gootkit | 0f1d79b7bebfb7bcfab9823392e986f982d869ba36928bd5f3d61af536ec5a00

Analysis

Target

0f1d79b7bebfb7bcfab9823392e986f982d869ba36928bd5f3d61af536ec5a00.exe
Size

104KB
MD5

8fe5df8c2a121a573062e4eb8ea1e3e2
SHA1

e26e99a7ccd69a198419c785a5d394c94d19ef73
SHA256

0f1d79b7bebfb7bcfab9823392e986f982d869ba36928bd5f3d61af536ec5a00
SHA512

ed65560375b4a030686cccfddb48a1693b48601a733db00fa0b7104300b7eb7c3fb1872a8b2a314cb98fd42642fb0a112d838531d0917e1c27865a0216f0f222

Score

10^/10

Family

gootkit

Botnet

1001

pell-talak.com

gudsline.com

Attributes

Gootkit
Gootkit is a banking trojan, where large parts are written in node.JS.
trojan banker botnet gootkit
suricata: ET MALWARE ABUSE.CH SSL Fingerprint Blacklist Malicious SSL Certificate Detected (Gootkit C2)
suricata: ET MALWARE ABUSE.CH SSL Fingerprint Blacklist Malicious SSL Certificate Detected (Gootkit C2)
suricata

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

0f1d79b7bebfb7bcfab9823392e986f982d869ba36928bd5f3d61af536ec5a00.exe

description	pid	process	target process
PID 4108 wrote to memory of 1516	4108	0f1d79b7bebfb7bcfab9823392e986f982d869ba36928bd5f3d61af536ec5a00.exe	0f1d79b7bebfb7bcfab9823392e986f982d869ba36928bd5f3d61af536ec5a00.exe
PID 4108 wrote to memory of 1516	4108	0f1d79b7bebfb7bcfab9823392e986f982d869ba36928bd5f3d61af536ec5a00.exe	0f1d79b7bebfb7bcfab9823392e986f982d869ba36928bd5f3d61af536ec5a00.exe
PID 4108 wrote to memory of 1516	4108	0f1d79b7bebfb7bcfab9823392e986f982d869ba36928bd5f3d61af536ec5a00.exe	0f1d79b7bebfb7bcfab9823392e986f982d869ba36928bd5f3d61af536ec5a00.exe

C:\Users\Admin\AppData\Local\Temp\0f1d79b7bebfb7bcfab9823392e986f982d869ba36928bd5f3d61af536ec5a00.exe
"C:\Users\Admin\AppData\Local\Temp\0f1d79b7bebfb7bcfab9823392e986f982d869ba36928bd5f3d61af536ec5a00.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4108

C:\Users\Admin\AppData\Local\Temp\0f1d79b7bebfb7bcfab9823392e986f982d869ba36928bd5f3d61af536ec5a00.exe
"C:\Users\Admin\AppData\Local\Temp\0f1d79b7bebfb7bcfab9823392e986f982d869ba36928bd5f3d61af536ec5a00.exe" kdwuscdnctzartmutioa
2⤵
PID:1516

memory/1516-133-0x0000000000000000-mapping.dmp

Download
memory/1516-134-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1516-135-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1516-136-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1516-137-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/4108-130-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/4108-131-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/4108-132-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download