Analysis

  • max time kernel
    594s
  • max time network
    490s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231020-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-11-2023 03:54

General

  • Target

    http://lifeinfotech.in/kpp.htm

Malware Config

Extracted

Family

kutaki

C2

http://linkwotowoto.club/new/two.php

Signatures

  • Kutaki

    Information stealer and keylogger that hides inside legitimate Visual Basic applications.

  • Kutaki Executable 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 35 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://lifeinfotech.in/kpp.htm
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2096
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff856549758,0x7ff856549768,0x7ff856549778
      2⤵
        PID:4040
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1716 --field-trial-handle=1876,i,261424223232097888,16540746435097466589,131072 /prefetch:2
        2⤵
          PID:3488
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2016 --field-trial-handle=1876,i,261424223232097888,16540746435097466589,131072 /prefetch:8
          2⤵
            PID:3952
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2856 --field-trial-handle=1876,i,261424223232097888,16540746435097466589,131072 /prefetch:1
            2⤵
              PID:3908
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2848 --field-trial-handle=1876,i,261424223232097888,16540746435097466589,131072 /prefetch:1
              2⤵
                PID:3976
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2096 --field-trial-handle=1876,i,261424223232097888,16540746435097466589,131072 /prefetch:8
                2⤵
                  PID:3680
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4560 --field-trial-handle=1876,i,261424223232097888,16540746435097466589,131072 /prefetch:1
                  2⤵
                    PID:4452
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5324 --field-trial-handle=1876,i,261424223232097888,16540746435097466589,131072 /prefetch:8
                    2⤵
                      PID:4940
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5448 --field-trial-handle=1876,i,261424223232097888,16540746435097466589,131072 /prefetch:8
                      2⤵
                        PID:1940
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3924 --field-trial-handle=1876,i,261424223232097888,16540746435097466589,131072 /prefetch:8
                        2⤵
                          PID:4244
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=212 --field-trial-handle=1876,i,261424223232097888,16540746435097466589,131072 /prefetch:2
                          2⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:5604
                      • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                        1⤵
                          PID:1584
                        • C:\Windows\System32\rundll32.exe
                          C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                          1⤵
                            PID:3048
                          • C:\Users\Admin\AppData\Local\Temp\Temp1_Payment Confirmation.zip\Payment Confirmation.exe
                            "C:\Users\Admin\AppData\Local\Temp\Temp1_Payment Confirmation.zip\Payment Confirmation.exe"
                            1⤵
                            • Drops startup file
                            • Suspicious use of SetWindowsHookEx
                            PID:4372
                            • C:\Windows\SysWOW64\cmd.exe
                              cmd.exe /c C:\Users\Admin\AppData\Local\Temp\NewBitmapImage.bmp
                              2⤵
                              • Checks computer location settings
                              • Modifies registry class
                              PID:1956
                              • C:\Windows\SysWOW64\mspaint.exe
                                "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\NewBitmapImage.bmp"
                                3⤵
                                • Drops file in Windows directory
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of SetWindowsHookEx
                                PID:4448
                            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sovzyvfk.exe
                              "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sovzyvfk.exe"
                              2⤵
                              • Executes dropped EXE
                              • Suspicious use of SetWindowsHookEx
                              PID:3120
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
                            1⤵
                              PID:3060

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                              Filesize

                              1KB

                              MD5

                              f0905982f3920ccff8a054be0c96aaf1

                              SHA1

                              1684f6eb8ddbbf4e42ae427439a86e7a7b31ac13

                              SHA256

                              61a17ad59433ffab84cde9ca768eb72e3bcea9a3d1957bc21f23da6c2cdb4bb3

                              SHA512

                              0ae83897c9a59222a3f3bb911454521aa5498ed916d03cb6e7fc336c9c40de436094b8927771847b59bddab1adf6b498c6a33444c797022c268cebf70d29d05a

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              6KB

                              MD5

                              5828288e4be8663bf210ef8095ddf34e

                              SHA1

                              f01f021010ec93eaf7335af51fea1ac2497df185

                              SHA256

                              f665b91e0737c8ccc1f75052748a48194efeb12753e524f83885102b47eb8121

                              SHA512

                              93ef378a9451d28276b1a981f0f2b23f751fb954259052aba57c1ae92bf218e79995c5ce8235f0a7ca5c198c40b43db4dab23b7c238a49de02256a8ffa9e09f0

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                              Filesize

                              109KB

                              MD5

                              27a4e09fae6c4519177b12af62cbc524

                              SHA1

                              b660e9e0b09230d4263362fdf0222673de01371e

                              SHA256

                              401204fa05c4674e544fc37268390c605700bb52c4b2868d6dc33270be735b3e

                              SHA512

                              873251c8880e8758c3d30dd8ff238714c6cb49f1ca1d08d3c3264ecfa778cc64edab515ca994a94e489d3c7a2002870ea16c1d9c36d6c5191d79f946f69635a4

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

                              Filesize

                              106KB

                              MD5

                              25305e23e76f8de4deb9a23258cad0ea

                              SHA1

                              132a6b340cb34d6272c3b970a1476f72b940895f

                              SHA256

                              f7e43b7368532b53211b49b6102370e8f96d4c5a52d114d953063feca54213f1

                              SHA512

                              361ec26d5fa92162fee0bcf25ed94a6cd1269bbb62b8773fcae92fdd1693afe578d373a01a5fa2b39a3b0f56336bffc3f122776ffce21dcedf7fcb68dbc1e9f7

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe57d83f.TMP

                              Filesize

                              103KB

                              MD5

                              f55730659a5f22fcd95d32db851236fc

                              SHA1

                              aa1803f9a739e44dbc2c1d7e939fab7dd114da53

                              SHA256

                              b94fd237866d18d108ff56bfa230a6b997733714d329b46c4140ac7ca7f22791

                              SHA512

                              c2130d1fc4f49f0afe0aec12e2fc913338da9f133d02601bbab7eeaed174095428d837de55e9a57be977cf4f0a590219b811501e127ea0a571a9da6e1a1f2a03

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                              Filesize

                              2B

                              MD5

                              99914b932bd37a50b983c5e7c90ae93b

                              SHA1

                              bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                              SHA256

                              44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                              SHA512

                              27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

                            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sovzyvfk.exe

                              Filesize

                              693KB

                              MD5

                              83dc522603e439dcfe423be0d0fdd9de

                              SHA1

                              10199d50a8e3578a8bec53b8123816b7ead8405d

                              SHA256

                              3c2e048459f9fdb1fa44877a06af17501f560b62d4544bc7ce2c54f024d25cb3

                              SHA512

                              390eedf9dca55ff2d45c805d83267d41be34ad74de2d2551ca13f9e9741465720ed8c231b1432ea77bfc8bb17f010e2e1d07a4b03c6675f1bfa3ed6aa764ae6c

                            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sovzyvfk.exe

                              Filesize

                              693KB

                              MD5

                              83dc522603e439dcfe423be0d0fdd9de

                              SHA1

                              10199d50a8e3578a8bec53b8123816b7ead8405d

                              SHA256

                              3c2e048459f9fdb1fa44877a06af17501f560b62d4544bc7ce2c54f024d25cb3

                              SHA512

                              390eedf9dca55ff2d45c805d83267d41be34ad74de2d2551ca13f9e9741465720ed8c231b1432ea77bfc8bb17f010e2e1d07a4b03c6675f1bfa3ed6aa764ae6c

                            • C:\Users\Admin\Downloads\Payment Confirmation.zip

                              Filesize

                              402KB

                              MD5

                              5bd60c03eca46c54645d504ef1e5c50e

                              SHA1

                              ba90aa94f16f3dc39e2bd8b6f9720ddc79b27ddb

                              SHA256

                              105f100d80e1809e0bdc24571f165009a1e94043a2ace6854b70aa1d281521b9

                              SHA512

                              4859692ccd046d4653afd31d6a3f409d3e511284cc5454e992570ff493113ef5f20be746d470df16ad78158f8f0b6393c6eeaa03eb911d1a64a7966d05359203

                            • \??\pipe\crashpad_2096_WIBLMENLQGYDKWSG

                              MD5

                              d41d8cd98f00b204e9800998ecf8427e

                              SHA1

                              da39a3ee5e6b4b0d3255bfef95601890afd80709

                              SHA256

                              e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                              SHA512

                              cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e