gootkit | d5ba0f1c01cf12f57cca93996d2f87191c9420afbbd116d3757060d780338d29

General

Target

d5ba0f1c01cf12f57cca93996d2f87191c9420afbbd116d3757060d780338d29.exe
Size

285KB
MD5

c25b6469a89826074b513d45b76c4c6a
SHA1

cd13f2ee1af78f3f48edb595fc90358415e5ebe1
SHA256

d5ba0f1c01cf12f57cca93996d2f87191c9420afbbd116d3757060d780338d29
SHA512

a9314292c946ad2c63165f241ab4bc3dbb5626b14b7fb5d6606dbf8d789040a50e7eb5777721568fbc32bed4d0a4e815dd423096a92026c319d4d96dcc3fc5f7

Score

10^/10

gootkit 6546 banker botnet trojan

Malware Config

Extracted

Family

gootkit

Botnet

6546

C2

servicemanager.icu

partnerservice.xyz

Attributes

vendor_id
6546

Signatures

Gootkit
Gootkit is a banking trojan, where large parts are written in node.JS.
trojan banker botnet gootkit

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

d5ba0f1c01cf12f57cca93996d2f87191c9420afbbd116d3757060d780338d29.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	d5ba0f1c01cf12f57cca93996d2f87191c9420afbbd116d3757060d780338d29.exe

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

268 cmd.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
268	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

d5ba0f1c01cf12f57cca93996d2f87191c9420afbbd116d3757060d780338d29.execmd.exe

description	pid	process	target process
PID 944 wrote to memory of 268	944	d5ba0f1c01cf12f57cca93996d2f87191c9420afbbd116d3757060d780338d29.exe	cmd.exe
PID 944 wrote to memory of 268	944	d5ba0f1c01cf12f57cca93996d2f87191c9420afbbd116d3757060d780338d29.exe	cmd.exe
PID 944 wrote to memory of 268	944	d5ba0f1c01cf12f57cca93996d2f87191c9420afbbd116d3757060d780338d29.exe	cmd.exe
PID 944 wrote to memory of 268	944	d5ba0f1c01cf12f57cca93996d2f87191c9420afbbd116d3757060d780338d29.exe	cmd.exe
PID 268 wrote to memory of 1548	268	cmd.exe	attrib.exe
PID 268 wrote to memory of 1548	268	cmd.exe	attrib.exe
PID 268 wrote to memory of 1548	268	cmd.exe	attrib.exe
PID 268 wrote to memory of 1548	268	cmd.exe	attrib.exe

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exe

pid process

1548 attrib.exe

pid	process
1548	attrib.exe

C:\Users\Admin\AppData\Local\Temp\d5ba0f1c01cf12f57cca93996d2f87191c9420afbbd116d3757060d780338d29.exe
"C:\Users\Admin\AppData\Local\Temp\d5ba0f1c01cf12f57cca93996d2f87191c9420afbbd116d3757060d780338d29.exe"
1⤵
- Checks BIOS information in registry
- Suspicious use of WriteProcessMemory
PID:944
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\259382628.bat" "C:\Users\Admin\AppData\Local\Temp\d5ba0f1c01cf12f57cca93996d2f87191c9420afbbd116d3757060d780338d29.exe""
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:268
- - C:\Windows\SysWOW64\attrib.exe
    attrib -r -s -h "C:\Users\Admin\AppData\Local\Temp\d5ba0f1c01cf12f57cca93996d2f87191c9420afbbd116d3757060d780338d29.exe"
    3⤵
    - Views/modifies file attributes
    PID:1548

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Privilege Escalation

Defense Evasion

Hidden Files and Directories

1

T1158

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\259382628.bat

MD5
514ba9826835207d76cc7c3851a8d4ca

SHA1
3107dd8afc05a7cf2e012c9a0ae2d8f9e7aa1216

SHA256
a1a174b87217e49b8a40eb3ce1155b21e01d65639c0affa62004dbec94d73f7c

SHA512
3b240d583bbe1306de8f120265abd6cedba7f141641b7d59b71a39914ba5d2b23d9d030587180b20ff53a9ea7498e010e714df5922147012112c87488e7d046b

Download Submit
memory/944-54-0x0000000076151000-0x0000000076153000-memory.dmp

Filesize
8KB

Download
memory/944-55-0x0000000000220000-0x0000000000223000-memory.dmp

Filesize
12KB

Download
memory/944-56-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download

Analysis

Sharing