Overview

overview

10

Static

static

05a1103b03...f8.exe

windows7_x64

10

05a1103b03...f8.exe

windows10_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    13s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    04-02-2021 16:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    05a1103b03aec2005386119fd29cedf8.exe

  • Size

    250KB

  • MD5

    05a1103b03aec2005386119fd29cedf8

  • SHA1

    455e579b34f9607d21b6195644b756ffb09a53a6

  • SHA256

    141b78ce7b21a31bffc8a05311d96b8347aca36a69fa4768f8a32fae2ce12b8b

  • SHA512

    22f88654f41414367e23d14eefe7f3caa88ae432216f85d9d4d3a82fce1c428917bfe60c12d15268d72347c6ce1887a3263bb28416c04c255d270531bd0ef711

Score
10/10
gootkit777bankerbotnettrojan

Malware Config

Extracted

Family

gootkit

Botnet

777

C2

madregobilsg.com

kerymarynicegross.com

pillygreamstronh.com

charnchiumbong.com

kiwimujirahdron.com
Attributes
  • vendor_id

    777

Signatures

  • Gootkit

    Gootkit is a banking trojan, where large parts are written in node.JS.

    trojanbankerbotnetgootkit
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer Protected Mode 1 TTPs 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 2394 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\05a1103b03aec2005386119fd29cedf8.exe
    "C:\Users\Admin\AppData\Local\Temp\05a1103b03aec2005386119fd29cedf8.exe"
    1⤵
    • Checks BIOS information in registry
    • Modifies Internet Explorer Protected Mode
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:324
    • C:\Users\Admin\AppData\Local\Temp\05a1103b03aec2005386119fd29cedf8.exe
      C:\Users\Admin\AppData\Local\Temp\05a1103b03aec2005386119fd29cedf8.exe --vwxyz
      2⤵
      • Checks BIOS information in registry
      PID:2020

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/324-2-0x00000000766C1000-0x00000000766C3000-memory.dmp
    Filesize

    8KB

    Download
  • memory/324-6-0x0000000000400000-0x000000000042A000-memory.dmp
    Filesize

    168KB

    Download
  • memory/324-5-0x00000000003B0000-0x00000000003B2000-memory.dmp
    Filesize

    8KB

    Download
  • memory/1688-9-0x000007FEF6A60000-0x000007FEF6CDA000-memory.dmp
    Filesize

    2.5MB

    Download
  • memory/2020-3-0x0000000000000000-mapping.dmp
    Download
  • memory/2020-8-0x0000000000400000-0x000000000042A000-memory.dmp
    Filesize

    168KB

    Download