Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    04-02-2021 16:42

General

  • Target

    05a1103b03aec2005386119fd29cedf8.exe

  • Size

    250KB

  • MD5

    05a1103b03aec2005386119fd29cedf8

  • SHA1

    455e579b34f9607d21b6195644b756ffb09a53a6

  • SHA256

    141b78ce7b21a31bffc8a05311d96b8347aca36a69fa4768f8a32fae2ce12b8b

  • SHA512

    22f88654f41414367e23d14eefe7f3caa88ae432216f85d9d4d3a82fce1c428917bfe60c12d15268d72347c6ce1887a3263bb28416c04c255d270531bd0ef711

Malware Config

Extracted

Family

gootkit

Botnet

777

C2

madregobilsg.com

kerymarynicegross.com

pillygreamstronh.com

charnchiumbong.com

kiwimujirahdron.com

Attributes
  • vendor_id

    777

Signatures

  • Gootkit

    Gootkit is a banking trojan, where large parts are written in node.JS.

  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer Protected Mode 1 TTPs 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 6428 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\05a1103b03aec2005386119fd29cedf8.exe
    "C:\Users\Admin\AppData\Local\Temp\05a1103b03aec2005386119fd29cedf8.exe"
    1⤵
    • Checks BIOS information in registry
    • Modifies Internet Explorer Protected Mode
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4772
    • C:\Users\Admin\AppData\Local\Temp\05a1103b03aec2005386119fd29cedf8.exe
      C:\Users\Admin\AppData\Local\Temp\05a1103b03aec2005386119fd29cedf8.exe --vwxyz
      2⤵
      • Checks BIOS information in registry
      PID:1868

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1868-6-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/4772-4-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/4772-3-0x0000000000570000-0x0000000000572000-memory.dmp

    Filesize

    8KB