kutaki | 682572888b60da06809d5f5dbce53b9a1bfede2d7a2deae9039e3020d68b1a73

General

Target

682572888b60da06809d5f5dbce53b9a1bfede2d7a2deae9039e3020d68b1a73.exe
Size

465KB
MD5

ae6e96376af9418752b9c2c9e9e1debf
SHA1

bbb067145926697c07e80a0308106112b1189039
SHA256

682572888b60da06809d5f5dbce53b9a1bfede2d7a2deae9039e3020d68b1a73
SHA512

4164d0c607636d6ba462d9556c7841cb77131e693c6a0af15cb062222052e099bfcc44f941f9fd5f1e19f585ca9b85d2e4f25b994f2b1415deb48782d64971b7
SSDEEP

12288:IVl4yCL6f6f0xB81IWa46A9jmP/uhu/yMS08CkntxYRYL:a7k3fmP/UDMS08Ckn3X

Score

10^/10

kutaki keylogger stealer

Malware Config

Extracted

Family

kutaki

C2

http://newlinkwotolove.club/love/three.php

Signatures

Kutaki
Information stealer and keylogger that hides inside legitimate Visual Basic applications.
stealer keylogger kutaki

Kutaki Executable 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\exljvofk.exe	family_kutaki

Drops startup file 2 IoCs

Processes:

682572888b60da06809d5f5dbce53b9a1bfede2d7a2deae9039e3020d68b1a73.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\exljvofk.exe	682572888b60da06809d5f5dbce53b9a1bfede2d7a2deae9039e3020d68b1a73.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\exljvofk.exe	682572888b60da06809d5f5dbce53b9a1bfede2d7a2deae9039e3020d68b1a73.exe

Executes dropped EXE 1 IoCs

Processes:

exljvofk.exe

pid process

2460 exljvofk.exe

pid	process
2460	exljvofk.exe

Loads dropped DLL 2 IoCs

Processes:

682572888b60da06809d5f5dbce53b9a1bfede2d7a2deae9039e3020d68b1a73.exe

pid	process
2164	682572888b60da06809d5f5dbce53b9a1bfede2d7a2deae9039e3020d68b1a73.exe
2164	682572888b60da06809d5f5dbce53b9a1bfede2d7a2deae9039e3020d68b1a73.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

DllHost.exe

pid process

2388 DllHost.exe

pid	process
2388	DllHost.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

682572888b60da06809d5f5dbce53b9a1bfede2d7a2deae9039e3020d68b1a73.exeexljvofk.exe

pid	process
2164	682572888b60da06809d5f5dbce53b9a1bfede2d7a2deae9039e3020d68b1a73.exe
2164	682572888b60da06809d5f5dbce53b9a1bfede2d7a2deae9039e3020d68b1a73.exe
2164	682572888b60da06809d5f5dbce53b9a1bfede2d7a2deae9039e3020d68b1a73.exe
2460	exljvofk.exe
2460	exljvofk.exe
2460	exljvofk.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

682572888b60da06809d5f5dbce53b9a1bfede2d7a2deae9039e3020d68b1a73.exe

description	pid	process	target process
PID 2164 wrote to memory of 2724	2164	682572888b60da06809d5f5dbce53b9a1bfede2d7a2deae9039e3020d68b1a73.exe	cmd.exe
PID 2164 wrote to memory of 2724	2164	682572888b60da06809d5f5dbce53b9a1bfede2d7a2deae9039e3020d68b1a73.exe	cmd.exe
PID 2164 wrote to memory of 2724	2164	682572888b60da06809d5f5dbce53b9a1bfede2d7a2deae9039e3020d68b1a73.exe	cmd.exe
PID 2164 wrote to memory of 2724	2164	682572888b60da06809d5f5dbce53b9a1bfede2d7a2deae9039e3020d68b1a73.exe	cmd.exe
PID 2164 wrote to memory of 2460	2164	682572888b60da06809d5f5dbce53b9a1bfede2d7a2deae9039e3020d68b1a73.exe	exljvofk.exe
PID 2164 wrote to memory of 2460	2164	682572888b60da06809d5f5dbce53b9a1bfede2d7a2deae9039e3020d68b1a73.exe	exljvofk.exe
PID 2164 wrote to memory of 2460	2164	682572888b60da06809d5f5dbce53b9a1bfede2d7a2deae9039e3020d68b1a73.exe	exljvofk.exe
PID 2164 wrote to memory of 2460	2164	682572888b60da06809d5f5dbce53b9a1bfede2d7a2deae9039e3020d68b1a73.exe	exljvofk.exe

C:\Users\Admin\AppData\Local\Temp\682572888b60da06809d5f5dbce53b9a1bfede2d7a2deae9039e3020d68b1a73.exe
"C:\Users\Admin\AppData\Local\Temp\682572888b60da06809d5f5dbce53b9a1bfede2d7a2deae9039e3020d68b1a73.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\NewBitmapImage.bmp
  2⤵
  PID:2724
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\exljvofk.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\exljvofk.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2460

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Suspicious use of FindShellTrayWindow
PID:2388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\exljvofk.exe

Filesize
465KB

MD5
ae6e96376af9418752b9c2c9e9e1debf

SHA1
bbb067145926697c07e80a0308106112b1189039

SHA256
682572888b60da06809d5f5dbce53b9a1bfede2d7a2deae9039e3020d68b1a73

SHA512
4164d0c607636d6ba462d9556c7841cb77131e693c6a0af15cb062222052e099bfcc44f941f9fd5f1e19f585ca9b85d2e4f25b994f2b1415deb48782d64971b7

Download Submit
memory/2388-63-0x00000000001B0000-0x00000000001B2000-memory.dmp

Filesize
8KB

Download
memory/2724-62-0x0000000000330000-0x0000000000332000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads