Analysis

  • max time kernel
    150s
  • max time network
    44s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    26-06-2022 22:26

General

  • Target

    35fd40cd3529e9b39b363bba62990949468f3a97ebb7e30e0f7629a64ae3c1d3.exe

  • Size

    256KB

  • MD5

    402f659fc27cbed15d8fcd00249d3086

  • SHA1

    d3e66de050ffe9dec31ddeabaa3926e98924aa52

  • SHA256

    35fd40cd3529e9b39b363bba62990949468f3a97ebb7e30e0f7629a64ae3c1d3

  • SHA512

    ebded44e7c611b633f17d2084e7e40fab90baf2591df48b58f73e8f2e69bd5c2854a7a71c38493334ba7819238de9c9aca43d65843de16f421c5af8e6a683d2a

Malware Config

Extracted

Family

gootkit

Botnet

777

C2

madregobilsg.com

kerymarynicegross.com

pillygreamstronh.com

charnchiumbong.com

kiwimujirahdron.com

Attributes
  • vendor_id

    777

Signatures

  • Gootkit

    Gootkit is a banking trojan, where large parts are written in node.JS.

  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer Protected Mode 1 TTPs 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\35fd40cd3529e9b39b363bba62990949468f3a97ebb7e30e0f7629a64ae3c1d3.exe
    "C:\Users\Admin\AppData\Local\Temp\35fd40cd3529e9b39b363bba62990949468f3a97ebb7e30e0f7629a64ae3c1d3.exe"
    1⤵
    • Checks BIOS information in registry
    • Modifies Internet Explorer Protected Mode
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1520
    • C:\Users\Admin\AppData\Local\Temp\35fd40cd3529e9b39b363bba62990949468f3a97ebb7e30e0f7629a64ae3c1d3.exe
      C:\Users\Admin\AppData\Local\Temp\35fd40cd3529e9b39b363bba62990949468f3a97ebb7e30e0f7629a64ae3c1d3.exe --vwxyz
      2⤵
      • Checks BIOS information in registry
      PID:920

Network

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/920-55-0x0000000000000000-mapping.dmp
  • memory/920-58-0x0000000000400000-0x0000000000442000-memory.dmp
    Filesize

    264KB

  • memory/1520-54-0x0000000076451000-0x0000000076453000-memory.dmp
    Filesize

    8KB

  • memory/1520-57-0x0000000000400000-0x0000000000442000-memory.dmp
    Filesize

    264KB

  • memory/1520-59-0x0000000000400000-0x0000000000442000-memory.dmp
    Filesize

    264KB