kutaki | hxxp://raagamayuribuilders[.]in/jastef

Analysis

max time kernel
163s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
31-08-2023 05:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://raagamayuribuilders.in/jastef

Score

10^/10

kutaki keylogger stealer

Malware Config

Extracted

Family

kutaki

http://treysbeatend.com/laptop/squared.php

http://terebinnahicc.club/sec/kool.txt

Signatures

Kutaki
Information stealer and keylogger that hides inside legitimate Visual Basic applications.
stealer keylogger kutaki

Drops startup file 8 IoCs

Processes:

NEFT_Copy.batNEFT_Copy.batNEFT_Copy.batNEFT_Copy.bat

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gdnppvfk.exe	NEFT_Copy.bat
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gdnppvfk.exe	NEFT_Copy.bat
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gdnppvfk.exe	NEFT_Copy.bat
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gdnppvfk.exe	NEFT_Copy.bat
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gdnppvfk.exe	NEFT_Copy.bat
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gdnppvfk.exe	NEFT_Copy.bat
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gdnppvfk.exe	NEFT_Copy.bat
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gdnppvfk.exe	NEFT_Copy.bat

Executes dropped EXE 4 IoCs

Processes:

gdnppvfk.exegdnppvfk.exegdnppvfk.exegdnppvfk.exe

pid process

432 gdnppvfk.exe
3192 gdnppvfk.exe
1660 gdnppvfk.exe
2356 gdnppvfk.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
432	gdnppvfk.exe
3192	gdnppvfk.exe
1660	gdnppvfk.exe
2356	gdnppvfk.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 3 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exe

pid process

2324 taskkill.exe
2060 taskkill.exe
1468 taskkill.exe

pid	process
2324	taskkill.exe
2060	taskkill.exe
1468	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133379333030002035"	chrome.exe

Modifies registry class 1 IoCs

Processes:

chrome.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings chrome.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

chrome.exechrome.exe

pid process

1608 chrome.exe
1608 chrome.exe
3000 chrome.exe
3000 chrome.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

Processes:

chrome.exe

pid process

1608 chrome.exe
1608 chrome.exe
1608 chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	1608	chrome.exe
Token: SeCreatePagefilePrivilege	1608	chrome.exe
Token: SeShutdownPrivilege	1608	chrome.exe
Token: SeCreatePagefilePrivilege	1608	chrome.exe
Token: SeShutdownPrivilege	1608	chrome.exe
Token: SeCreatePagefilePrivilege	1608	chrome.exe
Token: SeShutdownPrivilege	1608	chrome.exe
Token: SeCreatePagefilePrivilege	1608	chrome.exe
Token: SeShutdownPrivilege	1608	chrome.exe
Token: SeCreatePagefilePrivilege	1608	chrome.exe
Token: SeShutdownPrivilege	1608	chrome.exe
Token: SeCreatePagefilePrivilege	1608	chrome.exe
Token: SeShutdownPrivilege	1608	chrome.exe
Token: SeCreatePagefilePrivilege	1608	chrome.exe
Token: SeShutdownPrivilege	1608	chrome.exe
Token: SeCreatePagefilePrivilege	1608	chrome.exe
Token: SeShutdownPrivilege	1608	chrome.exe
Token: SeCreatePagefilePrivilege	1608	chrome.exe
Token: SeShutdownPrivilege	1608	chrome.exe
Token: SeCreatePagefilePrivilege	1608	chrome.exe
Token: SeShutdownPrivilege	1608	chrome.exe
Token: SeCreatePagefilePrivilege	1608	chrome.exe
Token: SeShutdownPrivilege	1608	chrome.exe
Token: SeCreatePagefilePrivilege	1608	chrome.exe
Token: SeShutdownPrivilege	1608	chrome.exe
Token: SeCreatePagefilePrivilege	1608	chrome.exe
Token: SeShutdownPrivilege	1608	chrome.exe
Token: SeCreatePagefilePrivilege	1608	chrome.exe
Token: SeShutdownPrivilege	1608	chrome.exe
Token: SeCreatePagefilePrivilege	1608	chrome.exe
Token: SeShutdownPrivilege	1608	chrome.exe
Token: SeCreatePagefilePrivilege	1608	chrome.exe
Token: SeShutdownPrivilege	1608	chrome.exe
Token: SeCreatePagefilePrivilege	1608	chrome.exe
Token: SeShutdownPrivilege	1608	chrome.exe
Token: SeCreatePagefilePrivilege	1608	chrome.exe
Token: SeShutdownPrivilege	1608	chrome.exe
Token: SeCreatePagefilePrivilege	1608	chrome.exe
Token: SeShutdownPrivilege	1608	chrome.exe
Token: SeCreatePagefilePrivilege	1608	chrome.exe
Token: SeShutdownPrivilege	1608	chrome.exe
Token: SeCreatePagefilePrivilege	1608	chrome.exe
Token: SeShutdownPrivilege	1608	chrome.exe
Token: SeCreatePagefilePrivilege	1608	chrome.exe
Token: SeShutdownPrivilege	1608	chrome.exe
Token: SeCreatePagefilePrivilege	1608	chrome.exe
Token: SeShutdownPrivilege	1608	chrome.exe
Token: SeCreatePagefilePrivilege	1608	chrome.exe
Token: SeShutdownPrivilege	1608	chrome.exe
Token: SeCreatePagefilePrivilege	1608	chrome.exe
Token: SeShutdownPrivilege	1608	chrome.exe
Token: SeCreatePagefilePrivilege	1608	chrome.exe
Token: SeShutdownPrivilege	1608	chrome.exe
Token: SeCreatePagefilePrivilege	1608	chrome.exe
Token: SeShutdownPrivilege	1608	chrome.exe
Token: SeCreatePagefilePrivilege	1608	chrome.exe
Token: SeShutdownPrivilege	1608	chrome.exe
Token: SeCreatePagefilePrivilege	1608	chrome.exe
Token: SeShutdownPrivilege	1608	chrome.exe
Token: SeCreatePagefilePrivilege	1608	chrome.exe
Token: SeShutdownPrivilege	1608	chrome.exe
Token: SeCreatePagefilePrivilege	1608	chrome.exe
Token: SeShutdownPrivilege	1608	chrome.exe
Token: SeCreatePagefilePrivilege	1608	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

Processes:

chrome.exe

pid	process
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	process
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe

Suspicious use of SetWindowsHookEx 24 IoCs

Processes:

NEFT_Copy.batgdnppvfk.exeNEFT_Copy.batgdnppvfk.exeNEFT_Copy.batgdnppvfk.exeNEFT_Copy.batgdnppvfk.exe

pid	process
2288	NEFT_Copy.bat
2288	NEFT_Copy.bat
2288	NEFT_Copy.bat
432	gdnppvfk.exe
432	gdnppvfk.exe
432	gdnppvfk.exe
5032	NEFT_Copy.bat
5032	NEFT_Copy.bat
5032	NEFT_Copy.bat
3192	gdnppvfk.exe
3192	gdnppvfk.exe
3192	gdnppvfk.exe
1484	NEFT_Copy.bat
1484	NEFT_Copy.bat
1484	NEFT_Copy.bat
1660	gdnppvfk.exe
1660	gdnppvfk.exe
1660	gdnppvfk.exe
3284	NEFT_Copy.bat
3284	NEFT_Copy.bat
3284	NEFT_Copy.bat
2356	gdnppvfk.exe
2356	gdnppvfk.exe
2356	gdnppvfk.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 1608 wrote to memory of 4440	1608	chrome.exe	chrome.exe
PID 1608 wrote to memory of 4440	1608	chrome.exe	chrome.exe
PID 1608 wrote to memory of 1348	1608	chrome.exe	chrome.exe
PID 1608 wrote to memory of 1348	1608	chrome.exe	chrome.exe
PID 1608 wrote to memory of 1348	1608	chrome.exe	chrome.exe
PID 1608 wrote to memory of 1348	1608	chrome.exe	chrome.exe
PID 1608 wrote to memory of 1348	1608	chrome.exe	chrome.exe
PID 1608 wrote to memory of 1348	1608	chrome.exe	chrome.exe
PID 1608 wrote to memory of 1348	1608	chrome.exe	chrome.exe
PID 1608 wrote to memory of 1348	1608	chrome.exe	chrome.exe
PID 1608 wrote to memory of 1348	1608	chrome.exe	chrome.exe
PID 1608 wrote to memory of 1348	1608	chrome.exe	chrome.exe
PID 1608 wrote to memory of 1348	1608	chrome.exe	chrome.exe
PID 1608 wrote to memory of 1348	1608	chrome.exe	chrome.exe
PID 1608 wrote to memory of 1348	1608	chrome.exe	chrome.exe
PID 1608 wrote to memory of 1348	1608	chrome.exe	chrome.exe
PID 1608 wrote to memory of 1348	1608	chrome.exe	chrome.exe
PID 1608 wrote to memory of 1348	1608	chrome.exe	chrome.exe
PID 1608 wrote to memory of 1348	1608	chrome.exe	chrome.exe
PID 1608 wrote to memory of 1348	1608	chrome.exe	chrome.exe
PID 1608 wrote to memory of 1348	1608	chrome.exe	chrome.exe
PID 1608 wrote to memory of 1348	1608	chrome.exe	chrome.exe
PID 1608 wrote to memory of 1348	1608	chrome.exe	chrome.exe
PID 1608 wrote to memory of 1348	1608	chrome.exe	chrome.exe
PID 1608 wrote to memory of 1348	1608	chrome.exe	chrome.exe
PID 1608 wrote to memory of 1348	1608	chrome.exe	chrome.exe
PID 1608 wrote to memory of 1348	1608	chrome.exe	chrome.exe
PID 1608 wrote to memory of 1348	1608	chrome.exe	chrome.exe
PID 1608 wrote to memory of 1348	1608	chrome.exe	chrome.exe
PID 1608 wrote to memory of 1348	1608	chrome.exe	chrome.exe
PID 1608 wrote to memory of 1348	1608	chrome.exe	chrome.exe
PID 1608 wrote to memory of 1348	1608	chrome.exe	chrome.exe
PID 1608 wrote to memory of 1348	1608	chrome.exe	chrome.exe
PID 1608 wrote to memory of 1348	1608	chrome.exe	chrome.exe
PID 1608 wrote to memory of 1348	1608	chrome.exe	chrome.exe
PID 1608 wrote to memory of 1348	1608	chrome.exe	chrome.exe
PID 1608 wrote to memory of 1348	1608	chrome.exe	chrome.exe
PID 1608 wrote to memory of 1348	1608	chrome.exe	chrome.exe
PID 1608 wrote to memory of 1348	1608	chrome.exe	chrome.exe
PID 1608 wrote to memory of 1348	1608	chrome.exe	chrome.exe
PID 1608 wrote to memory of 5012	1608	chrome.exe	chrome.exe
PID 1608 wrote to memory of 5012	1608	chrome.exe	chrome.exe
PID 1608 wrote to memory of 3460	1608	chrome.exe	chrome.exe
PID 1608 wrote to memory of 3460	1608	chrome.exe	chrome.exe
PID 1608 wrote to memory of 3460	1608	chrome.exe	chrome.exe
PID 1608 wrote to memory of 3460	1608	chrome.exe	chrome.exe
PID 1608 wrote to memory of 3460	1608	chrome.exe	chrome.exe
PID 1608 wrote to memory of 3460	1608	chrome.exe	chrome.exe
PID 1608 wrote to memory of 3460	1608	chrome.exe	chrome.exe
PID 1608 wrote to memory of 3460	1608	chrome.exe	chrome.exe
PID 1608 wrote to memory of 3460	1608	chrome.exe	chrome.exe
PID 1608 wrote to memory of 3460	1608	chrome.exe	chrome.exe
PID 1608 wrote to memory of 3460	1608	chrome.exe	chrome.exe
PID 1608 wrote to memory of 3460	1608	chrome.exe	chrome.exe
PID 1608 wrote to memory of 3460	1608	chrome.exe	chrome.exe
PID 1608 wrote to memory of 3460	1608	chrome.exe	chrome.exe
PID 1608 wrote to memory of 3460	1608	chrome.exe	chrome.exe
PID 1608 wrote to memory of 3460	1608	chrome.exe	chrome.exe
PID 1608 wrote to memory of 3460	1608	chrome.exe	chrome.exe
PID 1608 wrote to memory of 3460	1608	chrome.exe	chrome.exe
PID 1608 wrote to memory of 3460	1608	chrome.exe	chrome.exe
PID 1608 wrote to memory of 3460	1608	chrome.exe	chrome.exe
PID 1608 wrote to memory of 3460	1608	chrome.exe	chrome.exe
PID 1608 wrote to memory of 3460	1608	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://raagamayuribuilders.in/jastef
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1608

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa4c799758,0x7ffa4c799768,0x7ffa4c799778
2⤵
PID:4440

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=1876,i,15162583120644287975,17649792588192879187,131072 /prefetch:8
2⤵
PID:5012

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1784 --field-trial-handle=1876,i,15162583120644287975,17649792588192879187,131072 /prefetch:2
2⤵
PID:1348

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2232 --field-trial-handle=1876,i,15162583120644287975,17649792588192879187,131072 /prefetch:8
2⤵
PID:3460

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2852 --field-trial-handle=1876,i,15162583120644287975,17649792588192879187,131072 /prefetch:1
2⤵
PID:1320

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2884 --field-trial-handle=1876,i,15162583120644287975,17649792588192879187,131072 /prefetch:1
2⤵
PID:1732

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4596 --field-trial-handle=1876,i,15162583120644287975,17649792588192879187,131072 /prefetch:1
2⤵
PID:1196

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3952 --field-trial-handle=1876,i,15162583120644287975,17649792588192879187,131072 /prefetch:8
2⤵
PID:3832

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5400 --field-trial-handle=1876,i,15162583120644287975,17649792588192879187,131072 /prefetch:8
2⤵
PID:2000

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4924 --field-trial-handle=1876,i,15162583120644287975,17649792588192879187,131072 /prefetch:8
2⤵
PID:3332

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1644 --field-trial-handle=1876,i,15162583120644287975,17649792588192879187,131072 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3000

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4728

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1660

C:\Users\Admin\AppData\Local\Temp\Temp1_NEFT_Copy.zip\NEFT_Copy.bat
"C:\Users\Admin\AppData\Local\Temp\Temp1_NEFT_Copy.zip\NEFT_Copy.bat"
1⤵
- Drops startup file
- Suspicious use of SetWindowsHookEx
PID:2288

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c C:\Users\Admin\AppData\Local\Temp\
2⤵
PID:2716

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gdnppvfk.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gdnppvfk.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:432

C:\Users\Admin\AppData\Local\Temp\Temp1_NEFT_Copy.zip\NEFT_Copy.bat
"C:\Users\Admin\AppData\Local\Temp\Temp1_NEFT_Copy.zip\NEFT_Copy.bat"
1⤵
- Drops startup file
- Suspicious use of SetWindowsHookEx
PID:5032

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c C:\Users\Admin\AppData\Local\Temp\
2⤵
PID:4648

C:\Windows\SysWOW64\taskkill.exe
taskkill /im gdnppvfk.exe /f
2⤵
- Kills process with taskkill
PID:2060

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gdnppvfk.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gdnppvfk.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3192

C:\Users\Admin\AppData\Local\Temp\Temp1_NEFT_Copy.zip\NEFT_Copy.bat
"C:\Users\Admin\AppData\Local\Temp\Temp1_NEFT_Copy.zip\NEFT_Copy.bat"
1⤵
- Drops startup file
- Suspicious use of SetWindowsHookEx
PID:1484

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c C:\Users\Admin\AppData\Local\Temp\
2⤵
PID:4656

C:\Windows\SysWOW64\taskkill.exe
taskkill /im gdnppvfk.exe /f
2⤵
- Kills process with taskkill
PID:1468

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gdnppvfk.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gdnppvfk.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1660

C:\Users\Admin\AppData\Local\Temp\Temp1_NEFT_Copy.zip\NEFT_Copy.bat
"C:\Users\Admin\AppData\Local\Temp\Temp1_NEFT_Copy.zip\NEFT_Copy.bat"
1⤵
- Drops startup file
- Suspicious use of SetWindowsHookEx
PID:3284

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c C:\Users\Admin\AppData\Local\Temp\
2⤵
PID:4872

C:\Windows\SysWOW64\taskkill.exe
taskkill /im gdnppvfk.exe /f
2⤵
- Kills process with taskkill
PID:2324

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gdnppvfk.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gdnppvfk.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
1008B

MD5
e89eabb650c3b1fda2b0f4183aebc8a6

SHA1
82ed6f8b885f396f86f3a70ed26984fcc8d77078

SHA256
a7ab2be62f74b7ff0be30cf332f292419ee5982d0fca2fe1306da406e472027e

SHA512
fd44b933e82dbee07534ebf9f098662bbbb3f7e406ae2d6e2fd89693c713d2e1421b4bdc97d88592883c12949f27b3cff228833bceb8fe56ac5b17afc5da2dbb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
705B

MD5
04fd23720f6d8b741dc52ec3aa481cb7

SHA1
eacac7b0d262b469531480515bd95984d556652c

SHA256
074dfd273aec047ef68eae14376fe3ff225d0da100fd60894f004c107a6c88a3

SHA512
aa34cc4ccf28f5496e710c0d93fa70993a82da50579e70cd0d80ef86331bef60cc9bc5fc5a382bcfad491093881a64fb80ae3853c28f3f1b6fc2cce5da21ad0c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
1e9a1dd7cd96f3c17a437973f77ebb7b

SHA1
52def273c8ba8c8f834b1e804f2825b13d087ad2

SHA256
0896375075e8ac4f77754342ef7ddc8a2870fce4fd2544d9b7aa48ea692ba561

SHA512
201eb953226f1673dc3c95a46644453e45f2827b71ce1763745207db4f0ec7a88bd55a2ed3b4366dfa18a63ab22e314d5329e623eb5167db773cdcfffbea775d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
87KB

MD5
4c74e80f3681886b88f935219487b7cb

SHA1
64ef263cebf007cac9feda3b52cd42f1ba79a56d

SHA256
81b52bda241cbf7543d0cd987dd88c4a963afa3bc71b0afd01517ec7a1dd3df1

SHA512
1ac0b841edcb301f586556c63c50307f8ac425051fb325ecd696d774363a193543eadaa0c428af07ae06458e661393cfbcb0110de1045c32b63e0baa08974bd8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gdnppvfk.exe
Filesize
2.3MB

MD5
9c153ac25f02739019b04b0a8ce82c4b

SHA1
64136c4238d140a6fb1ec542744ff90aba5bac09

SHA256
83269040e4f510f11a327807b23dda45d98386676fc309e27b3eebd9cefa8416

SHA512
a7a9bb1eee5470bb4939d61df33c3840fe69e8503e792d474d7fa273f4c77dd42c84a8e6bdd78b3b157b7aadada401c903e46d3237fa5fcfa6f7b27c477bb4de

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gdnppvfk.exe
Filesize
2.3MB

MD5
9c153ac25f02739019b04b0a8ce82c4b

SHA1
64136c4238d140a6fb1ec542744ff90aba5bac09

SHA256
83269040e4f510f11a327807b23dda45d98386676fc309e27b3eebd9cefa8416

SHA512
a7a9bb1eee5470bb4939d61df33c3840fe69e8503e792d474d7fa273f4c77dd42c84a8e6bdd78b3b157b7aadada401c903e46d3237fa5fcfa6f7b27c477bb4de

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gdnppvfk.exe
Filesize
2.3MB

MD5
9c153ac25f02739019b04b0a8ce82c4b

SHA1
64136c4238d140a6fb1ec542744ff90aba5bac09

SHA256
83269040e4f510f11a327807b23dda45d98386676fc309e27b3eebd9cefa8416

SHA512
a7a9bb1eee5470bb4939d61df33c3840fe69e8503e792d474d7fa273f4c77dd42c84a8e6bdd78b3b157b7aadada401c903e46d3237fa5fcfa6f7b27c477bb4de

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gdnppvfk.exe
Filesize
2.3MB

MD5
9c153ac25f02739019b04b0a8ce82c4b

SHA1
64136c4238d140a6fb1ec542744ff90aba5bac09

SHA256
83269040e4f510f11a327807b23dda45d98386676fc309e27b3eebd9cefa8416

SHA512
a7a9bb1eee5470bb4939d61df33c3840fe69e8503e792d474d7fa273f4c77dd42c84a8e6bdd78b3b157b7aadada401c903e46d3237fa5fcfa6f7b27c477bb4de

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gdnppvfk.exe
Filesize
2.3MB

MD5
9c153ac25f02739019b04b0a8ce82c4b

SHA1
64136c4238d140a6fb1ec542744ff90aba5bac09

SHA256
83269040e4f510f11a327807b23dda45d98386676fc309e27b3eebd9cefa8416

SHA512
a7a9bb1eee5470bb4939d61df33c3840fe69e8503e792d474d7fa273f4c77dd42c84a8e6bdd78b3b157b7aadada401c903e46d3237fa5fcfa6f7b27c477bb4de

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gdnppvfk.exe
Filesize
2.3MB

MD5
9c153ac25f02739019b04b0a8ce82c4b

SHA1
64136c4238d140a6fb1ec542744ff90aba5bac09

SHA256
83269040e4f510f11a327807b23dda45d98386676fc309e27b3eebd9cefa8416

SHA512
a7a9bb1eee5470bb4939d61df33c3840fe69e8503e792d474d7fa273f4c77dd42c84a8e6bdd78b3b157b7aadada401c903e46d3237fa5fcfa6f7b27c477bb4de

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gdnppvfk.exe
Filesize
2.3MB

MD5
9c153ac25f02739019b04b0a8ce82c4b

SHA1
64136c4238d140a6fb1ec542744ff90aba5bac09

SHA256
83269040e4f510f11a327807b23dda45d98386676fc309e27b3eebd9cefa8416

SHA512
a7a9bb1eee5470bb4939d61df33c3840fe69e8503e792d474d7fa273f4c77dd42c84a8e6bdd78b3b157b7aadada401c903e46d3237fa5fcfa6f7b27c477bb4de

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gdnppvfk.exe
Filesize
2.3MB

MD5
9c153ac25f02739019b04b0a8ce82c4b

SHA1
64136c4238d140a6fb1ec542744ff90aba5bac09

SHA256
83269040e4f510f11a327807b23dda45d98386676fc309e27b3eebd9cefa8416

SHA512
a7a9bb1eee5470bb4939d61df33c3840fe69e8503e792d474d7fa273f4c77dd42c84a8e6bdd78b3b157b7aadada401c903e46d3237fa5fcfa6f7b27c477bb4de

Download Submit
C:\Users\Admin\Downloads\NEFT_Copy.zip.crdownload
Filesize
2.1MB

MD5
d0f2c2de0407cefe7a24c8eb22237a61

SHA1
a46ba89e46a3d04fd9c919837441625ddaa4febe

SHA256
23d3f3b9c74b6707db237bdfa797d7425f18938614051ddb633712a42e7f3c96

SHA512
c59e010a958a1f714bd064592d6b0f26619b2efc879a1b8496d6132a598aa5edddec2e6537c34b1944893926f7664a989bf8df752f8bfffeabae4d3f7fbfb3e3

Download Submit
\??\pipe\crashpad_1608_VRIVUFHFWKGSQFDJ
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit