Analysis
-
max time kernel
1803s -
max time network
1164s -
platform
windows11-21h2_x64 -
resource
win11-20231215-en -
resource tags
arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system -
submitted
04-02-2024 18:03
General
-
Target
a6f34907ae34f485e4091ba122886cb32a2cc27856d580fe289c8861d6241f27.exe
-
Size
743KB
-
MD5
3636153d8fdc065fc40aae264f39eb7f
-
SHA1
3f62736088952839a2379bb33575fc1e963e784e
-
SHA256
a6f34907ae34f485e4091ba122886cb32a2cc27856d580fe289c8861d6241f27
-
SHA512
96337dc43b446f6a2793715a8716a4ee688f9e0587020554dcc9a65c21a0b3ea54a2cf29954e23485b0fc29897a84d73a8df560d8b3dfc6f1807b7ca2da8a2b8
-
SSDEEP
12288:pUTq7ZKSOkkd+kQpGPqlSpwhm4s5bsGSCs5:u0ZIkkd+LrlSpnHuGE5
Malware Config
Signatures
-
Kutaki Executable 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lunlerio.exe family_kutaki -
Drops startup file 2 IoCs
Processes:
a6f34907ae34f485e4091ba122886cb32a2cc27856d580fe289c8861d6241f27.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lunlerio.exe a6f34907ae34f485e4091ba122886cb32a2cc27856d580fe289c8861d6241f27.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lunlerio.exe a6f34907ae34f485e4091ba122886cb32a2cc27856d580fe289c8861d6241f27.exe -
Executes dropped EXE 1 IoCs
Processes:
lunlerio.exepid process 1720 lunlerio.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
lunlerio.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum lunlerio.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 lunlerio.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
a6f34907ae34f485e4091ba122886cb32a2cc27856d580fe289c8861d6241f27.exelunlerio.exepid process 4004 a6f34907ae34f485e4091ba122886cb32a2cc27856d580fe289c8861d6241f27.exe 4004 a6f34907ae34f485e4091ba122886cb32a2cc27856d580fe289c8861d6241f27.exe 4004 a6f34907ae34f485e4091ba122886cb32a2cc27856d580fe289c8861d6241f27.exe 1720 lunlerio.exe 1720 lunlerio.exe 1720 lunlerio.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
a6f34907ae34f485e4091ba122886cb32a2cc27856d580fe289c8861d6241f27.exedescription pid process target process PID 4004 wrote to memory of 3316 4004 a6f34907ae34f485e4091ba122886cb32a2cc27856d580fe289c8861d6241f27.exe cmd.exe PID 4004 wrote to memory of 3316 4004 a6f34907ae34f485e4091ba122886cb32a2cc27856d580fe289c8861d6241f27.exe cmd.exe PID 4004 wrote to memory of 3316 4004 a6f34907ae34f485e4091ba122886cb32a2cc27856d580fe289c8861d6241f27.exe cmd.exe PID 4004 wrote to memory of 1720 4004 a6f34907ae34f485e4091ba122886cb32a2cc27856d580fe289c8861d6241f27.exe lunlerio.exe PID 4004 wrote to memory of 1720 4004 a6f34907ae34f485e4091ba122886cb32a2cc27856d580fe289c8861d6241f27.exe lunlerio.exe PID 4004 wrote to memory of 1720 4004 a6f34907ae34f485e4091ba122886cb32a2cc27856d580fe289c8861d6241f27.exe lunlerio.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a6f34907ae34f485e4091ba122886cb32a2cc27856d580fe289c8861d6241f27.exe"C:\Users\Admin\AppData\Local\Temp\a6f34907ae34f485e4091ba122886cb32a2cc27856d580fe289c8861d6241f27.exe"1⤵
- Drops startup file
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Users\Admin\AppData\Local\Temp\2⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lunlerio.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lunlerio.exe"2⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lunlerio.exeFilesize
743KB
MD53636153d8fdc065fc40aae264f39eb7f
SHA13f62736088952839a2379bb33575fc1e963e784e
SHA256a6f34907ae34f485e4091ba122886cb32a2cc27856d580fe289c8861d6241f27
SHA51296337dc43b446f6a2793715a8716a4ee688f9e0587020554dcc9a65c21a0b3ea54a2cf29954e23485b0fc29897a84d73a8df560d8b3dfc6f1807b7ca2da8a2b8