kutaki | 03e067b68230dd9da8e74c905e862dd1f7c094a35606405d4e426f8ba02981bc

Analysis

max time kernel
124s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
30-06-2023 12:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Payment_Receipt.exe
Size

812KB
MD5

fad8c7f1f023b519a8bc97f44c845f1b
SHA1

e305349bd0dda9732aaab10499153d6e80ce11bc
SHA256

c056c58e3d32716447e27dbe38e784b685203dededddf1253ba4051d0a7a174a
SHA512

ff1a302e99ad89f01c805517085fd76291ee594edc0e9e9c3980cd47dbf1c2429016b11df3b7621eb96da914809b2bb47e5291ec3cd2894f43ff116f9ce39fb3
SSDEEP

12288:jw/h2mDPAtjj4cv6aiUoIxbU546A9jmP/uhu/yMS08CkntxYRK:EPmjj4cZfmP/UDMS08Ckn3n

Score

10^/10

kutaki keylogger stealer

Malware Config

Extracted

Family

kutaki

http://newloshree.xyz/work/son.php

Signatures

Kutaki
Information stealer and keylogger that hides inside legitimate Visual Basic applications.
stealer keylogger kutaki

Kutaki Executable 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pwatuach.exe	family_kutaki
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pwatuach.exe	family_kutaki

Drops startup file 2 IoCs

Processes:

Payment_Receipt.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pwatuach.exe	Payment_Receipt.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pwatuach.exe	Payment_Receipt.exe

Executes dropped EXE 1 IoCs

Processes:

pwatuach.exe

pid process

1404 pwatuach.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

Payment_Receipt.exepwatuach.exe

pid process

3860 Payment_Receipt.exe
3860 Payment_Receipt.exe
3860 Payment_Receipt.exe
1404 pwatuach.exe
1404 pwatuach.exe
1404 pwatuach.exe

pid	process
1404	pwatuach.exe

pid	process
3860	Payment_Receipt.exe
3860	Payment_Receipt.exe
3860	Payment_Receipt.exe
1404	pwatuach.exe
1404	pwatuach.exe
1404	pwatuach.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

Payment_Receipt.exe

description	pid	process	target process
PID 3860 wrote to memory of 4484	3860	Payment_Receipt.exe	cmd.exe
PID 3860 wrote to memory of 4484	3860	Payment_Receipt.exe	cmd.exe
PID 3860 wrote to memory of 4484	3860	Payment_Receipt.exe	cmd.exe
PID 3860 wrote to memory of 1404	3860	Payment_Receipt.exe	pwatuach.exe
PID 3860 wrote to memory of 1404	3860	Payment_Receipt.exe	pwatuach.exe
PID 3860 wrote to memory of 1404	3860	Payment_Receipt.exe	pwatuach.exe

C:\Users\Admin\AppData\Local\Temp\Payment_Receipt.exe
"C:\Users\Admin\AppData\Local\Temp\Payment_Receipt.exe"
1⤵
- Drops startup file
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3860
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\
  2⤵
  PID:4484
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pwatuach.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pwatuach.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1404

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0P2PR3BY\NewErrorPageTemplate[1]

Filesize
1KB

MD5
dfeabde84792228093a5a270352395b6

SHA1
e41258c9576721025926326f76063c2305586f76

SHA256
77b138ab5d0a90ff04648c26addd5e414cc178165e3b54a4cb3739da0f58e075

SHA512
e256f603e67335151bb709294749794e2e3085f4063c623461a0b3decbcca8e620807b707ec9bcbe36dcd7d639c55753da0495be85b4ae5fb6bfc52ab4b284fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0P2PR3BY\dnserrordiagoff[1]

Filesize
1KB

MD5
7e81a79f38695e467a49ee41dd24146d

SHA1
035e110c36bf3072525b05394f73d1ba54d0d316

SHA256
a705d1e0916a79b0d6e60c41a9ce301ed95b3fc00e927f940ab27061c208a536

SHA512
53c5f2f2b9ad8b555f9ae6644941cf2016108e803ea6ab2c7418e31e66874dea5a2bc04be0fa9766e7206617879520e730e9e3e0de136bae886c2e786082d622

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2YMNL2J1\errorPageStrings[1]

Filesize
4KB

MD5
d65ec06f21c379c87040b83cc1abac6b

SHA1
208d0a0bb775661758394be7e4afb18357e46c8b

SHA256
a1270e90cea31b46432ec44731bf4400d22b38eb2855326bf934fe8f1b169a4f

SHA512
8a166d26b49a5d95aea49bc649e5ea58786a2191f4d2adac6f5fbb7523940ce4482d6a2502aa870a931224f215cb2010a8c9b99a2c1820150e4d365cab28299e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\IDCMYYRW\httpErrorPagesScripts[1]

Filesize
11KB

MD5
9234071287e637f85d721463c488704c

SHA1
cca09b1e0fba38ba29d3972ed8dcecefdef8c152

SHA256
65cc039890c7ceb927ce40f6f199d74e49b8058c3f8a6e22e8f916ad90ea8649

SHA512
87d691987e7a2f69ad8605f35f94241ab7e68ad4f55ad384f1f0d40dc59ffd1432c758123661ee39443d624c881b01dcd228a67afb8700fe5e66fc794a6c0384

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pwatuach.exe

Filesize
812KB

MD5
fad8c7f1f023b519a8bc97f44c845f1b

SHA1
e305349bd0dda9732aaab10499153d6e80ce11bc

SHA256
c056c58e3d32716447e27dbe38e784b685203dededddf1253ba4051d0a7a174a

SHA512
ff1a302e99ad89f01c805517085fd76291ee594edc0e9e9c3980cd47dbf1c2429016b11df3b7621eb96da914809b2bb47e5291ec3cd2894f43ff116f9ce39fb3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pwatuach.exe

Filesize
812KB

MD5
fad8c7f1f023b519a8bc97f44c845f1b

SHA1
e305349bd0dda9732aaab10499153d6e80ce11bc

SHA256
c056c58e3d32716447e27dbe38e784b685203dededddf1253ba4051d0a7a174a

SHA512
ff1a302e99ad89f01c805517085fd76291ee594edc0e9e9c3980cd47dbf1c2429016b11df3b7621eb96da914809b2bb47e5291ec3cd2894f43ff116f9ce39fb3

Download Submit