kutaki | 314354ecd6851e77c74ab85bba3a53c9f2ee6c95010410f8ef3c5c435600ecb2

General

Target

314354ecd6851e77c74ab85bba3a53c9f2ee6c95010410f8ef3c5c435600ecb2.exe
Size

617KB
MD5

9b719e21e56dfe22fe282fcd496d83c6
SHA1

f0229d661757258893ca0f0b9daf21ac52d71364
SHA256

314354ecd6851e77c74ab85bba3a53c9f2ee6c95010410f8ef3c5c435600ecb2
SHA512

c969de50ba51747e457aed23a2f60a131e055d217c8e941ea03e0f51a2f441d4dc4f105ae78418f7be9bec326f7949ebabe174e9c50226c6ef8c59c57418750e
SSDEEP

12288:eFT8EyAFXYN1hP46A9jmP/uhu/yMS08CkntxYRmqL:uYlAFXqAfmP/UDMS08Ckn3A

Score

10^/10

kutaki keylogger stealer

Malware Config

Extracted

Family

kutaki

C2

http://linkwotowoto.club/new/two.php

Signatures

Kutaki
Information stealer and keylogger that hides inside legitimate Visual Basic applications.
stealer keylogger kutaki

Kutaki Executable 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ezbmabfk.exe	family_kutaki

Drops startup file 2 IoCs

Processes:

314354ecd6851e77c74ab85bba3a53c9f2ee6c95010410f8ef3c5c435600ecb2.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ezbmabfk.exe	314354ecd6851e77c74ab85bba3a53c9f2ee6c95010410f8ef3c5c435600ecb2.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ezbmabfk.exe	314354ecd6851e77c74ab85bba3a53c9f2ee6c95010410f8ef3c5c435600ecb2.exe

Executes dropped EXE 1 IoCs

Processes:

ezbmabfk.exe

pid process

2552 ezbmabfk.exe

pid	process
2552	ezbmabfk.exe

Loads dropped DLL 2 IoCs

Processes:

314354ecd6851e77c74ab85bba3a53c9f2ee6c95010410f8ef3c5c435600ecb2.exe

pid	process
2192	314354ecd6851e77c74ab85bba3a53c9f2ee6c95010410f8ef3c5c435600ecb2.exe
2192	314354ecd6851e77c74ab85bba3a53c9f2ee6c95010410f8ef3c5c435600ecb2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

DllHost.exe

pid process

2436 DllHost.exe

pid	process
2436	DllHost.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

314354ecd6851e77c74ab85bba3a53c9f2ee6c95010410f8ef3c5c435600ecb2.exeezbmabfk.exe

pid	process
2192	314354ecd6851e77c74ab85bba3a53c9f2ee6c95010410f8ef3c5c435600ecb2.exe
2192	314354ecd6851e77c74ab85bba3a53c9f2ee6c95010410f8ef3c5c435600ecb2.exe
2192	314354ecd6851e77c74ab85bba3a53c9f2ee6c95010410f8ef3c5c435600ecb2.exe
2552	ezbmabfk.exe
2552	ezbmabfk.exe
2552	ezbmabfk.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

314354ecd6851e77c74ab85bba3a53c9f2ee6c95010410f8ef3c5c435600ecb2.exe

description	pid	process	target process
PID 2192 wrote to memory of 2984	2192	314354ecd6851e77c74ab85bba3a53c9f2ee6c95010410f8ef3c5c435600ecb2.exe	cmd.exe
PID 2192 wrote to memory of 2984	2192	314354ecd6851e77c74ab85bba3a53c9f2ee6c95010410f8ef3c5c435600ecb2.exe	cmd.exe
PID 2192 wrote to memory of 2984	2192	314354ecd6851e77c74ab85bba3a53c9f2ee6c95010410f8ef3c5c435600ecb2.exe	cmd.exe
PID 2192 wrote to memory of 2984	2192	314354ecd6851e77c74ab85bba3a53c9f2ee6c95010410f8ef3c5c435600ecb2.exe	cmd.exe
PID 2192 wrote to memory of 2552	2192	314354ecd6851e77c74ab85bba3a53c9f2ee6c95010410f8ef3c5c435600ecb2.exe	ezbmabfk.exe
PID 2192 wrote to memory of 2552	2192	314354ecd6851e77c74ab85bba3a53c9f2ee6c95010410f8ef3c5c435600ecb2.exe	ezbmabfk.exe
PID 2192 wrote to memory of 2552	2192	314354ecd6851e77c74ab85bba3a53c9f2ee6c95010410f8ef3c5c435600ecb2.exe	ezbmabfk.exe
PID 2192 wrote to memory of 2552	2192	314354ecd6851e77c74ab85bba3a53c9f2ee6c95010410f8ef3c5c435600ecb2.exe	ezbmabfk.exe

C:\Users\Admin\AppData\Local\Temp\314354ecd6851e77c74ab85bba3a53c9f2ee6c95010410f8ef3c5c435600ecb2.exe
"C:\Users\Admin\AppData\Local\Temp\314354ecd6851e77c74ab85bba3a53c9f2ee6c95010410f8ef3c5c435600ecb2.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2192

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c C:\Users\Admin\AppData\Local\Temp\NewBitmapImage.bmp
2⤵
PID:2984

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ezbmabfk.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ezbmabfk.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2552

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Suspicious use of FindShellTrayWindow
PID:2436

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ezbmabfk.exe
Filesize
617KB

MD5
9b719e21e56dfe22fe282fcd496d83c6

SHA1
f0229d661757258893ca0f0b9daf21ac52d71364

SHA256
314354ecd6851e77c74ab85bba3a53c9f2ee6c95010410f8ef3c5c435600ecb2

SHA512
c969de50ba51747e457aed23a2f60a131e055d217c8e941ea03e0f51a2f441d4dc4f105ae78418f7be9bec326f7949ebabe174e9c50226c6ef8c59c57418750e

Download Submit
memory/2436-63-0x0000000000160000-0x0000000000162000-memory.dmp

Filesize
8KB

Download
memory/2436-64-0x0000000000200000-0x0000000000201000-memory.dmp

Filesize
4KB

Download
memory/2436-65-0x0000000000200000-0x0000000000201000-memory.dmp

Filesize
4KB

Download
memory/2984-62-0x0000000002040000-0x0000000002042000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads