kutaki | 0fd485cf586b6ec28f7b1e943712935ef4a333cbbeee29167ef086ccdd49cc79

Analysis

max time kernel
1800s
max time network
1226s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
23-03-2023 07:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

INCOME_TAX_Challan.exe
Size

3.2MB
MD5

b1fadf19937c7d653286997afd35d84d
SHA1

577dc340ec3af92b5dc30ac50840a90b99ec6f50
SHA256

f9694c42f4212704e55550704a80cf62bf03051265585d83d667ac040a2c72b8
SHA512

d78b64e4844cb4d06e735ed574b9278d6b1021360b9154cd510e4427648eadb1732a31719821ecadabcaa772183645065a9c46aafad224107f3b5af6bee2bc63
SSDEEP

98304:vu4fwD6IO242Sn3Jgo63Sp7dZ3FJNZaZHKSn6sjn0MfmP/SA8t:1oPOVmmnSht

Score

10^/10

kutaki keylogger stealer

Malware Config

Extracted

Family

kutaki

http://waaatlink.xyz/hello/son.php

Signatures

Kutaki
Information stealer and keylogger that hides inside legitimate Visual Basic applications.
stealer keylogger kutaki

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dduadkfk.exe	INCOME_TAX_Challan.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dduadkfk.exe	INCOME_TAX_Challan.exe

Executes dropped EXE 1 IoCs

pid	Process
4800	dduadkfk.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
384	INCOME_TAX_Challan.exe
384	INCOME_TAX_Challan.exe
384	INCOME_TAX_Challan.exe
4800	dduadkfk.exe
4800	dduadkfk.exe
4800	dduadkfk.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 384 wrote to memory of 4068	384	INCOME_TAX_Challan.exe	87
PID 384 wrote to memory of 4068	384	INCOME_TAX_Challan.exe	87
PID 384 wrote to memory of 4068	384	INCOME_TAX_Challan.exe	87
PID 384 wrote to memory of 4800	384	INCOME_TAX_Challan.exe	91
PID 384 wrote to memory of 4800	384	INCOME_TAX_Challan.exe	91
PID 384 wrote to memory of 4800	384	INCOME_TAX_Challan.exe	91

C:\Users\Admin\AppData\Local\Temp\INCOME_TAX_Challan.exe
"C:\Users\Admin\AppData\Local\Temp\INCOME_TAX_Challan.exe"
1⤵
- Drops startup file
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:384
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\
  2⤵
  PID:4068
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dduadkfk.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dduadkfk.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4800

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\S1Q31HZS\httpErrorPagesScripts[1]

Filesize
11KB

MD5
9234071287e637f85d721463c488704c

SHA1
cca09b1e0fba38ba29d3972ed8dcecefdef8c152

SHA256
65cc039890c7ceb927ce40f6f199d74e49b8058c3f8a6e22e8f916ad90ea8649

SHA512
87d691987e7a2f69ad8605f35f94241ab7e68ad4f55ad384f1f0d40dc59ffd1432c758123661ee39443d624c881b01dcd228a67afb8700fe5e66fc794a6c0384

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\TUIJN6ZA\NewErrorPageTemplate[1]

Filesize
1KB

MD5
dfeabde84792228093a5a270352395b6

SHA1
e41258c9576721025926326f76063c2305586f76

SHA256
77b138ab5d0a90ff04648c26addd5e414cc178165e3b54a4cb3739da0f58e075

SHA512
e256f603e67335151bb709294749794e2e3085f4063c623461a0b3decbcca8e620807b707ec9bcbe36dcd7d639c55753da0495be85b4ae5fb6bfc52ab4b284fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\TUIJN6ZA\dnserrordiagoff[1]

Filesize
1KB

MD5
7e81a79f38695e467a49ee41dd24146d

SHA1
035e110c36bf3072525b05394f73d1ba54d0d316

SHA256
a705d1e0916a79b0d6e60c41a9ce301ed95b3fc00e927f940ab27061c208a536

SHA512
53c5f2f2b9ad8b555f9ae6644941cf2016108e803ea6ab2c7418e31e66874dea5a2bc04be0fa9766e7206617879520e730e9e3e0de136bae886c2e786082d622

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YYL8D8JJ\errorPageStrings[1]

Filesize
4KB

MD5
d65ec06f21c379c87040b83cc1abac6b

SHA1
208d0a0bb775661758394be7e4afb18357e46c8b

SHA256
a1270e90cea31b46432ec44731bf4400d22b38eb2855326bf934fe8f1b169a4f

SHA512
8a166d26b49a5d95aea49bc649e5ea58786a2191f4d2adac6f5fbb7523940ce4482d6a2502aa870a931224f215cb2010a8c9b99a2c1820150e4d365cab28299e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dduadkfk.exe

Filesize
3.2MB

MD5
b1fadf19937c7d653286997afd35d84d

SHA1
577dc340ec3af92b5dc30ac50840a90b99ec6f50

SHA256
f9694c42f4212704e55550704a80cf62bf03051265585d83d667ac040a2c72b8

SHA512
d78b64e4844cb4d06e735ed574b9278d6b1021360b9154cd510e4427648eadb1732a31719821ecadabcaa772183645065a9c46aafad224107f3b5af6bee2bc63

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dduadkfk.exe

Filesize
3.2MB

MD5
b1fadf19937c7d653286997afd35d84d

SHA1
577dc340ec3af92b5dc30ac50840a90b99ec6f50

SHA256
f9694c42f4212704e55550704a80cf62bf03051265585d83d667ac040a2c72b8

SHA512
d78b64e4844cb4d06e735ed574b9278d6b1021360b9154cd510e4427648eadb1732a31719821ecadabcaa772183645065a9c46aafad224107f3b5af6bee2bc63

Download Submit