kutaki | efe869dde8d4abbf6d697566cf13ff253a8fd3066cf81e536bad37f05a8ba788

Analysis

max time kernel
140s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
13/09/2022, 02:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IncomeTax_Payment_Acknowledgement.exe
Size 2.4MB
Sample220913-dc2n4aeee8
SHA256 a19a7785b190a62882c5e1101de45d380ff7b61db8a7d76bbf07ab6d9a94d294
MD5 643a9bfe03a5ab7ce2afe23e6edf7950
SHA1 054e41125bf975932f88573cdbaac302a8ca3932
SHA512 4361308a7316b95fbbb90a51aa62550910624bef3b2aaec8b6d48bd081db1c51cca8e88710fc068b028e019dce1c81c066654462f856b803825ca32eb58db3bd
SSDEEP 24576:U6fWaOBKmi1nPWohnrGhRoqgnfmP/UDMS08Ckn3:ZGKmiFrSwfmP/SA8N
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

kutaki keylogger stealer

Malware Config

Extracted

Family

kutaki

http://newloshree.xyz/work/son.php

Signatures

Kutaki
Information stealer and keylogger that hides inside legitimate Visual Basic applications.
stealer keylogger kutaki

Kutaki Executable 2 IoCs

resource	yara_rule
behavioral2/files/0x000500000001daff-136.dat	family_kutaki
behavioral2/files/0x000500000001daff-137.dat	family_kutaki

Executes dropped EXE 1 IoCs

pid	Process
4032	bljduofk.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bljduofk.exe	IncomeTax_Payment_Acknowledgement.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bljduofk.exe	IncomeTax_Payment_Acknowledgement.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2520	IncomeTax_Payment_Acknowledgement.exe
2520	IncomeTax_Payment_Acknowledgement.exe
2520	IncomeTax_Payment_Acknowledgement.exe
4032	bljduofk.exe
4032	bljduofk.exe
4032	bljduofk.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 3480	2520	IncomeTax_Payment_Acknowledgement.exe	87
PID 2520 wrote to memory of 3480	2520	IncomeTax_Payment_Acknowledgement.exe	87
PID 2520 wrote to memory of 3480	2520	IncomeTax_Payment_Acknowledgement.exe	87
PID 2520 wrote to memory of 4032	2520	IncomeTax_Payment_Acknowledgement.exe	91
PID 2520 wrote to memory of 4032	2520	IncomeTax_Payment_Acknowledgement.exe	91
PID 2520 wrote to memory of 4032	2520	IncomeTax_Payment_Acknowledgement.exe	91

C:\Users\Admin\AppData\Local\Temp\IncomeTax_Payment_Acknowledgement.exe
"C:\Users\Admin\AppData\Local\Temp\IncomeTax_Payment_Acknowledgement.exe"
1⤵
- Drops startup file
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\
  2⤵
  PID:3480
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bljduofk.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bljduofk.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4032

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

bljduofk.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bljduofk.exe
Size 2.4MB
SHA256 a19a7785b190a62882c5e1101de45d380ff7b61db8a7d76bbf07ab6d9a94d294
MD5 643a9bfe03a5ab7ce2afe23e6edf7950
SHA1 054e41125bf975932f88573cdbaac302a8ca3932
SHA512 4361308a7316b95fbbb90a51aa62550910624bef3b2aaec8b6d48bd081db1c51cca8e88710fc068b028e019dce1c81c066654462f856b803825ca32eb58db3bd
SSDEEP 24576:U6fWaOBKmi1nPWohnrGhRoqgnfmP/UDMS08Ckn3:ZGKmiFrSwfmP/SA8N
MD5 SHA1 SHA512 SSDEEP

Submit Download