Overview

overview

10

Static

static

1

URLScan

urlscan

1

https://bongdalu.med...

windows10-1703-x64

10

Analysis

  • max time kernel
    64s
  • max time network
    64s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    09-05-2024 05:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    https://bongdalu.media/wp-content/plugins/wp-automatic/challan.zip

Score
10/10
kutakikeyloggerstealer

Malware Config

Extracted

Family

kutaki

C2

http://treysbeatend.com/laptop/squared.php

http://terebinnahicc.club/sec/kool.txt

Signatures

  • Kutaki

    Information stealer and keylogger that hides inside legitimate Visual Basic applications.

    stealerkeyloggerkutaki
  • Drops startup file 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\LaunchWinApp.exe
    "C:\Windows\system32\LaunchWinApp.exe" "https://bongdalu.media/wp-content/plugins/wp-automatic/challan.zip"
    1⤵
      PID:512
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:212
    • C:\Windows\system32\browser_broker.exe
      C:\Windows\system32\browser_broker.exe -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • NTFS ADS
      PID:5028
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies registry class
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2004
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:4968
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      PID:3500
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      PID:4472
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:2332
      • C:\Users\Admin\AppData\Local\Temp\Temp1_challan.zip\challan.cmd
        "C:\Users\Admin\AppData\Local\Temp\Temp1_challan.zip\challan.cmd"
        1⤵
        • Drops startup file
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4060
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c C:\Users\Admin\AppData\Local\Temp\
          2⤵
            PID:2444
          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ffbmfafk.exe
            "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ffbmfafk.exe"
            2⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:4956

        Network

        MITRE ATT&CK Matrix ATT&CK v13

        Initial Access

        Execution

        Persistence

        Privilege Escalation

        Defense Evasion

        Modify Registry

        1
        T1112

        Credential Access

        Discovery

        System Information Discovery

        1
        T1082

        Query Registry

        1
        T1012

        Lateral Movement

        Collection

        Exfiltration

        Command and Control

        Impact

        Resource Development

        Reconnaissance

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Temp\~DF580AA110EED96D0E.TMP
          Filesize

          24KB

          MD5

          47db71aa3c925542ea1dbb2ae6434b64

          SHA1

          0a6458fa112370b17b81091f22924900ca91e253

          SHA256

          5a81d9aeaa5e368d54cc54d9a0cae95d23cd03009510fdbcca62f870687d47ae

          SHA512

          2f0e7e22736afc2f0f2e676236459abe58bcba7e15778684e2b519bb135801fda18e4648a0c82c2abc54e07b8cda3c60a2d2ce9d4dd46b42f365c438d94163de

          Download Submit
        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\challan.zip.6i5uq8g.partial
          Filesize

          323KB

          MD5

          1294ac7fe599c30704fa1e8490334db1

          SHA1

          ef20b2f7a1ff52116e45b7d9229839640f3a1ef7

          SHA256

          c32da53d5fc9390e89095e10efc76c469175e49ffbc88303b0073dfac98179c4

          SHA512

          2af5a286f45bc7b75c0d91e3ab54d85487b76a78c69d05f29d9005ecb0abaac38b6fca2164d679d136a292c604ff592fe027dc7634d8ed40d4e50069a3ee50cc

          Download Submit
        • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\1BSU2TDD\challan[1].zip
          Filesize

          63KB

          MD5

          852f62121e9264c86f020c54d654b6f1

          SHA1

          87f75ccaa931ce8aaa7fbb9b89adde3d2f2adbd5

          SHA256

          678b689e833d87672c56c329201a6fca15bede2547834ab51744f3e5842aab73

          SHA512

          458f564958310fc20e7aa8059e4d9d03a364bbfa0c67f2c5714f37b179c3670cab978ca1a8c018da73d133567649864040a373d91526f84d1a747d9ed4585fc4

          Download Submit
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ffbmfafk.exe
          Filesize

          460KB

          MD5

          6b4e999cea39ddf88ba99a25a9953592

          SHA1

          61de1f1624705164ac5d57e4b5bf8870f8534784

          SHA256

          de1eb2286c9e65e7e8f7e3d7a19330015f3b3a9718d7d78646622f3c3ce07995

          SHA512

          312573d55cfcfc624e486ca86903b2a0f6d2ce1fef36b13692ae55d5d806f5baa4393bdd31f93fd40ac001218d54f26317ca8aa2314d4057b393e4d864df3c54

          Download Submit
        • memory/212-17-0x0000025463830000-0x0000025463840000-memory.dmp
          Filesize

          64KB

          Download
        • memory/212-126-0x0000025460CE0000-0x0000025460CE1000-memory.dmp
          Filesize

          4KB

          Download
        • memory/212-69-0x0000025469CC0000-0x0000025469CC1000-memory.dmp
          Filesize

          4KB

          Download
        • memory/212-70-0x0000025469CD0000-0x0000025469CD1000-memory.dmp
          Filesize

          4KB

          Download
        • memory/212-123-0x0000025462800000-0x0000025462802000-memory.dmp
          Filesize

          8KB

          Download
        • memory/212-130-0x00000254609A0000-0x00000254609A1000-memory.dmp
          Filesize

          4KB

          Download
        • memory/212-35-0x0000025460C90000-0x0000025460C92000-memory.dmp
          Filesize

          8KB

          Download
        • memory/212-0-0x0000025463720000-0x0000025463730000-memory.dmp
          Filesize

          64KB

          Download
        • memory/3500-58-0x0000022913AA0000-0x0000022913BA0000-memory.dmp
          Filesize

          1024KB

          Download
        • memory/3500-66-0x0000022923E10000-0x0000022923E12000-memory.dmp
          Filesize

          8KB

          Download
        • memory/3500-64-0x0000022923C50000-0x0000022923C52000-memory.dmp
          Filesize

          8KB

          Download
        • memory/3500-61-0x0000022923C20000-0x0000022923C22000-memory.dmp
          Filesize

          8KB

          Download
        • memory/4472-78-0x000001BCB0E00000-0x000001BCB0F00000-memory.dmp
          Filesize

          1024KB

          Download
        • memory/4968-43-0x0000024D80B00000-0x0000024D80C00000-memory.dmp
          Filesize

          1024KB

          Download
        • memory/4968-45-0x0000024D80B00000-0x0000024D80C00000-memory.dmp
          Filesize

          1024KB

          Download