kutaki | 1a3baff7083619571a375795049718bc745e555a25ea3e248848c536671fef35

Analysis

max time kernel
150s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
19-01-2023 08:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7ff7b7eedc089b658ba80ec8cb0748f9.exe
Size

453KB
MD5

7ff7b7eedc089b658ba80ec8cb0748f9
SHA1

1840814d053eb5327e68db983215316008e84bdb
SHA256

1a3baff7083619571a375795049718bc745e555a25ea3e248848c536671fef35
SHA512

5c370ad1314d4d0c66aad6518b93ecba45835766feabd26bada33e6b6aa4ba68ff766257db0f91f2643a680fbbf061bf99185dfc5e55fec20a9e86c7256b4472
SSDEEP

12288:+U4Tisi246A9jmP/uhu/yMS08CkntxYRPL:lDsKfmP/UDMS08Ckn3K

Score

10^/10

kutaki keylogger stealer

Malware Config

Extracted

Family

kutaki

http://newbosslink.xyz/baba/new4.php

Signatures

Kutaki
Information stealer and keylogger that hides inside legitimate Visual Basic applications.
stealer keylogger kutaki

Kutaki Executable 3 IoCs

resource	yara_rule
behavioral1/files/0x00070000000142ea-61.dat	family_kutaki
behavioral1/files/0x00070000000142ea-59.dat	family_kutaki
behavioral1/files/0x00070000000142ea-58.dat	family_kutaki

Executes dropped EXE 1 IoCs

pid	Process
940	mtzjnlfk.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mtzjnlfk.exe	7ff7b7eedc089b658ba80ec8cb0748f9.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mtzjnlfk.exe	7ff7b7eedc089b658ba80ec8cb0748f9.exe

Loads dropped DLL 2 IoCs

pid	Process
832	7ff7b7eedc089b658ba80ec8cb0748f9.exe
832	7ff7b7eedc089b658ba80ec8cb0748f9.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1692	DllHost.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
832	7ff7b7eedc089b658ba80ec8cb0748f9.exe
832	7ff7b7eedc089b658ba80ec8cb0748f9.exe
832	7ff7b7eedc089b658ba80ec8cb0748f9.exe
940	mtzjnlfk.exe
940	mtzjnlfk.exe
940	mtzjnlfk.exe
940	mtzjnlfk.exe
940	mtzjnlfk.exe
940	mtzjnlfk.exe
940	mtzjnlfk.exe
940	mtzjnlfk.exe
940	mtzjnlfk.exe
940	mtzjnlfk.exe
940	mtzjnlfk.exe
940	mtzjnlfk.exe
940	mtzjnlfk.exe
940	mtzjnlfk.exe
940	mtzjnlfk.exe
940	mtzjnlfk.exe
940	mtzjnlfk.exe
940	mtzjnlfk.exe
940	mtzjnlfk.exe
940	mtzjnlfk.exe
940	mtzjnlfk.exe
940	mtzjnlfk.exe
940	mtzjnlfk.exe
940	mtzjnlfk.exe
940	mtzjnlfk.exe
940	mtzjnlfk.exe
940	mtzjnlfk.exe
940	mtzjnlfk.exe
940	mtzjnlfk.exe
940	mtzjnlfk.exe
940	mtzjnlfk.exe
940	mtzjnlfk.exe
940	mtzjnlfk.exe
940	mtzjnlfk.exe
940	mtzjnlfk.exe
940	mtzjnlfk.exe
940	mtzjnlfk.exe
940	mtzjnlfk.exe
940	mtzjnlfk.exe
940	mtzjnlfk.exe
940	mtzjnlfk.exe
940	mtzjnlfk.exe
940	mtzjnlfk.exe
940	mtzjnlfk.exe
940	mtzjnlfk.exe
940	mtzjnlfk.exe
940	mtzjnlfk.exe
940	mtzjnlfk.exe
940	mtzjnlfk.exe
940	mtzjnlfk.exe
940	mtzjnlfk.exe
940	mtzjnlfk.exe
940	mtzjnlfk.exe
940	mtzjnlfk.exe
940	mtzjnlfk.exe
940	mtzjnlfk.exe
940	mtzjnlfk.exe
940	mtzjnlfk.exe
940	mtzjnlfk.exe
940	mtzjnlfk.exe
940	mtzjnlfk.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 832 wrote to memory of 1924	832	7ff7b7eedc089b658ba80ec8cb0748f9.exe	29
PID 832 wrote to memory of 1924	832	7ff7b7eedc089b658ba80ec8cb0748f9.exe	29
PID 832 wrote to memory of 1924	832	7ff7b7eedc089b658ba80ec8cb0748f9.exe	29
PID 832 wrote to memory of 1924	832	7ff7b7eedc089b658ba80ec8cb0748f9.exe	29
PID 832 wrote to memory of 940	832	7ff7b7eedc089b658ba80ec8cb0748f9.exe	31
PID 832 wrote to memory of 940	832	7ff7b7eedc089b658ba80ec8cb0748f9.exe	31
PID 832 wrote to memory of 940	832	7ff7b7eedc089b658ba80ec8cb0748f9.exe	31
PID 832 wrote to memory of 940	832	7ff7b7eedc089b658ba80ec8cb0748f9.exe	31

C:\Users\Admin\AppData\Local\Temp\7ff7b7eedc089b658ba80ec8cb0748f9.exe
"C:\Users\Admin\AppData\Local\Temp\7ff7b7eedc089b658ba80ec8cb0748f9.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:832
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\NewBitmapImage.bmp
  2⤵
  PID:1924
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mtzjnlfk.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mtzjnlfk.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:940

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Suspicious use of FindShellTrayWindow
PID:1692

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mtzjnlfk.exe

Filesize
453KB

MD5
7ff7b7eedc089b658ba80ec8cb0748f9

SHA1
1840814d053eb5327e68db983215316008e84bdb

SHA256
1a3baff7083619571a375795049718bc745e555a25ea3e248848c536671fef35

SHA512
5c370ad1314d4d0c66aad6518b93ecba45835766feabd26bada33e6b6aa4ba68ff766257db0f91f2643a680fbbf061bf99185dfc5e55fec20a9e86c7256b4472

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mtzjnlfk.exe

Filesize
453KB

MD5
7ff7b7eedc089b658ba80ec8cb0748f9

SHA1
1840814d053eb5327e68db983215316008e84bdb

SHA256
1a3baff7083619571a375795049718bc745e555a25ea3e248848c536671fef35

SHA512
5c370ad1314d4d0c66aad6518b93ecba45835766feabd26bada33e6b6aa4ba68ff766257db0f91f2643a680fbbf061bf99185dfc5e55fec20a9e86c7256b4472

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mtzjnlfk.exe

Filesize
453KB

MD5
7ff7b7eedc089b658ba80ec8cb0748f9

SHA1
1840814d053eb5327e68db983215316008e84bdb

SHA256
1a3baff7083619571a375795049718bc745e555a25ea3e248848c536671fef35

SHA512
5c370ad1314d4d0c66aad6518b93ecba45835766feabd26bada33e6b6aa4ba68ff766257db0f91f2643a680fbbf061bf99185dfc5e55fec20a9e86c7256b4472

Download Submit
memory/832-56-0x0000000075701000-0x0000000075703000-memory.dmp

Filesize
8KB

Download
memory/940-66-0x0000000003040000-0x0000000003AFA000-memory.dmp

Filesize
10.7MB

Download