gootkit | 087b9f549d23316dc43dd3f6b2280fdfde113bc457b785066f8657115a7ef555

General

Target

087b9f549d23316dc43dd3f6b2280fdfde113bc457b785066f8657115a7ef555.exe
Size

264KB
MD5

af0b810ee30058e5cea264fed2a15f05
SHA1

7aae8004f0042d3c4d250ace81053dbc3e31fecf
SHA256

087b9f549d23316dc43dd3f6b2280fdfde113bc457b785066f8657115a7ef555
SHA512

56b7da6973995c0e007ce78f62c5a45db54f8448ff7f0af6fcebe1a5f63c5d30b6864b7d0ae5c940f0db1d12c7363d87037a2b166caf51bc9b32175a95072710

Score

10^/10

gootkit 410 banker botnet trojan

Malware Config

Extracted

Family

gootkit

Botnet

410

C2

parking.dynophyl.com

parked.dynonortheast.com

trktrk.eu

smeinsurances.co.uk

Attributes

vendor_id
410

Signatures

Gootkit
Gootkit is a banking trojan, where large parts are written in node.JS.
trojan banker botnet gootkit

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

087b9f549d23316dc43dd3f6b2280fdfde113bc457b785066f8657115a7ef555.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	087b9f549d23316dc43dd3f6b2280fdfde113bc457b785066f8657115a7ef555.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

mstsc.exe

pid	process
2640	mstsc.exe
2640	mstsc.exe
2640	mstsc.exe
2640	mstsc.exe
2640	mstsc.exe
2640	mstsc.exe
2640	mstsc.exe
2640	mstsc.exe
2640	mstsc.exe
2640	mstsc.exe
2640	mstsc.exe
2640	mstsc.exe
2640	mstsc.exe
2640	mstsc.exe
2640	mstsc.exe
2640	mstsc.exe
2640	mstsc.exe
2640	mstsc.exe
2640	mstsc.exe
2640	mstsc.exe
2640	mstsc.exe
2640	mstsc.exe
2640	mstsc.exe
2640	mstsc.exe
2640	mstsc.exe
2640	mstsc.exe
2640	mstsc.exe
2640	mstsc.exe
2640	mstsc.exe
2640	mstsc.exe
2640	mstsc.exe
2640	mstsc.exe
2640	mstsc.exe
2640	mstsc.exe
2640	mstsc.exe
2640	mstsc.exe
2640	mstsc.exe
2640	mstsc.exe
2640	mstsc.exe
2640	mstsc.exe
2640	mstsc.exe
2640	mstsc.exe
2640	mstsc.exe
2640	mstsc.exe
2640	mstsc.exe
2640	mstsc.exe
2640	mstsc.exe
2640	mstsc.exe
2640	mstsc.exe
2640	mstsc.exe
2640	mstsc.exe
2640	mstsc.exe
2640	mstsc.exe
2640	mstsc.exe
2640	mstsc.exe
2640	mstsc.exe
2640	mstsc.exe
2640	mstsc.exe
2640	mstsc.exe
2640	mstsc.exe
2640	mstsc.exe
2640	mstsc.exe
2640	mstsc.exe
2640	mstsc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

087b9f549d23316dc43dd3f6b2280fdfde113bc457b785066f8657115a7ef555.exe

pid process

3716 087b9f549d23316dc43dd3f6b2280fdfde113bc457b785066f8657115a7ef555.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

087b9f549d23316dc43dd3f6b2280fdfde113bc457b785066f8657115a7ef555.exe

pid process

3716 087b9f549d23316dc43dd3f6b2280fdfde113bc457b785066f8657115a7ef555.exe

pid	process
3716	087b9f549d23316dc43dd3f6b2280fdfde113bc457b785066f8657115a7ef555.exe

pid	process
3716	087b9f549d23316dc43dd3f6b2280fdfde113bc457b785066f8657115a7ef555.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

087b9f549d23316dc43dd3f6b2280fdfde113bc457b785066f8657115a7ef555.exemstsc.execmd.exe

description	pid	process	target process
PID 3716 wrote to memory of 2640	3716	087b9f549d23316dc43dd3f6b2280fdfde113bc457b785066f8657115a7ef555.exe	mstsc.exe
PID 3716 wrote to memory of 2640	3716	087b9f549d23316dc43dd3f6b2280fdfde113bc457b785066f8657115a7ef555.exe	mstsc.exe
PID 3716 wrote to memory of 2640	3716	087b9f549d23316dc43dd3f6b2280fdfde113bc457b785066f8657115a7ef555.exe	mstsc.exe
PID 3716 wrote to memory of 2640	3716	087b9f549d23316dc43dd3f6b2280fdfde113bc457b785066f8657115a7ef555.exe	mstsc.exe
PID 3716 wrote to memory of 2640	3716	087b9f549d23316dc43dd3f6b2280fdfde113bc457b785066f8657115a7ef555.exe	mstsc.exe
PID 3716 wrote to memory of 2640	3716	087b9f549d23316dc43dd3f6b2280fdfde113bc457b785066f8657115a7ef555.exe	mstsc.exe
PID 3716 wrote to memory of 2640	3716	087b9f549d23316dc43dd3f6b2280fdfde113bc457b785066f8657115a7ef555.exe	mstsc.exe
PID 3716 wrote to memory of 2640	3716	087b9f549d23316dc43dd3f6b2280fdfde113bc457b785066f8657115a7ef555.exe	mstsc.exe
PID 2640 wrote to memory of 2824	2640	mstsc.exe	cmd.exe
PID 2640 wrote to memory of 2824	2640	mstsc.exe	cmd.exe
PID 2640 wrote to memory of 2824	2640	mstsc.exe	cmd.exe
PID 2824 wrote to memory of 4300	2824	cmd.exe	attrib.exe
PID 2824 wrote to memory of 4300	2824	cmd.exe	attrib.exe
PID 2824 wrote to memory of 4300	2824	cmd.exe	attrib.exe

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exe

pid process

4300 attrib.exe

pid	process
4300	attrib.exe

C:\Users\Admin\AppData\Local\Temp\087b9f549d23316dc43dd3f6b2280fdfde113bc457b785066f8657115a7ef555.exe
"C:\Users\Admin\AppData\Local\Temp\087b9f549d23316dc43dd3f6b2280fdfde113bc457b785066f8657115a7ef555.exe"
1⤵
- Checks BIOS information in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3716
- C:\Windows\SysWOW64\mstsc.exe
  C:\Windows\System32\mstsc.exe "C:\Users\Admin\AppData\Local\Temp\087b9f549d23316dc43dd3f6b2280fdfde113bc457b785066f8657115a7ef555.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2640
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\240584515.bat" "C:\Users\Admin\AppData\Local\Temp\087b9f549d23316dc43dd3f6b2280fdfde113bc457b785066f8657115a7ef555.exe""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2824
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -r -s -h "C:\Users\Admin\AppData\Local\Temp\087b9f549d23316dc43dd3f6b2280fdfde113bc457b785066f8657115a7ef555.exe"
      4⤵
      Views/modifies file attributes
      PID:4300

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Privilege Escalation

Defense Evasion

Hidden Files and Directories

1

T1158

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\240584515.bat

Filesize
76B

MD5
a0b56dbfec40bc9e00e413253c74041c

SHA1
0495a408fa21c4002a858bece5ede1bc78a1c6fd

SHA256
c5f526e250b512ac9415ac62599c08dfc9a27e2e44d5dd309b08948b1653c81a

SHA512
f6d75d4474456fa9755b6516c638e617b4edb75afaf86e7b5a107967426daa2e4736dbac9600e3c31a27b6294b8bb0149fcac862091130f4ef749d708c30e647

Download Submit
memory/2640-130-0x0000000000000000-mapping.dmp

Download
memory/2640-132-0x0000000000350000-0x0000000000370000-memory.dmp

Filesize
128KB

Download
memory/2824-133-0x0000000000000000-mapping.dmp

Download
memory/3716-131-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4300-135-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads