Overview

overview

10

Static

static

URLScan

urlscan

1

http://eic.in.net/it...

windows7-x64

10

http://eic.in.net/it...

windows10-2004-x64

10

Analysis

  • max time kernel
    140s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/09/2022, 04:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    http://eic.in.net/itt.htm
  • Sample220921-e9lvksafej
Score
10/10
kutakikeyloggerstealer

Malware Config

Extracted

Family

  • kutaki

C2

  • http://newbosslink.xyz/baba/new4.php

Signatures

  • Kutaki

    Information stealer and keylogger that hides inside legitimate Visual Basic applications.

    stealerkeyloggerkutaki
  • Kutaki Executable 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 43 IoCs
    adwarespyware
  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 16 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://eic.in.net/itt.htm
    1⤵
    • Modifies Internet Explorer Phishing Filter
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5000
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5000 CREDAT:17410 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2036
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:4880
    • C:\Users\Admin\AppData\Local\Temp\Temp1_Tax Payment Challan.zip\Tax Payment Challan.exe
      "C:\Users\Admin\AppData\Local\Temp\Temp1_Tax Payment Challan.zip\Tax Payment Challan.exe"
      1⤵
      • Drops startup file
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3492
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c C:\Users\Admin\AppData\Local\Temp\NewBitmapImage.bmp
        2⤵
        • Checks computer location settings
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:1152
        • C:\Windows\SysWOW64\mspaint.exe
          "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\NewBitmapImage.bmp"
          3⤵
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          PID:1112
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ch.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ch.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:4528
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
      1⤵
        PID:1464

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
            • Size 471B
            • SHA256 fd9644d82e1e00505eb4e716136b42befb20145a05057f0cb052d1793a853a58
            • MD5 SHA1 SHA512
            Submit Download

            7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
            • Size 404B
            • SHA256 6010630d7d80c2d6e71ac232d5d72dbf1e826aa15c0e0e876440fd7883e39667
            • MD5 SHA1 SHA512
            Submit Download

            Tax Payment Challan.zip.phlsner.partial
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DU2BEY67\Tax Payment Challan.zip.phlsner.partial
            • Size 297KB
            • SHA256 dde0124bda68711f66fcfbe85fd13fe2d484166706110ae8a4534df6d441c613
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            ch.exe
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ch.exe
            • Size 368KB
            • SHA256 d988bc3914a3a156bb8141ccaf92997da443c5701c0eacb1c9a64a81659716dd
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            ch.exe
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ch.exe
            • Size 368KB
            • SHA256 d988bc3914a3a156bb8141ccaf92997da443c5701c0eacb1c9a64a81659716dd
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download