kutaki | cae9f198df106768c911029ef9dd41fc90a0fd482edabbc31a1eab6d31b92890

Analysis

max time kernel
103s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25/10/2022, 10:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

IncomeTax_Receipt.exe
Size

1.4MB
MD5

144d5d049c409c97f72fdf80071fda7a
SHA1

1699e0433c2bf8b2c986de4376bab92865fa1dac
SHA256

d839c7617c80517cdc500d6c52a3d4cfe3f2f5d587d0b6c5c5ccff094c12ea3a
SHA512

e4b86d46b5c5a179a5a072c39ca2d5bcbfdc5cbc2a161c2b2d8aa738360b6cf9d2e326da46d37758b062084efcfc7005c78b385a331f96b3c519ea3e9eda69ed
SSDEEP

24576:ZSy4uqCSN5l3ksJb7tb1Fdv11jfmP/UDMS08Ckn3/:8yMlzfmP/SA8Nv

Score

10^/10

kutaki keylogger stealer

Malware Config

Signatures

Kutaki
Information stealer and keylogger that hides inside legitimate Visual Basic applications.
stealer keylogger kutaki

Kutaki Executable 4 IoCs

resource	yara_rule
behavioral1/files/0x0007000000005c50-58.dat	family_kutaki
behavioral1/files/0x0007000000005c50-61.dat	family_kutaki
behavioral1/files/0x0007000000005c50-59.dat	family_kutaki
behavioral1/files/0x0007000000005c50-66.dat	family_kutaki

Executes dropped EXE 1 IoCs

pid	Process
1200	ydyztufk.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ydyztufk.exe	IncomeTax_Receipt.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ydyztufk.exe	IncomeTax_Receipt.exe

Loads dropped DLL 2 IoCs

pid	Process
1184	IncomeTax_Receipt.exe
1184	IncomeTax_Receipt.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1184	IncomeTax_Receipt.exe
1184	IncomeTax_Receipt.exe
1184	IncomeTax_Receipt.exe
1200	ydyztufk.exe
1200	ydyztufk.exe
1200	ydyztufk.exe
1200	ydyztufk.exe
1200	ydyztufk.exe
1200	ydyztufk.exe
1200	ydyztufk.exe
1200	ydyztufk.exe
1200	ydyztufk.exe
1200	ydyztufk.exe
1200	ydyztufk.exe
1200	ydyztufk.exe
1200	ydyztufk.exe
1200	ydyztufk.exe
1200	ydyztufk.exe
1200	ydyztufk.exe
1200	ydyztufk.exe
1200	ydyztufk.exe
1200	ydyztufk.exe
1200	ydyztufk.exe
1200	ydyztufk.exe
1200	ydyztufk.exe
1200	ydyztufk.exe
1200	ydyztufk.exe
1200	ydyztufk.exe
1200	ydyztufk.exe
1200	ydyztufk.exe
1200	ydyztufk.exe
1200	ydyztufk.exe
1200	ydyztufk.exe
1200	ydyztufk.exe
1200	ydyztufk.exe
1200	ydyztufk.exe
1200	ydyztufk.exe
1200	ydyztufk.exe
1200	ydyztufk.exe
1200	ydyztufk.exe
1200	ydyztufk.exe
1200	ydyztufk.exe
1200	ydyztufk.exe
1200	ydyztufk.exe
1200	ydyztufk.exe
1200	ydyztufk.exe
1200	ydyztufk.exe
1200	ydyztufk.exe
1200	ydyztufk.exe
1200	ydyztufk.exe
1200	ydyztufk.exe
1200	ydyztufk.exe
1200	ydyztufk.exe
1200	ydyztufk.exe
1200	ydyztufk.exe
1200	ydyztufk.exe
1200	ydyztufk.exe
1200	ydyztufk.exe
1200	ydyztufk.exe
1200	ydyztufk.exe
1200	ydyztufk.exe
1200	ydyztufk.exe
1200	ydyztufk.exe
1200	ydyztufk.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1184 wrote to memory of 1488	1184	IncomeTax_Receipt.exe	27
PID 1184 wrote to memory of 1488	1184	IncomeTax_Receipt.exe	27
PID 1184 wrote to memory of 1488	1184	IncomeTax_Receipt.exe	27
PID 1184 wrote to memory of 1488	1184	IncomeTax_Receipt.exe	27
PID 1184 wrote to memory of 1200	1184	IncomeTax_Receipt.exe	29
PID 1184 wrote to memory of 1200	1184	IncomeTax_Receipt.exe	29
PID 1184 wrote to memory of 1200	1184	IncomeTax_Receipt.exe	29
PID 1184 wrote to memory of 1200	1184	IncomeTax_Receipt.exe	29

C:\Users\Admin\AppData\Local\Temp\IncomeTax_Receipt.exe
"C:\Users\Admin\AppData\Local\Temp\IncomeTax_Receipt.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1184
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\
  2⤵
  PID:1488
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ydyztufk.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ydyztufk.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1200

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ydyztufk.exe

Filesize
1.4MB

MD5
144d5d049c409c97f72fdf80071fda7a

SHA1
1699e0433c2bf8b2c986de4376bab92865fa1dac

SHA256
d839c7617c80517cdc500d6c52a3d4cfe3f2f5d587d0b6c5c5ccff094c12ea3a

SHA512
e4b86d46b5c5a179a5a072c39ca2d5bcbfdc5cbc2a161c2b2d8aa738360b6cf9d2e326da46d37758b062084efcfc7005c78b385a331f96b3c519ea3e9eda69ed

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ydyztufk.exe

Filesize
1.4MB

MD5
144d5d049c409c97f72fdf80071fda7a

SHA1
1699e0433c2bf8b2c986de4376bab92865fa1dac

SHA256
d839c7617c80517cdc500d6c52a3d4cfe3f2f5d587d0b6c5c5ccff094c12ea3a

SHA512
e4b86d46b5c5a179a5a072c39ca2d5bcbfdc5cbc2a161c2b2d8aa738360b6cf9d2e326da46d37758b062084efcfc7005c78b385a331f96b3c519ea3e9eda69ed

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ydyztufk.exe

Filesize
1.4MB

MD5
144d5d049c409c97f72fdf80071fda7a

SHA1
1699e0433c2bf8b2c986de4376bab92865fa1dac

SHA256
d839c7617c80517cdc500d6c52a3d4cfe3f2f5d587d0b6c5c5ccff094c12ea3a

SHA512
e4b86d46b5c5a179a5a072c39ca2d5bcbfdc5cbc2a161c2b2d8aa738360b6cf9d2e326da46d37758b062084efcfc7005c78b385a331f96b3c519ea3e9eda69ed

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ydyztufk.exe

Filesize
1.4MB

MD5
144d5d049c409c97f72fdf80071fda7a

SHA1
1699e0433c2bf8b2c986de4376bab92865fa1dac

SHA256
d839c7617c80517cdc500d6c52a3d4cfe3f2f5d587d0b6c5c5ccff094c12ea3a

SHA512
e4b86d46b5c5a179a5a072c39ca2d5bcbfdc5cbc2a161c2b2d8aa738360b6cf9d2e326da46d37758b062084efcfc7005c78b385a331f96b3c519ea3e9eda69ed

Download Submit
memory/1184-56-0x0000000074BB1000-0x0000000074BB3000-memory.dmp

Filesize
8KB

Download
memory/1200-65-0x0000000004181000-0x000000000502D000-memory.dmp

Filesize
14.7MB

Download