Analysis
-
max time kernel
56s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
12-02-2024 07:12
Behavioral task
behavioral1
Sample
9693fd176c8734b1928a56cb9771a0c8.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
9693fd176c8734b1928a56cb9771a0c8.exe
Resource
win10v2004-20231215-en
General
-
Target
9693fd176c8734b1928a56cb9771a0c8.exe
-
Size
376KB
-
MD5
9693fd176c8734b1928a56cb9771a0c8
-
SHA1
35d2579e6a03c2e769b17f1aa8ce934f91fd5e13
-
SHA256
381ec80e02dba4fe1877e427522ea92a94b29b7f45bddd11c1f2ef9724dd6d2e
-
SHA512
cb68ab4fb44c52763294fbe010ae6383d1feafa0ea67c663c333f36b5ddac7374b2a787fe7f6b331893c40e94c060782a6d2a65acadb5771c05defe103a6a847
-
SSDEEP
6144:7IaXScY1S4GlA9jmHv/VCSY3hw9lMbk6u1QMS0y+lqiHTonWryFDYRF:H46A9jmP/uhu/yMS08CkntxYRF
Malware Config
Signatures
-
Kutaki Executable 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rkbblfch.exe family_kutaki -
Drops startup file 2 IoCs
Processes:
9693fd176c8734b1928a56cb9771a0c8.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rkbblfch.exe 9693fd176c8734b1928a56cb9771a0c8.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rkbblfch.exe 9693fd176c8734b1928a56cb9771a0c8.exe -
Executes dropped EXE 1 IoCs
Processes:
rkbblfch.exepid process 2716 rkbblfch.exe -
Loads dropped DLL 2 IoCs
Processes:
9693fd176c8734b1928a56cb9771a0c8.exepid process 3060 9693fd176c8734b1928a56cb9771a0c8.exe 3060 9693fd176c8734b1928a56cb9771a0c8.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
DllHost.exepid process 2612 DllHost.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
9693fd176c8734b1928a56cb9771a0c8.exerkbblfch.exepid process 3060 9693fd176c8734b1928a56cb9771a0c8.exe 3060 9693fd176c8734b1928a56cb9771a0c8.exe 3060 9693fd176c8734b1928a56cb9771a0c8.exe 2716 rkbblfch.exe 2716 rkbblfch.exe 2716 rkbblfch.exe 2716 rkbblfch.exe 2716 rkbblfch.exe 2716 rkbblfch.exe 2716 rkbblfch.exe 2716 rkbblfch.exe 2716 rkbblfch.exe 2716 rkbblfch.exe 2716 rkbblfch.exe 2716 rkbblfch.exe 2716 rkbblfch.exe 2716 rkbblfch.exe 2716 rkbblfch.exe 2716 rkbblfch.exe 2716 rkbblfch.exe 2716 rkbblfch.exe 2716 rkbblfch.exe 2716 rkbblfch.exe 2716 rkbblfch.exe 2716 rkbblfch.exe 2716 rkbblfch.exe 2716 rkbblfch.exe 2716 rkbblfch.exe 2716 rkbblfch.exe 2716 rkbblfch.exe 2716 rkbblfch.exe 2716 rkbblfch.exe 2716 rkbblfch.exe 2716 rkbblfch.exe 2716 rkbblfch.exe 2716 rkbblfch.exe 2716 rkbblfch.exe 2716 rkbblfch.exe 2716 rkbblfch.exe 2716 rkbblfch.exe 2716 rkbblfch.exe 2716 rkbblfch.exe 2716 rkbblfch.exe 2716 rkbblfch.exe 2716 rkbblfch.exe 2716 rkbblfch.exe 2716 rkbblfch.exe 2716 rkbblfch.exe 2716 rkbblfch.exe 2716 rkbblfch.exe 2716 rkbblfch.exe 2716 rkbblfch.exe 2716 rkbblfch.exe 2716 rkbblfch.exe 2716 rkbblfch.exe 2716 rkbblfch.exe 2716 rkbblfch.exe 2716 rkbblfch.exe 2716 rkbblfch.exe 2716 rkbblfch.exe 2716 rkbblfch.exe 2716 rkbblfch.exe 2716 rkbblfch.exe 2716 rkbblfch.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
9693fd176c8734b1928a56cb9771a0c8.exedescription pid process target process PID 3060 wrote to memory of 2760 3060 9693fd176c8734b1928a56cb9771a0c8.exe cmd.exe PID 3060 wrote to memory of 2760 3060 9693fd176c8734b1928a56cb9771a0c8.exe cmd.exe PID 3060 wrote to memory of 2760 3060 9693fd176c8734b1928a56cb9771a0c8.exe cmd.exe PID 3060 wrote to memory of 2760 3060 9693fd176c8734b1928a56cb9771a0c8.exe cmd.exe PID 3060 wrote to memory of 2716 3060 9693fd176c8734b1928a56cb9771a0c8.exe rkbblfch.exe PID 3060 wrote to memory of 2716 3060 9693fd176c8734b1928a56cb9771a0c8.exe rkbblfch.exe PID 3060 wrote to memory of 2716 3060 9693fd176c8734b1928a56cb9771a0c8.exe rkbblfch.exe PID 3060 wrote to memory of 2716 3060 9693fd176c8734b1928a56cb9771a0c8.exe rkbblfch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9693fd176c8734b1928a56cb9771a0c8.exe"C:\Users\Admin\AppData\Local\Temp\9693fd176c8734b1928a56cb9771a0c8.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Users\Admin\AppData\Local\Temp\NewBitmapImage.bmp2⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rkbblfch.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rkbblfch.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rkbblfch.exeFilesize
376KB
MD59693fd176c8734b1928a56cb9771a0c8
SHA135d2579e6a03c2e769b17f1aa8ce934f91fd5e13
SHA256381ec80e02dba4fe1877e427522ea92a94b29b7f45bddd11c1f2ef9724dd6d2e
SHA512cb68ab4fb44c52763294fbe010ae6383d1feafa0ea67c663c333f36b5ddac7374b2a787fe7f6b331893c40e94c060782a6d2a65acadb5771c05defe103a6a847
-
memory/2612-63-0x0000000000120000-0x0000000000122000-memory.dmpFilesize
8KB
-
memory/2612-64-0x00000000001D0000-0x00000000001D1000-memory.dmpFilesize
4KB
-
memory/2612-65-0x00000000001D0000-0x00000000001D1000-memory.dmpFilesize
4KB
-
memory/2716-66-0x0000000004230000-0x000000000427F000-memory.dmpFilesize
316KB
-
memory/2716-67-0x0000000004430000-0x0000000005492000-memory.dmpFilesize
16.4MB
-
memory/2760-62-0x0000000002160000-0x0000000002162000-memory.dmpFilesize
8KB