kutaki | b47dc07388cf0646f0cc080abaebd9e357b188f2f4b8d6de0c7a3e67b989a718

Analysis

max time kernel
140s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
09-09-2022 14:23

Target

Income_Tax_Receipt.exe
Size

656KB
MD5

d039b5c37d260eda505b03f97b963b3a
SHA1

f7d4b2a09d147cc05d63f8ae20f6e72ad0912bbb
SHA256

8f541e14c1eae40515b2abc8bb11aa584cd754f668eec02f6a2bf7974d686357
SHA512

935c665290617855d4a60ba6b2a458a4d3cc086893df8549101fd04f704d00b57c4460981c20fb6a701ae73a776dddf7f2823d0a466590bbcb68298e1500e9d7
SSDEEP

12288:j7k+QuuMas9dpZHV10DSpbgJ2y+OC1HwJ5tChW4kZdnNrv750F46A9jmP/uhu/y8:vQkxZHV10DFikZdnNxfmP/UDMS08Ckn0

Score

10^/10

Family

kutaki

http://newloshree.xyz/work/son.php

Kutaki
Information stealer and keylogger that hides inside legitimate Visual Basic applications.
stealer keylogger kutaki

Kutaki Executable 2 IoCs

resource	yara_rule
behavioral2/files/0x000200000001e57e-136.dat	family_kutaki
behavioral2/files/0x000200000001e57e-137.dat	family_kutaki

Executes dropped EXE 1 IoCs

pid	Process
4996	pebvvych.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pebvvych.exe	Income_Tax_Receipt.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pebvvych.exe	Income_Tax_Receipt.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1400 wrote to memory of 224	1400	Income_Tax_Receipt.exe	84
PID 1400 wrote to memory of 224	1400	Income_Tax_Receipt.exe	84
PID 1400 wrote to memory of 224	1400	Income_Tax_Receipt.exe	84
PID 1400 wrote to memory of 4996	1400	Income_Tax_Receipt.exe	88
PID 1400 wrote to memory of 4996	1400	Income_Tax_Receipt.exe	88
PID 1400 wrote to memory of 4996	1400	Income_Tax_Receipt.exe	88

C:\Users\Admin\AppData\Local\Temp\Income_Tax_Receipt.exe
"C:\Users\Admin\AppData\Local\Temp\Income_Tax_Receipt.exe"
1⤵
- Drops startup file
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1400
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\
  2⤵
  PID:224
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pebvvych.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pebvvych.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4996

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pebvvych.exe

Filesize
656KB

MD5
d039b5c37d260eda505b03f97b963b3a

SHA1
f7d4b2a09d147cc05d63f8ae20f6e72ad0912bbb

SHA256
8f541e14c1eae40515b2abc8bb11aa584cd754f668eec02f6a2bf7974d686357

SHA512
935c665290617855d4a60ba6b2a458a4d3cc086893df8549101fd04f704d00b57c4460981c20fb6a701ae73a776dddf7f2823d0a466590bbcb68298e1500e9d7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pebvvych.exe

Filesize
656KB

MD5
d039b5c37d260eda505b03f97b963b3a

SHA1
f7d4b2a09d147cc05d63f8ae20f6e72ad0912bbb

SHA256
8f541e14c1eae40515b2abc8bb11aa584cd754f668eec02f6a2bf7974d686357

SHA512
935c665290617855d4a60ba6b2a458a4d3cc086893df8549101fd04f704d00b57c4460981c20fb6a701ae73a776dddf7f2823d0a466590bbcb68298e1500e9d7

Download Submit
memory/224-134-0x0000000000000000-mapping.dmp

Download
memory/4996-135-0x0000000000000000-mapping.dmp

Download