Analysis
- max time kernel
69s - max time network
44s - platform
windows7_x64 - resource
win7-20220812-en - resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system - submitted
13/09/2022, 02:52
Behavioral task
behavioral1
Sample
IncomeTax_Payment_Acknowledgement.exe
Resource
win7-20220812-en
windows7-x64
7 signatures
150 seconds
General
- Target IncomeTax_Payment_Acknowledgement.exe
- Size 2.4MB
- Sample220913-dc2n4aeee8
- SHA256 a19a7785b190a62882c5e1101de45d380ff7b61db8a7d76bbf07ab6d9a94d294
- MD5 643a9bfe03a5ab7ce2afe23e6edf7950
- SHA1 054e41125bf975932f88573cdbaac302a8ca3932
- SHA512 4361308a7316b95fbbb90a51aa62550910624bef3b2aaec8b6d48bd081db1c51cca8e88710fc068b028e019dce1c81c066654462f856b803825ca32eb58db3bd
- SSDEEP 24576:U6fWaOBKmi1nPWohnrGhRoqgnfmP/UDMS08Ckn3:ZGKmiFrSwfmP/SA8N
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
kutaki
C2
-
http://newloshree.xyz/work/son.php
Signatures
- Kutaki Executable 3 IoCs
resource yara_rule behavioral1/files/0x0007000000005c50-58.dat family_kutaki behavioral1/files/0x0007000000005c50-59.dat family_kutaki behavioral1/files/0x0007000000005c50-61.dat family_kutaki - Executes dropped EXE 1 IoCs
pid Process 1560 frqjbafk.exe - Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\frqjbafk.exe IncomeTax_Payment_Acknowledgement.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\frqjbafk.exe IncomeTax_Payment_Acknowledgement.exe - Loads dropped DLL 2 IoCs
pid Process 1088 IncomeTax_Payment_Acknowledgement.exe 1088 IncomeTax_Payment_Acknowledgement.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1088 IncomeTax_Payment_Acknowledgement.exe 1088 IncomeTax_Payment_Acknowledgement.exe 1088 IncomeTax_Payment_Acknowledgement.exe 1560 frqjbafk.exe 1560 frqjbafk.exe 1560 frqjbafk.exe 1560 frqjbafk.exe 1560 frqjbafk.exe 1560 frqjbafk.exe 1560 frqjbafk.exe 1560 frqjbafk.exe 1560 frqjbafk.exe 1560 frqjbafk.exe 1560 frqjbafk.exe 1560 frqjbafk.exe 1560 frqjbafk.exe 1560 frqjbafk.exe 1560 frqjbafk.exe 1560 frqjbafk.exe 1560 frqjbafk.exe 1560 frqjbafk.exe 1560 frqjbafk.exe 1560 frqjbafk.exe 1560 frqjbafk.exe 1560 frqjbafk.exe 1560 frqjbafk.exe 1560 frqjbafk.exe 1560 frqjbafk.exe 1560 frqjbafk.exe 1560 frqjbafk.exe 1560 frqjbafk.exe 1560 frqjbafk.exe 1560 frqjbafk.exe 1560 frqjbafk.exe 1560 frqjbafk.exe 1560 frqjbafk.exe 1560 frqjbafk.exe 1560 frqjbafk.exe 1560 frqjbafk.exe 1560 frqjbafk.exe 1560 frqjbafk.exe 1560 frqjbafk.exe 1560 frqjbafk.exe 1560 frqjbafk.exe 1560 frqjbafk.exe 1560 frqjbafk.exe 1560 frqjbafk.exe 1560 frqjbafk.exe 1560 frqjbafk.exe 1560 frqjbafk.exe 1560 frqjbafk.exe 1560 frqjbafk.exe 1560 frqjbafk.exe 1560 frqjbafk.exe 1560 frqjbafk.exe 1560 frqjbafk.exe 1560 frqjbafk.exe 1560 frqjbafk.exe 1560 frqjbafk.exe 1560 frqjbafk.exe 1560 frqjbafk.exe 1560 frqjbafk.exe 1560 frqjbafk.exe 1560 frqjbafk.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1088 wrote to memory of 1548 1088 IncomeTax_Payment_Acknowledgement.exe 27 PID 1088 wrote to memory of 1548 1088 IncomeTax_Payment_Acknowledgement.exe 27 PID 1088 wrote to memory of 1548 1088 IncomeTax_Payment_Acknowledgement.exe 27 PID 1088 wrote to memory of 1548 1088 IncomeTax_Payment_Acknowledgement.exe 27 PID 1088 wrote to memory of 1560 1088 IncomeTax_Payment_Acknowledgement.exe 29 PID 1088 wrote to memory of 1560 1088 IncomeTax_Payment_Acknowledgement.exe 29 PID 1088 wrote to memory of 1560 1088 IncomeTax_Payment_Acknowledgement.exe 29 PID 1088 wrote to memory of 1560 1088 IncomeTax_Payment_Acknowledgement.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\IncomeTax_Payment_Acknowledgement.exe"C:\Users\Admin\AppData\Local\Temp\IncomeTax_Payment_Acknowledgement.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Users\Admin\AppData\Local\Temp\2⤵PID:1548
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\frqjbafk.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\frqjbafk.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1560
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\frqjbafk.exe
- Size 2.4MB
- SHA256 a19a7785b190a62882c5e1101de45d380ff7b61db8a7d76bbf07ab6d9a94d294
- MD5 643a9bfe03a5ab7ce2afe23e6edf7950
- SHA1 054e41125bf975932f88573cdbaac302a8ca3932
- SHA512 4361308a7316b95fbbb90a51aa62550910624bef3b2aaec8b6d48bd081db1c51cca8e88710fc068b028e019dce1c81c066654462f856b803825ca32eb58db3bd
- SSDEEP 24576:U6fWaOBKmi1nPWohnrGhRoqgnfmP/UDMS08Ckn3:ZGKmiFrSwfmP/SA8N
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\frqjbafk.exe
- Size 2.4MB
- SHA256 a19a7785b190a62882c5e1101de45d380ff7b61db8a7d76bbf07ab6d9a94d294
- MD5 643a9bfe03a5ab7ce2afe23e6edf7950
- SHA1 054e41125bf975932f88573cdbaac302a8ca3932
- SHA512 4361308a7316b95fbbb90a51aa62550910624bef3b2aaec8b6d48bd081db1c51cca8e88710fc068b028e019dce1c81c066654462f856b803825ca32eb58db3bd
- SSDEEP 24576:U6fWaOBKmi1nPWohnrGhRoqgnfmP/UDMS08Ckn3:ZGKmiFrSwfmP/SA8N
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\frqjbafk.exe
- Size 2.4MB
- SHA256 a19a7785b190a62882c5e1101de45d380ff7b61db8a7d76bbf07ab6d9a94d294
- MD5 643a9bfe03a5ab7ce2afe23e6edf7950
- SHA1 054e41125bf975932f88573cdbaac302a8ca3932
- SHA512 4361308a7316b95fbbb90a51aa62550910624bef3b2aaec8b6d48bd081db1c51cca8e88710fc068b028e019dce1c81c066654462f856b803825ca32eb58db3bd
- SSDEEP 24576:U6fWaOBKmi1nPWohnrGhRoqgnfmP/UDMS08Ckn3:ZGKmiFrSwfmP/SA8N
- MD5 SHA1 SHA512 SSDEEP