kutaki | 1252-67-0x0000000000400000-0x0000000000669000-memory[.]dmp

General

Target
1252-67-0x0000000000400000-0x0000000000669000-memory.dmp
Size 2.4MB
Sample220920-hadlpsfgbl
SHA256 fc7c59182246af43dd5675ac762ad50fa0ea65c6ca49e8f4b4a5a761b61c5926
MD5 95079465a646b30c5d364bc63963f5b3
SHA1 d9834d202f1387c4b7bb75067cfb020f41255fee
SHA512 f17adf5fd63df50914c206f563842e7cb1198b6b41bc5f27b97c3091a33b8aa13010ba258a83573c4d5e5ca627c1143d9f0226a4f964a0386075c458a8a94a0f
SSDEEP 12288:cscRkK9uowuoyuo3f8j9ysMXFLcCjbWaOBK7Ki1nkC+lbuiNyb7OAUrfPa:mfWaOBKmi1neuiN87OAU
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

kutaki

Malware Config

Signatures

Kutaki Executable 1 IoCs

resource	yara_rule
sample	family_kutaki

Kutaki family
kutaki

File Explorer

1252-67-0x0000000000400000-0x0000000000669000-memory.dmp

.exe 2.4MB

1252-67-0x0000000000400000-0x0000000000669000-memory.dmp

IMPHASH a1f738693e64ee5c693bac4e539f7b86
SHA256 fc7c59182246af43dd5675ac762ad50fa0ea65c6ca49e8f4b4a5a761b61c5926
MD5 95079465a646b30c5d364bc63963f5b3
SHA1 d9834d202f1387c4b7bb75067cfb020f41255fee
SHA512 f17adf5fd63df50914c206f563842e7cb1198b6b41bc5f27b97c3091a33b8aa13010ba258a83573c4d5e5ca627c1143d9f0226a4f964a0386075c458a8a94a0f
SSDEEP 12288:cscRkK9uowuoyuo3f8j9ysMXFLcCjbWaOBK7Ki1nkC+lbuiNyb7OAUrfPa:mfWaOBKmi1neuiN87OAU
MD5 SHA1 SHA512 SSDEEP

windows x86

Kutaki Executable

Minor OS version

Major OS version

Entry point

17836

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

EVENT_SINK_GetIDsOfNames __vbaVarTstGt __vbaVarSub ord690 __vbaStrI2 _CIcos _adj_fptan __vbaStrI4 __vbaHresultCheck __vbaVarMove __vbaVarVargNofree __vbaAryMove __vbaFreeVar __vbaLenBstr __vbaLateIdCall __vbaStrVarMove ord696 __vbaPut3 __vbaEnd __vbaFreeVarList _adj_fdiv_m64 ord698 EVENT_SINK_Invoke __vbaNextEachVar __vbaFreeObjList ord516 __vbaVarIndexLoadRef __vbaStrErrVarCopy _adj_fprem1 ord518 __vbaRecAnsiToUni ord626 ord519 __vbaForEachCollAd __vbaVarCmpNe __vbaStrCat ord660 __vbaRecDestruct __vbaSetSystemError __vbaLenBstrB __vbaHresultCheckObj __vbaLenVar _adj_fdiv_m32 ord666 __vbaAryVar __vbaVarTstLe ord667 Zombie_GetTypeInfo __vbaAryDestruct ord591 __vbaVarIndexLoadRefLock ord593 __vbaForEachCollObj __vbaVarForInit __vbaExitProc ord300 ord594 __vbaOnError __vbaObjSet ord595 ord596 _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i __vbaVarIndexLoad ord598 ord599 ord306 __vbaForEachCollVar ord520 __vbaFpR8 __vbaRefVarAry __vbaBoolVarNull _CIsin ord631 __vbaErase __vbaVarCmpGt __vbaVargVarMove ord525 ord632 __vbaNextEachCollObj __vbaChkstk ord526 __vbaFileClose EVENT_SINK_AddRef ord528 __vbaGenerateBoundsError __vbaGet3 ord529 __vbaStrCmp __vbaAryConstruct2 __vbaVarTstEq __vbaPutOwner4 __vbaNextEachCollVar ord561 __vbaI2I4 __vbaObjVar DllFunctionCall ord563 ord670 __vbaVarLateMemSt __vbaVarOr ord564 __vbaCastObjVar __vbaLbound _adj_fpatan __vbaR4Var __vbaLateIdCallLd Zombie_GetTypeInfoCount __vbaR8Cy __vbaRedim __vbaStrR8 __vbaRecUniToAnsi EVENT_SINK_Release __vbaNew ord600 ord601 __vbaUI1I2 _CIsqrt __vbaObjIs __vbaVarAnd EVENT_SINK_QueryInterface __vbaStr2Vec __vbaUI1I4 __vbaVarMul __vbaExceptHandler ord711 __vbaPrintFile ord712 __vbaStrToUnicode ord713 ord606 _adj_fprem _adj_fdivr_m64 ord714 ord607 __vbaVarDiv ord608 ord531 __vbaFPException ord717 __vbaInStrVar ord319 __vbaUbound __vbaStrVarVal __vbaVarCat __vbaI2Var ord644 ord537 ord645 _CIlog __vbaErrorOverflow __vbaFileOpen ord570 ord648 __vbaVar2Vec __vbaInStr __vbaVarLateMemCallLdRf __vbaR8Str __vbaNew2 _adj_fdiv_m32i _adj_fdivr_m32i __vbaVarSetObj ord573 __vbaStrCopy __vbaI4Str ord681 __vbaVarCmpLt __vbaFreeStrList ord576 _adj_fdivr_m32 __vbaPowerR8 __vbaR8Var _adj_fdiv_r ord685 ord100 __vbaVarTstNe __vbaI4Var ord689 __vbaVarCmpEq __vbaFpCy ord610 __vbaAryLock __vbaVarAdd __vbaLateMemCall ord320 __vbaStrComp __vbaStrToAnsi __vbaVarDup ord321 __vbaFpI4 ord616 __vbaVarCopy __vbaVarLateMemCallLd __vbaLateMemCallLd __vbaRecDestructAnsi ord617 _CIatan __vbaAryCopy ord618 __vbaCastObj __vbaStrMove __vbaForEachVar ord619 __vbaR8IntI4 __vbaStrVarCopy ord650 _allmul __vbaLateIdSt _CItan __vbaNextEachCollAd __vbaAryUnlock __vbaUI1Var __vbaVarForNext _CIexp __vbaFreeObj __vbaFreeStr ord581

Sharing