kutaki | 91b9ab308bdf9f41bf08f6529145a5219c90917be1cca844425a04bf9ee1216e

Analysis

max time kernel
172s
max time network
183s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25/10/2022, 10:15

Target

INCOMETAX_CHALLAN_COPY.exe
Size

1.4MB
MD5

702bb8f393cc2dba7181b407175c2d20
SHA1

5ede8da72c0e18a528edc56c5fb254f894a1aec0
SHA256

5ab0fd363096157c4a3ae912e126b20c7d31d15887b3c0c04a90b6b4d1a2f03b
SHA512

d951434277bc2e4a761fc8ad504bafeaf8e98921d5dc011ceabe3aa3fc36ce0fd06c75d7f10703483a655c80f3ceead706c65330ca94df92c8051abb1e2143ce
SSDEEP

24576:1Sy4uqCSN5l3ksJb7tb1Fdv11KfmP/UDMS08Ckn3f:wyMlafmP/SA8NP

Score

10^/10

Kutaki
Information stealer and keylogger that hides inside legitimate Visual Basic applications.
stealer keylogger kutaki

Kutaki Executable 2 IoCs

resource	yara_rule
behavioral2/files/0x000900000001db4e-136.dat	family_kutaki
behavioral2/files/0x000900000001db4e-137.dat	family_kutaki

Executes dropped EXE 1 IoCs

pid	Process
60	tgdvsxfk.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tgdvsxfk.exe	INCOMETAX_CHALLAN_COPY.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tgdvsxfk.exe	INCOMETAX_CHALLAN_COPY.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4924 wrote to memory of 2420	4924	INCOMETAX_CHALLAN_COPY.exe	80
PID 4924 wrote to memory of 2420	4924	INCOMETAX_CHALLAN_COPY.exe	80
PID 4924 wrote to memory of 2420	4924	INCOMETAX_CHALLAN_COPY.exe	80
PID 4924 wrote to memory of 60	4924	INCOMETAX_CHALLAN_COPY.exe	86
PID 4924 wrote to memory of 60	4924	INCOMETAX_CHALLAN_COPY.exe	86
PID 4924 wrote to memory of 60	4924	INCOMETAX_CHALLAN_COPY.exe	86

C:\Users\Admin\AppData\Local\Temp\INCOMETAX_CHALLAN_COPY.exe
"C:\Users\Admin\AppData\Local\Temp\INCOMETAX_CHALLAN_COPY.exe"
1⤵
- Drops startup file
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4924
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\
  2⤵
  PID:2420
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tgdvsxfk.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tgdvsxfk.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:60

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tgdvsxfk.exe

Filesize
1.4MB

MD5
702bb8f393cc2dba7181b407175c2d20

SHA1
5ede8da72c0e18a528edc56c5fb254f894a1aec0

SHA256
5ab0fd363096157c4a3ae912e126b20c7d31d15887b3c0c04a90b6b4d1a2f03b

SHA512
d951434277bc2e4a761fc8ad504bafeaf8e98921d5dc011ceabe3aa3fc36ce0fd06c75d7f10703483a655c80f3ceead706c65330ca94df92c8051abb1e2143ce

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tgdvsxfk.exe

Filesize
1.4MB

MD5
702bb8f393cc2dba7181b407175c2d20

SHA1
5ede8da72c0e18a528edc56c5fb254f894a1aec0

SHA256
5ab0fd363096157c4a3ae912e126b20c7d31d15887b3c0c04a90b6b4d1a2f03b

SHA512
d951434277bc2e4a761fc8ad504bafeaf8e98921d5dc011ceabe3aa3fc36ce0fd06c75d7f10703483a655c80f3ceead706c65330ca94df92c8051abb1e2143ce

Download Submit