kutaki | b47dc07388cf0646f0cc080abaebd9e357b188f2f4b8d6de0c7a3e67b989a718

Analysis

max time kernel
144s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/09/2022, 10:27

Target

Income_Tax_Receipt.exe
Size

656KB
MD5

d039b5c37d260eda505b03f97b963b3a
SHA1

f7d4b2a09d147cc05d63f8ae20f6e72ad0912bbb
SHA256

8f541e14c1eae40515b2abc8bb11aa584cd754f668eec02f6a2bf7974d686357
SHA512

935c665290617855d4a60ba6b2a458a4d3cc086893df8549101fd04f704d00b57c4460981c20fb6a701ae73a776dddf7f2823d0a466590bbcb68298e1500e9d7
SSDEEP

12288:j7k+QuuMas9dpZHV10DSpbgJ2y+OC1HwJ5tChW4kZdnNrv750F46A9jmP/uhu/y8:vQkxZHV10DFikZdnNxfmP/UDMS08Ckn0

Score

10^/10

Family

kutaki

http://newloshree.xyz/work/son.php

Kutaki
Information stealer and keylogger that hides inside legitimate Visual Basic applications.
stealer keylogger kutaki

Kutaki Executable 2 IoCs

resource	yara_rule
behavioral2/files/0x000b000000022f5a-137.dat	family_kutaki
behavioral2/files/0x000b000000022f5a-136.dat	family_kutaki

Executes dropped EXE 1 IoCs

pid	Process
5068	kkxdrnch.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kkxdrnch.exe	Income_Tax_Receipt.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kkxdrnch.exe	Income_Tax_Receipt.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4628 wrote to memory of 1428	4628	Income_Tax_Receipt.exe	83
PID 4628 wrote to memory of 1428	4628	Income_Tax_Receipt.exe	83
PID 4628 wrote to memory of 1428	4628	Income_Tax_Receipt.exe	83
PID 4628 wrote to memory of 5068	4628	Income_Tax_Receipt.exe	87
PID 4628 wrote to memory of 5068	4628	Income_Tax_Receipt.exe	87
PID 4628 wrote to memory of 5068	4628	Income_Tax_Receipt.exe	87

C:\Users\Admin\AppData\Local\Temp\Income_Tax_Receipt.exe
"C:\Users\Admin\AppData\Local\Temp\Income_Tax_Receipt.exe"
1⤵
- Drops startup file
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4628
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\
  2⤵
  PID:1428
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kkxdrnch.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kkxdrnch.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5068

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kkxdrnch.exe

Filesize
656KB

MD5
d039b5c37d260eda505b03f97b963b3a

SHA1
f7d4b2a09d147cc05d63f8ae20f6e72ad0912bbb

SHA256
8f541e14c1eae40515b2abc8bb11aa584cd754f668eec02f6a2bf7974d686357

SHA512
935c665290617855d4a60ba6b2a458a4d3cc086893df8549101fd04f704d00b57c4460981c20fb6a701ae73a776dddf7f2823d0a466590bbcb68298e1500e9d7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kkxdrnch.exe

Filesize
656KB

MD5
d039b5c37d260eda505b03f97b963b3a

SHA1
f7d4b2a09d147cc05d63f8ae20f6e72ad0912bbb

SHA256
8f541e14c1eae40515b2abc8bb11aa584cd754f668eec02f6a2bf7974d686357

SHA512
935c665290617855d4a60ba6b2a458a4d3cc086893df8549101fd04f704d00b57c4460981c20fb6a701ae73a776dddf7f2823d0a466590bbcb68298e1500e9d7

Download Submit