Analysis
-
max time kernel
119s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
10-11-2023 02:22
Behavioral task
behavioral1
Sample
2114e284c9636a3b015aadb156369d5c55dc29541bc9f27ecf3724f16a65fa8d.exe
Resource
win7-20231023-en
General
-
Target
2114e284c9636a3b015aadb156369d5c55dc29541bc9f27ecf3724f16a65fa8d.exe
-
Size
501KB
-
MD5
816cdd0d2e0852404804a683d1cd1b53
-
SHA1
9842b46047c8ef18a2041a7a35fe3b51515dd829
-
SHA256
2114e284c9636a3b015aadb156369d5c55dc29541bc9f27ecf3724f16a65fa8d
-
SHA512
9648bb75a15afb57baeb7c9becf994dece54f499f04df344210c8241839d493599b71cf7ae7a9f4f790009ba3a9b8d2f80df7db41bac5b78edce20bd1a115cf2
-
SSDEEP
12288:6Ycs+XKy/AZe+e9AP8LP810o4HfyNQlQj0DunOq0Mte9oIopkyd+wMeMIC10pqTO:6Ycs+XKy/AZeJ9AP8LP810o4HfyNQlQn
Malware Config
Extracted
kutaki
http://linkwotowoto.club/new/two.php
Signatures
-
Kutaki Executable 4 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\psuqtnfk.exe family_kutaki \Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\psuqtnfk.exe family_kutaki C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\psuqtnfk.exe family_kutaki C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\psuqtnfk.exe family_kutaki -
Drops startup file 2 IoCs
Processes:
2114e284c9636a3b015aadb156369d5c55dc29541bc9f27ecf3724f16a65fa8d.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\psuqtnfk.exe 2114e284c9636a3b015aadb156369d5c55dc29541bc9f27ecf3724f16a65fa8d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\psuqtnfk.exe 2114e284c9636a3b015aadb156369d5c55dc29541bc9f27ecf3724f16a65fa8d.exe -
Executes dropped EXE 1 IoCs
Processes:
psuqtnfk.exepid process 1288 psuqtnfk.exe -
Loads dropped DLL 2 IoCs
Processes:
2114e284c9636a3b015aadb156369d5c55dc29541bc9f27ecf3724f16a65fa8d.exepid process 2060 2114e284c9636a3b015aadb156369d5c55dc29541bc9f27ecf3724f16a65fa8d.exe 2060 2114e284c9636a3b015aadb156369d5c55dc29541bc9f27ecf3724f16a65fa8d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
DllHost.exepid process 2644 DllHost.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
2114e284c9636a3b015aadb156369d5c55dc29541bc9f27ecf3724f16a65fa8d.exepsuqtnfk.exepid process 2060 2114e284c9636a3b015aadb156369d5c55dc29541bc9f27ecf3724f16a65fa8d.exe 2060 2114e284c9636a3b015aadb156369d5c55dc29541bc9f27ecf3724f16a65fa8d.exe 2060 2114e284c9636a3b015aadb156369d5c55dc29541bc9f27ecf3724f16a65fa8d.exe 1288 psuqtnfk.exe 1288 psuqtnfk.exe 1288 psuqtnfk.exe 1288 psuqtnfk.exe 1288 psuqtnfk.exe 1288 psuqtnfk.exe 1288 psuqtnfk.exe 1288 psuqtnfk.exe 1288 psuqtnfk.exe 1288 psuqtnfk.exe 1288 psuqtnfk.exe 1288 psuqtnfk.exe 1288 psuqtnfk.exe 1288 psuqtnfk.exe 1288 psuqtnfk.exe 1288 psuqtnfk.exe 1288 psuqtnfk.exe 1288 psuqtnfk.exe 1288 psuqtnfk.exe 1288 psuqtnfk.exe 1288 psuqtnfk.exe 1288 psuqtnfk.exe 1288 psuqtnfk.exe 1288 psuqtnfk.exe 1288 psuqtnfk.exe 1288 psuqtnfk.exe 1288 psuqtnfk.exe 1288 psuqtnfk.exe 1288 psuqtnfk.exe 1288 psuqtnfk.exe 1288 psuqtnfk.exe 1288 psuqtnfk.exe 1288 psuqtnfk.exe 1288 psuqtnfk.exe 1288 psuqtnfk.exe 1288 psuqtnfk.exe 1288 psuqtnfk.exe 1288 psuqtnfk.exe 1288 psuqtnfk.exe 1288 psuqtnfk.exe 1288 psuqtnfk.exe 1288 psuqtnfk.exe 1288 psuqtnfk.exe 1288 psuqtnfk.exe 1288 psuqtnfk.exe 1288 psuqtnfk.exe 1288 psuqtnfk.exe 1288 psuqtnfk.exe 1288 psuqtnfk.exe 1288 psuqtnfk.exe 1288 psuqtnfk.exe 1288 psuqtnfk.exe 1288 psuqtnfk.exe 1288 psuqtnfk.exe 1288 psuqtnfk.exe 1288 psuqtnfk.exe 1288 psuqtnfk.exe 1288 psuqtnfk.exe 1288 psuqtnfk.exe 1288 psuqtnfk.exe 1288 psuqtnfk.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
2114e284c9636a3b015aadb156369d5c55dc29541bc9f27ecf3724f16a65fa8d.exedescription pid process target process PID 2060 wrote to memory of 2856 2060 2114e284c9636a3b015aadb156369d5c55dc29541bc9f27ecf3724f16a65fa8d.exe cmd.exe PID 2060 wrote to memory of 2856 2060 2114e284c9636a3b015aadb156369d5c55dc29541bc9f27ecf3724f16a65fa8d.exe cmd.exe PID 2060 wrote to memory of 2856 2060 2114e284c9636a3b015aadb156369d5c55dc29541bc9f27ecf3724f16a65fa8d.exe cmd.exe PID 2060 wrote to memory of 2856 2060 2114e284c9636a3b015aadb156369d5c55dc29541bc9f27ecf3724f16a65fa8d.exe cmd.exe PID 2060 wrote to memory of 1288 2060 2114e284c9636a3b015aadb156369d5c55dc29541bc9f27ecf3724f16a65fa8d.exe psuqtnfk.exe PID 2060 wrote to memory of 1288 2060 2114e284c9636a3b015aadb156369d5c55dc29541bc9f27ecf3724f16a65fa8d.exe psuqtnfk.exe PID 2060 wrote to memory of 1288 2060 2114e284c9636a3b015aadb156369d5c55dc29541bc9f27ecf3724f16a65fa8d.exe psuqtnfk.exe PID 2060 wrote to memory of 1288 2060 2114e284c9636a3b015aadb156369d5c55dc29541bc9f27ecf3724f16a65fa8d.exe psuqtnfk.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2114e284c9636a3b015aadb156369d5c55dc29541bc9f27ecf3724f16a65fa8d.exe"C:\Users\Admin\AppData\Local\Temp\2114e284c9636a3b015aadb156369d5c55dc29541bc9f27ecf3724f16a65fa8d.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Users\Admin\AppData\Local\Temp\NewBitmapImage.bmp2⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\psuqtnfk.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\psuqtnfk.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\psuqtnfk.exeFilesize
501KB
MD5816cdd0d2e0852404804a683d1cd1b53
SHA19842b46047c8ef18a2041a7a35fe3b51515dd829
SHA2562114e284c9636a3b015aadb156369d5c55dc29541bc9f27ecf3724f16a65fa8d
SHA5129648bb75a15afb57baeb7c9becf994dece54f499f04df344210c8241839d493599b71cf7ae7a9f4f790009ba3a9b8d2f80df7db41bac5b78edce20bd1a115cf2
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\psuqtnfk.exeFilesize
501KB
MD5816cdd0d2e0852404804a683d1cd1b53
SHA19842b46047c8ef18a2041a7a35fe3b51515dd829
SHA2562114e284c9636a3b015aadb156369d5c55dc29541bc9f27ecf3724f16a65fa8d
SHA5129648bb75a15afb57baeb7c9becf994dece54f499f04df344210c8241839d493599b71cf7ae7a9f4f790009ba3a9b8d2f80df7db41bac5b78edce20bd1a115cf2
-
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\psuqtnfk.exeFilesize
501KB
MD5816cdd0d2e0852404804a683d1cd1b53
SHA19842b46047c8ef18a2041a7a35fe3b51515dd829
SHA2562114e284c9636a3b015aadb156369d5c55dc29541bc9f27ecf3724f16a65fa8d
SHA5129648bb75a15afb57baeb7c9becf994dece54f499f04df344210c8241839d493599b71cf7ae7a9f4f790009ba3a9b8d2f80df7db41bac5b78edce20bd1a115cf2
-
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\psuqtnfk.exeFilesize
501KB
MD5816cdd0d2e0852404804a683d1cd1b53
SHA19842b46047c8ef18a2041a7a35fe3b51515dd829
SHA2562114e284c9636a3b015aadb156369d5c55dc29541bc9f27ecf3724f16a65fa8d
SHA5129648bb75a15afb57baeb7c9becf994dece54f499f04df344210c8241839d493599b71cf7ae7a9f4f790009ba3a9b8d2f80df7db41bac5b78edce20bd1a115cf2
-
memory/2644-63-0x00000000001A0000-0x00000000001A2000-memory.dmpFilesize
8KB
-
memory/2644-64-0x0000000000250000-0x0000000000251000-memory.dmpFilesize
4KB
-
memory/2644-65-0x0000000000250000-0x0000000000251000-memory.dmpFilesize
4KB
-
memory/2856-62-0x00000000020F0000-0x00000000020F2000-memory.dmpFilesize
8KB