kutaki | cae9f198df106768c911029ef9dd41fc90a0fd482edabbc31a1eab6d31b92890

Analysis

max time kernel
158s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25/10/2022, 10:15

Target

IncomeTax_Receipt.exe
Size

1.4MB
MD5

144d5d049c409c97f72fdf80071fda7a
SHA1

1699e0433c2bf8b2c986de4376bab92865fa1dac
SHA256

d839c7617c80517cdc500d6c52a3d4cfe3f2f5d587d0b6c5c5ccff094c12ea3a
SHA512

e4b86d46b5c5a179a5a072c39ca2d5bcbfdc5cbc2a161c2b2d8aa738360b6cf9d2e326da46d37758b062084efcfc7005c78b385a331f96b3c519ea3e9eda69ed
SSDEEP

24576:ZSy4uqCSN5l3ksJb7tb1Fdv11jfmP/UDMS08Ckn3/:8yMlzfmP/SA8Nv

Score

10^/10

Kutaki
Information stealer and keylogger that hides inside legitimate Visual Basic applications.
stealer keylogger kutaki

Kutaki Executable 2 IoCs

resource	yara_rule
behavioral2/files/0x000500000001da01-136.dat	family_kutaki
behavioral2/files/0x000500000001da01-137.dat	family_kutaki

Executes dropped EXE 1 IoCs

pid	Process
1988	wogmrnfk.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wogmrnfk.exe	IncomeTax_Receipt.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wogmrnfk.exe	IncomeTax_Receipt.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3252 wrote to memory of 4660	3252	IncomeTax_Receipt.exe	82
PID 3252 wrote to memory of 4660	3252	IncomeTax_Receipt.exe	82
PID 3252 wrote to memory of 4660	3252	IncomeTax_Receipt.exe	82
PID 3252 wrote to memory of 1988	3252	IncomeTax_Receipt.exe	86
PID 3252 wrote to memory of 1988	3252	IncomeTax_Receipt.exe	86
PID 3252 wrote to memory of 1988	3252	IncomeTax_Receipt.exe	86

C:\Users\Admin\AppData\Local\Temp\IncomeTax_Receipt.exe
"C:\Users\Admin\AppData\Local\Temp\IncomeTax_Receipt.exe"
1⤵
- Drops startup file
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3252
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\
  2⤵
  PID:4660
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wogmrnfk.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wogmrnfk.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1988

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wogmrnfk.exe

Filesize
1.4MB

MD5
144d5d049c409c97f72fdf80071fda7a

SHA1
1699e0433c2bf8b2c986de4376bab92865fa1dac

SHA256
d839c7617c80517cdc500d6c52a3d4cfe3f2f5d587d0b6c5c5ccff094c12ea3a

SHA512
e4b86d46b5c5a179a5a072c39ca2d5bcbfdc5cbc2a161c2b2d8aa738360b6cf9d2e326da46d37758b062084efcfc7005c78b385a331f96b3c519ea3e9eda69ed

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wogmrnfk.exe

Filesize
1.4MB

MD5
144d5d049c409c97f72fdf80071fda7a

SHA1
1699e0433c2bf8b2c986de4376bab92865fa1dac

SHA256
d839c7617c80517cdc500d6c52a3d4cfe3f2f5d587d0b6c5c5ccff094c12ea3a

SHA512
e4b86d46b5c5a179a5a072c39ca2d5bcbfdc5cbc2a161c2b2d8aa738360b6cf9d2e326da46d37758b062084efcfc7005c78b385a331f96b3c519ea3e9eda69ed

Download Submit