kutaki | b47dc07388cf0646f0cc080abaebd9e357b188f2f4b8d6de0c7a3e67b989a718

Analysis

max time kernel
144s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/09/2022, 10:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Income_Tax_Receipt.exe
Size 656KB
Sample220905-mg376ahhd2
SHA256 8f541e14c1eae40515b2abc8bb11aa584cd754f668eec02f6a2bf7974d686357
MD5 d039b5c37d260eda505b03f97b963b3a
SHA1 f7d4b2a09d147cc05d63f8ae20f6e72ad0912bbb
SHA512 935c665290617855d4a60ba6b2a458a4d3cc086893df8549101fd04f704d00b57c4460981c20fb6a701ae73a776dddf7f2823d0a466590bbcb68298e1500e9d7
SSDEEP 12288:j7k+QuuMas9dpZHV10DSpbgJ2y+OC1HwJ5tChW4kZdnNrv750F46A9jmP/uhu/y8:vQkxZHV10DFikZdnNxfmP/UDMS08Ckn0
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

kutaki keylogger stealer

Malware Config

Extracted

Family

kutaki

http://newloshree.xyz/work/son.php

Signatures

Kutaki
Information stealer and keylogger that hides inside legitimate Visual Basic applications.
stealer keylogger kutaki

Kutaki Executable 2 IoCs

resource	yara_rule
behavioral2/files/0x000b000000022f5a-137.dat	family_kutaki
behavioral2/files/0x000b000000022f5a-136.dat	family_kutaki

Executes dropped EXE 1 IoCs

pid	Process
5068	kkxdrnch.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kkxdrnch.exe	Income_Tax_Receipt.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kkxdrnch.exe	Income_Tax_Receipt.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4628	Income_Tax_Receipt.exe
4628	Income_Tax_Receipt.exe
4628	Income_Tax_Receipt.exe
5068	kkxdrnch.exe
5068	kkxdrnch.exe
5068	kkxdrnch.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4628 wrote to memory of 1428	4628	Income_Tax_Receipt.exe	83
PID 4628 wrote to memory of 1428	4628	Income_Tax_Receipt.exe	83
PID 4628 wrote to memory of 1428	4628	Income_Tax_Receipt.exe	83
PID 4628 wrote to memory of 5068	4628	Income_Tax_Receipt.exe	87
PID 4628 wrote to memory of 5068	4628	Income_Tax_Receipt.exe	87
PID 4628 wrote to memory of 5068	4628	Income_Tax_Receipt.exe	87

C:\Users\Admin\AppData\Local\Temp\Income_Tax_Receipt.exe
"C:\Users\Admin\AppData\Local\Temp\Income_Tax_Receipt.exe"
1⤵
- Drops startup file
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4628
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\
  2⤵
  PID:1428
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kkxdrnch.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kkxdrnch.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5068

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

kkxdrnch.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kkxdrnch.exe
Size 656KB
SHA256 8f541e14c1eae40515b2abc8bb11aa584cd754f668eec02f6a2bf7974d686357
MD5 d039b5c37d260eda505b03f97b963b3a
SHA1 f7d4b2a09d147cc05d63f8ae20f6e72ad0912bbb
SHA512 935c665290617855d4a60ba6b2a458a4d3cc086893df8549101fd04f704d00b57c4460981c20fb6a701ae73a776dddf7f2823d0a466590bbcb68298e1500e9d7
SSDEEP 12288:j7k+QuuMas9dpZHV10DSpbgJ2y+OC1HwJ5tChW4kZdnNrv750F46A9jmP/uhu/y8:vQkxZHV10DFikZdnNxfmP/UDMS08Ckn0
MD5 SHA1 SHA512 SSDEEP

Submit Download