gootkit | 0ca397cd9b4dd05d04216e1511fcfb820e91383d82f34dc003698f4fc3f11744

General

Target

0ca397cd9b4dd05d04216e1511fcfb820e91383d82f34dc003698f4fc3f11744.exe
Size

268KB
MD5

03f6ec5cca4b5d0eb52775125e770f07
SHA1

782a8fd49bbc5fe7ff3c28508561a400fc22732e
SHA256

0ca397cd9b4dd05d04216e1511fcfb820e91383d82f34dc003698f4fc3f11744
SHA512

21a6896b3f3f2451a29aa3216d0dbb12c00b7f79f02319beaf10d5226f669cbdc3f7623e17da65d82d5320703fb9c17f713793e250d124492491cd9b19815ef8

Score

10^/10

gootkit 410 banker botnet trojan

Malware Config

Extracted

Family

gootkit

Botnet

410

C2

parking.dynophyl.com

parked.dynonortheast.com

trktrk.eu

smeinsurances.co.uk

Attributes

vendor_id
410

Signatures

Gootkit
Gootkit is a banking trojan, where large parts are written in node.JS.
trojan banker botnet gootkit

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

0ca397cd9b4dd05d04216e1511fcfb820e91383d82f34dc003698f4fc3f11744.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	0ca397cd9b4dd05d04216e1511fcfb820e91383d82f34dc003698f4fc3f11744.exe

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

276 cmd.exe

pid	process
276	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

mstsc.exe

pid	process
1684	mstsc.exe
1684	mstsc.exe
1684	mstsc.exe
1684	mstsc.exe
1684	mstsc.exe
1684	mstsc.exe
1684	mstsc.exe
1684	mstsc.exe
1684	mstsc.exe
1684	mstsc.exe
1684	mstsc.exe
1684	mstsc.exe
1684	mstsc.exe
1684	mstsc.exe
1684	mstsc.exe
1684	mstsc.exe
1684	mstsc.exe
1684	mstsc.exe
1684	mstsc.exe
1684	mstsc.exe
1684	mstsc.exe
1684	mstsc.exe
1684	mstsc.exe
1684	mstsc.exe
1684	mstsc.exe
1684	mstsc.exe
1684	mstsc.exe
1684	mstsc.exe
1684	mstsc.exe
1684	mstsc.exe
1684	mstsc.exe
1684	mstsc.exe
1684	mstsc.exe
1684	mstsc.exe
1684	mstsc.exe
1684	mstsc.exe
1684	mstsc.exe
1684	mstsc.exe
1684	mstsc.exe
1684	mstsc.exe
1684	mstsc.exe
1684	mstsc.exe
1684	mstsc.exe
1684	mstsc.exe
1684	mstsc.exe
1684	mstsc.exe
1684	mstsc.exe
1684	mstsc.exe
1684	mstsc.exe
1684	mstsc.exe
1684	mstsc.exe
1684	mstsc.exe
1684	mstsc.exe
1684	mstsc.exe
1684	mstsc.exe
1684	mstsc.exe
1684	mstsc.exe
1684	mstsc.exe
1684	mstsc.exe
1684	mstsc.exe
1684	mstsc.exe
1684	mstsc.exe
1684	mstsc.exe
1684	mstsc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

0ca397cd9b4dd05d04216e1511fcfb820e91383d82f34dc003698f4fc3f11744.exe

pid process

1836 0ca397cd9b4dd05d04216e1511fcfb820e91383d82f34dc003698f4fc3f11744.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

0ca397cd9b4dd05d04216e1511fcfb820e91383d82f34dc003698f4fc3f11744.exe

pid process

1836 0ca397cd9b4dd05d04216e1511fcfb820e91383d82f34dc003698f4fc3f11744.exe

pid	process
1836	0ca397cd9b4dd05d04216e1511fcfb820e91383d82f34dc003698f4fc3f11744.exe

pid	process
1836	0ca397cd9b4dd05d04216e1511fcfb820e91383d82f34dc003698f4fc3f11744.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

0ca397cd9b4dd05d04216e1511fcfb820e91383d82f34dc003698f4fc3f11744.exemstsc.execmd.exe

description	pid	process	target process
PID 1836 wrote to memory of 1684	1836	0ca397cd9b4dd05d04216e1511fcfb820e91383d82f34dc003698f4fc3f11744.exe	mstsc.exe
PID 1836 wrote to memory of 1684	1836	0ca397cd9b4dd05d04216e1511fcfb820e91383d82f34dc003698f4fc3f11744.exe	mstsc.exe
PID 1836 wrote to memory of 1684	1836	0ca397cd9b4dd05d04216e1511fcfb820e91383d82f34dc003698f4fc3f11744.exe	mstsc.exe
PID 1836 wrote to memory of 1684	1836	0ca397cd9b4dd05d04216e1511fcfb820e91383d82f34dc003698f4fc3f11744.exe	mstsc.exe
PID 1836 wrote to memory of 1684	1836	0ca397cd9b4dd05d04216e1511fcfb820e91383d82f34dc003698f4fc3f11744.exe	mstsc.exe
PID 1836 wrote to memory of 1684	1836	0ca397cd9b4dd05d04216e1511fcfb820e91383d82f34dc003698f4fc3f11744.exe	mstsc.exe
PID 1836 wrote to memory of 1684	1836	0ca397cd9b4dd05d04216e1511fcfb820e91383d82f34dc003698f4fc3f11744.exe	mstsc.exe
PID 1836 wrote to memory of 1684	1836	0ca397cd9b4dd05d04216e1511fcfb820e91383d82f34dc003698f4fc3f11744.exe	mstsc.exe
PID 1836 wrote to memory of 1684	1836	0ca397cd9b4dd05d04216e1511fcfb820e91383d82f34dc003698f4fc3f11744.exe	mstsc.exe
PID 1684 wrote to memory of 276	1684	mstsc.exe	cmd.exe
PID 1684 wrote to memory of 276	1684	mstsc.exe	cmd.exe
PID 1684 wrote to memory of 276	1684	mstsc.exe	cmd.exe
PID 1684 wrote to memory of 276	1684	mstsc.exe	cmd.exe
PID 276 wrote to memory of 1088	276	cmd.exe	attrib.exe
PID 276 wrote to memory of 1088	276	cmd.exe	attrib.exe
PID 276 wrote to memory of 1088	276	cmd.exe	attrib.exe
PID 276 wrote to memory of 1088	276	cmd.exe	attrib.exe

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exe

pid process

1088 attrib.exe

pid	process
1088	attrib.exe

C:\Users\Admin\AppData\Local\Temp\0ca397cd9b4dd05d04216e1511fcfb820e91383d82f34dc003698f4fc3f11744.exe
"C:\Users\Admin\AppData\Local\Temp\0ca397cd9b4dd05d04216e1511fcfb820e91383d82f34dc003698f4fc3f11744.exe"
1⤵
- Checks BIOS information in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1836
- C:\Windows\SysWOW64\mstsc.exe
  C:\Windows\System32\mstsc.exe "C:\Users\Admin\AppData\Local\Temp\0ca397cd9b4dd05d04216e1511fcfb820e91383d82f34dc003698f4fc3f11744.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1684
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\7068888.bat" "C:\Users\Admin\AppData\Local\Temp\0ca397cd9b4dd05d04216e1511fcfb820e91383d82f34dc003698f4fc3f11744.exe""
    3⤵
    - Deletes itself
    - Suspicious use of WriteProcessMemory
    PID:276
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -r -s -h "C:\Users\Admin\AppData\Local\Temp\0ca397cd9b4dd05d04216e1511fcfb820e91383d82f34dc003698f4fc3f11744.exe"
      4⤵
      Views/modifies file attributes
      PID:1088

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Privilege Escalation

Defense Evasion

Hidden Files and Directories

1

T1158

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7068888.bat

Filesize
72B

MD5
23f946bb0307e2aa6413e2e5408142c9

SHA1
07883e1ef7048e542c316f7b7e10d3fe472fd845

SHA256
7324573fc38d6f074587bd6f50e3f6d4d4fa99b32eff3cefec7841ba38edbbcb

SHA512
5b4958fcc817347e476a716a3c79ed2a2b76538e64385ef527046196919f21dc5100e2c9a2eba548e7a21b8abe317bdc3a3ef91a5b5d40313080754b7a2e6986

Download Submit
memory/276-58-0x0000000000000000-mapping.dmp

Download
memory/1088-61-0x0000000000000000-mapping.dmp

Download
memory/1684-55-0x0000000000000000-mapping.dmp

Download
memory/1684-59-0x00000000000C0000-0x00000000000E0000-memory.dmp

Filesize
128KB

Download
memory/1836-54-0x0000000076421000-0x0000000076423000-memory.dmp

Filesize
8KB

Download
memory/1836-57-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads