kutaki | 58092b88b330eec0e01a54c5ea8715b2206e8775b56ca54400c5cae59bc23f77

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
30-01-2023 08:15

Target

IncomeTax_Challan_Copy.exe
Size

1.7MB
MD5

9cebc9cd7dec812aa0891df66d2dfd50
SHA1

739286547c4533f85ba1187acb3d46eb13b1090f
SHA256

58092b88b330eec0e01a54c5ea8715b2206e8775b56ca54400c5cae59bc23f77
SHA512

347b593128ebdc5f519955d788461f6842795fdd18163baa38bae6cf59a73e423018bd4e8446cb1bae42c75b3da821bd45ec36af6329bb1eedec956b4ef4accb
SSDEEP

24576:KeqSDLyQvKTLEXIRtJ4tjhXGT743iX8EFuvXb0lPCDB3oy4LJ1/obfmP/UDMS08s:KeqSDdvKHEXIHJEBGvY+kwyfmP/SA8Ne

Score

10^/10

Family

kutaki

http://newloshree.xyz/work/son.php

Kutaki
Information stealer and keylogger that hides inside legitimate Visual Basic applications.
stealer keylogger kutaki

Kutaki Executable 2 IoCs

resource	yara_rule
behavioral2/files/0x000900000001da19-136.dat	family_kutaki
behavioral2/files/0x000900000001da19-137.dat	family_kutaki

Executes dropped EXE 1 IoCs

pid	Process
640	uaaillfk.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uaaillfk.exe	IncomeTax_Challan_Copy.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uaaillfk.exe	IncomeTax_Challan_Copy.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5040 wrote to memory of 4328	5040	IncomeTax_Challan_Copy.exe	88
PID 5040 wrote to memory of 4328	5040	IncomeTax_Challan_Copy.exe	88
PID 5040 wrote to memory of 4328	5040	IncomeTax_Challan_Copy.exe	88
PID 5040 wrote to memory of 640	5040	IncomeTax_Challan_Copy.exe	91
PID 5040 wrote to memory of 640	5040	IncomeTax_Challan_Copy.exe	91
PID 5040 wrote to memory of 640	5040	IncomeTax_Challan_Copy.exe	91

C:\Users\Admin\AppData\Local\Temp\IncomeTax_Challan_Copy.exe
"C:\Users\Admin\AppData\Local\Temp\IncomeTax_Challan_Copy.exe"
1⤵
- Drops startup file
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\
  2⤵
  PID:4328
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uaaillfk.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uaaillfk.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:640

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uaaillfk.exe

Filesize
1.7MB

MD5
9cebc9cd7dec812aa0891df66d2dfd50

SHA1
739286547c4533f85ba1187acb3d46eb13b1090f

SHA256
58092b88b330eec0e01a54c5ea8715b2206e8775b56ca54400c5cae59bc23f77

SHA512
347b593128ebdc5f519955d788461f6842795fdd18163baa38bae6cf59a73e423018bd4e8446cb1bae42c75b3da821bd45ec36af6329bb1eedec956b4ef4accb

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uaaillfk.exe

Filesize
1.7MB

MD5
9cebc9cd7dec812aa0891df66d2dfd50

SHA1
739286547c4533f85ba1187acb3d46eb13b1090f

SHA256
58092b88b330eec0e01a54c5ea8715b2206e8775b56ca54400c5cae59bc23f77

SHA512
347b593128ebdc5f519955d788461f6842795fdd18163baa38bae6cf59a73e423018bd4e8446cb1bae42c75b3da821bd45ec36af6329bb1eedec956b4ef4accb

Download Submit