Analysis
-
max time kernel
150s -
max time network
171s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
07-07-2022 23:18
General
-
Target
43509f678cd6d6f3ea2d6a8fb86ffbd7b7bca5ee8d4a14be763770769417de5d.exe
-
Size
97KB
-
MD5
3be315046348568a36b8976f64ce7297
-
SHA1
96f95f161f01926928dec5560a5a1c5094e4e6a2
-
SHA256
43509f678cd6d6f3ea2d6a8fb86ffbd7b7bca5ee8d4a14be763770769417de5d
-
SHA512
d5857f4aa8ddf34334de82f182065a1cb80fc0f17d75620a3677aa6225b3024cf1472fab23ac8f88b0096336dd0845bdfe36270c49ade99d124585a133b5f74a
Score
10/10
Malware Config
Extracted
Family
gootkit
Botnet
1001
C2
pell-talak.com
gudsline.com
Attributes
-
vendor_id
1001
Signatures
-
Gootkit
Gootkit is a banking trojan, where large parts are written in node.JS.
-
suricata: ET MALWARE ABUSE.CH SSL Fingerprint Blacklist Malicious SSL Certificate Detected (Gootkit C2)
suricata: ET MALWARE ABUSE.CH SSL Fingerprint Blacklist Malicious SSL Certificate Detected (Gootkit C2)
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\43509f678cd6d6f3ea2d6a8fb86ffbd7b7bca5ee8d4a14be763770769417de5d.exe"C:\Users\Admin\AppData\Local\Temp\43509f678cd6d6f3ea2d6a8fb86ffbd7b7bca5ee8d4a14be763770769417de5d.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\43509f678cd6d6f3ea2d6a8fb86ffbd7b7bca5ee8d4a14be763770769417de5d.exe"C:\Users\Admin\AppData\Local\Temp\43509f678cd6d6f3ea2d6a8fb86ffbd7b7bca5ee8d4a14be763770769417de5d.exe" kvencllhelxadkbswhth2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
-
Filesize
112KB
-
Filesize
112KB
-
Filesize
112KB
-
Filesize
52KB
-
Filesize
112KB
-
Filesize
112KB
-
Filesize
112KB