Overview

overview

10

Static

static

10

Payment_Receipt.exe

windows7-x64

10

Payment_Receipt.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    124s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230621-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/06/2023, 12:31

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Payment_Receipt.exe
  • Size 812KB
  • Sample230630-pp8tqabd95
  • SHA256 c056c58e3d32716447e27dbe38e784b685203dededddf1253ba4051d0a7a174a
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
kutakikeyloggerstealer

Malware Config

Extracted

Family

  • kutaki

C2

  • http://newloshree.xyz/work/son.php

Signatures

  • Kutaki

    Information stealer and keylogger that hides inside legitimate Visual Basic applications.

    stealerkeyloggerkutaki
  • Kutaki Executable 2 IoCs
  • Drops startup file 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Payment_Receipt.exe
    "C:\Users\Admin\AppData\Local\Temp\Payment_Receipt.exe"
    1⤵
    • Drops startup file
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3860
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c C:\Users\Admin\AppData\Local\Temp\
      2⤵
        PID:4484
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pwatuach.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pwatuach.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1404

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          NewErrorPageTemplate[1]
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0P2PR3BY\NewErrorPageTemplate[1]
          • Size 1KB
          • SHA256 77b138ab5d0a90ff04648c26addd5e414cc178165e3b54a4cb3739da0f58e075
          • MD5 SHA1 SHA512
          Submit Download

          dnserrordiagoff[1]
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0P2PR3BY\dnserrordiagoff[1]
          • Size 1KB
          • SHA256 a705d1e0916a79b0d6e60c41a9ce301ed95b3fc00e927f940ab27061c208a536
          • MD5 SHA1 SHA512
          Submit Download

          errorPageStrings[1]
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2YMNL2J1\errorPageStrings[1]
          • Size 4KB
          • SHA256 a1270e90cea31b46432ec44731bf4400d22b38eb2855326bf934fe8f1b169a4f
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          httpErrorPagesScripts[1]
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\IDCMYYRW\httpErrorPagesScripts[1]
          • Size 11KB
          • SHA256 65cc039890c7ceb927ce40f6f199d74e49b8058c3f8a6e22e8f916ad90ea8649
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          pwatuach.exe
          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pwatuach.exe
          • Size 812KB
          • SHA256 c056c58e3d32716447e27dbe38e784b685203dededddf1253ba4051d0a7a174a
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          pwatuach.exe
          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pwatuach.exe
          • Size 812KB
          • SHA256 c056c58e3d32716447e27dbe38e784b685203dededddf1253ba4051d0a7a174a
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download