Analysis
-
max time kernel
149s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
26-02-2024 11:34
Behavioral task
behavioral1
Sample
Challan.exe
Resource
win7-20240221-en
General
-
Target
Challan.exe
-
Size
573KB
-
MD5
111d37dd39bb7f73b76eb13e22a16178
-
SHA1
c358557e24b87ae758606d707763bfa95da88a61
-
SHA256
6492086998bb2a858614dc2310e2349d5a282eadc5a08376c1111dca7d765c7f
-
SHA512
31b0424ce110261af02c23c94a60659301ba6eacc4223578b04fe1fc815f4eb41f7d899f6322e642a6df62e88580a4d70131a01500ebe12b9ffa46d9e7232bf4
-
SSDEEP
12288:Ua4NFT8ElW46A9jmP/uhu/yMS08CkntxYRtqL:J6YahfmP/UDMS08Ckn3v
Malware Config
Extracted
kutaki
http://linkwotowoto.club/new/two.php
Signatures
-
Kutaki Executable 1 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xbtrtdfk.exe family_kutaki -
Drops startup file 2 IoCs
Processes:
Challan.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xbtrtdfk.exe Challan.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xbtrtdfk.exe Challan.exe -
Executes dropped EXE 1 IoCs
Processes:
xbtrtdfk.exepid process 2956 xbtrtdfk.exe -
Loads dropped DLL 2 IoCs
Processes:
Challan.exepid process 2740 Challan.exe 2740 Challan.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
DllHost.exepid process 2636 DllHost.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
Challan.exexbtrtdfk.exepid process 2740 Challan.exe 2740 Challan.exe 2740 Challan.exe 2956 xbtrtdfk.exe 2956 xbtrtdfk.exe 2956 xbtrtdfk.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
Challan.exedescription pid process target process PID 2740 wrote to memory of 1624 2740 Challan.exe cmd.exe PID 2740 wrote to memory of 1624 2740 Challan.exe cmd.exe PID 2740 wrote to memory of 1624 2740 Challan.exe cmd.exe PID 2740 wrote to memory of 1624 2740 Challan.exe cmd.exe PID 2740 wrote to memory of 2956 2740 Challan.exe xbtrtdfk.exe PID 2740 wrote to memory of 2956 2740 Challan.exe xbtrtdfk.exe PID 2740 wrote to memory of 2956 2740 Challan.exe xbtrtdfk.exe PID 2740 wrote to memory of 2956 2740 Challan.exe xbtrtdfk.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Challan.exe"C:\Users\Admin\AppData\Local\Temp\Challan.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Users\Admin\AppData\Local\Temp\NewBitmapImage.bmp2⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xbtrtdfk.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xbtrtdfk.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xbtrtdfk.exeFilesize
573KB
MD5111d37dd39bb7f73b76eb13e22a16178
SHA1c358557e24b87ae758606d707763bfa95da88a61
SHA2566492086998bb2a858614dc2310e2349d5a282eadc5a08376c1111dca7d765c7f
SHA51231b0424ce110261af02c23c94a60659301ba6eacc4223578b04fe1fc815f4eb41f7d899f6322e642a6df62e88580a4d70131a01500ebe12b9ffa46d9e7232bf4
-
memory/1624-62-0x00000000005F0000-0x00000000005F2000-memory.dmpFilesize
8KB
-
memory/2636-63-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/2636-64-0x00000000007B0000-0x00000000007B1000-memory.dmpFilesize
4KB
-
memory/2636-65-0x00000000007B0000-0x00000000007B1000-memory.dmpFilesize
4KB