kutaki | 58092b88b330eec0e01a54c5ea8715b2206e8775b56ca54400c5cae59bc23f77

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
30/01/2023, 08:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IncomeTax_Challan_Copy.exe
Size 1.7MB
Sample230130-j5j8eahf93
SHA256 58092b88b330eec0e01a54c5ea8715b2206e8775b56ca54400c5cae59bc23f77
MD5 9cebc9cd7dec812aa0891df66d2dfd50
SHA1 739286547c4533f85ba1187acb3d46eb13b1090f
SHA512 347b593128ebdc5f519955d788461f6842795fdd18163baa38bae6cf59a73e423018bd4e8446cb1bae42c75b3da821bd45ec36af6329bb1eedec956b4ef4accb
SSDEEP 24576:KeqSDLyQvKTLEXIRtJ4tjhXGT743iX8EFuvXb0lPCDB3oy4LJ1/obfmP/UDMS08s:KeqSDdvKHEXIHJEBGvY+kwyfmP/SA8Ne
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

kutaki keylogger stealer

Malware Config

Extracted

Family

kutaki

http://newloshree.xyz/work/son.php

Signatures

Kutaki
Information stealer and keylogger that hides inside legitimate Visual Basic applications.
stealer keylogger kutaki

Kutaki Executable 2 IoCs

resource	yara_rule
behavioral2/files/0x000900000001da19-136.dat	family_kutaki
behavioral2/files/0x000900000001da19-137.dat	family_kutaki

Executes dropped EXE 1 IoCs

pid	Process
640	uaaillfk.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uaaillfk.exe	IncomeTax_Challan_Copy.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uaaillfk.exe	IncomeTax_Challan_Copy.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
5040	IncomeTax_Challan_Copy.exe
5040	IncomeTax_Challan_Copy.exe
5040	IncomeTax_Challan_Copy.exe
640	uaaillfk.exe
640	uaaillfk.exe
640	uaaillfk.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5040 wrote to memory of 4328	5040	IncomeTax_Challan_Copy.exe	88
PID 5040 wrote to memory of 4328	5040	IncomeTax_Challan_Copy.exe	88
PID 5040 wrote to memory of 4328	5040	IncomeTax_Challan_Copy.exe	88
PID 5040 wrote to memory of 640	5040	IncomeTax_Challan_Copy.exe	91
PID 5040 wrote to memory of 640	5040	IncomeTax_Challan_Copy.exe	91
PID 5040 wrote to memory of 640	5040	IncomeTax_Challan_Copy.exe	91

C:\Users\Admin\AppData\Local\Temp\IncomeTax_Challan_Copy.exe
"C:\Users\Admin\AppData\Local\Temp\IncomeTax_Challan_Copy.exe"
1⤵
- Drops startup file
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\
  2⤵
  PID:4328
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uaaillfk.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uaaillfk.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

uaaillfk.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uaaillfk.exe
Size 1.7MB
SHA256 58092b88b330eec0e01a54c5ea8715b2206e8775b56ca54400c5cae59bc23f77
MD5 9cebc9cd7dec812aa0891df66d2dfd50
SHA1 739286547c4533f85ba1187acb3d46eb13b1090f
SHA512 347b593128ebdc5f519955d788461f6842795fdd18163baa38bae6cf59a73e423018bd4e8446cb1bae42c75b3da821bd45ec36af6329bb1eedec956b4ef4accb
SSDEEP 24576:KeqSDLyQvKTLEXIRtJ4tjhXGT743iX8EFuvXb0lPCDB3oy4LJ1/obfmP/UDMS08s:KeqSDdvKHEXIHJEBGvY+kwyfmP/SA8Ne
MD5 SHA1 SHA512 SSDEEP

Submit Download