gootkit | 4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f

General

Target

4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe
Size

254KB
MD5

dcb6c44e6a850f0e4444a3bd8e4249c5
SHA1

0c54b4afe4c6670bec75a4fa8230015bda4f159a
SHA256

4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f
SHA512

b6e4dfc3205c867c5dfbbfb9a8f5a95bbb28b243f1351c1658aab3357005915938e5f62a70d5f8273f5b9a62f0216ea0e35b9a5dc68a6b03cbdf53882960bdb7

Score

10^/10

gootkit 777 banker botnet trojan

Malware Config

Extracted

Family

gootkit

Botnet

777

C2

madregobilsg.com

kerymarynicegross.com

pillygreamstronh.com

charnchiumbong.com

kiwimujirahdron.com

Attributes

vendor_id
777

Signatures

Gootkit
Gootkit is a banking trojan, where large parts are written in node.JS.
trojan banker botnet gootkit

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe

Modifies Internet Explorer Protected Mode 1 TTPs 5 IoCs

Modify Registry

T1112

Processes:

4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\2500 = "3"	4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3"	4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3"	4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3"	4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3"	4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe

pid	process
3112	4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe
3112	4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe
3112	4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe
3112	4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe
3112	4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe
3112	4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe
3112	4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe
3112	4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe
3112	4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe
3112	4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe
3112	4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe
3112	4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe
3112	4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe
3112	4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe
3112	4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe
3112	4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe
3112	4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe
3112	4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe
3112	4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe
3112	4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe
3112	4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe
3112	4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe
3112	4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe
3112	4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe
3112	4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe
3112	4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe
3112	4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe
3112	4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe
3112	4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe
3112	4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe
3112	4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe
3112	4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe
3112	4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe
3112	4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe
3112	4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe
3112	4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe
3112	4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe
3112	4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe
3112	4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe
3112	4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe
3112	4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe
3112	4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe
3112	4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe
3112	4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe
3112	4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe
3112	4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe
3112	4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe
3112	4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe
3112	4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe
3112	4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe
3112	4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe
3112	4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe
3112	4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe
3112	4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe
3112	4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe
3112	4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe
3112	4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe
3112	4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe
3112	4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe
3112	4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe
3112	4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe
3112	4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe
3112	4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe
3112	4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe

description	pid	process	target process
PID 3112 wrote to memory of 3320	3112	4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe	4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe
PID 3112 wrote to memory of 3320	3112	4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe	4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe
PID 3112 wrote to memory of 3320	3112	4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe	4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe

C:\Users\Admin\AppData\Local\Temp\4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe
"C:\Users\Admin\AppData\Local\Temp\4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe"
1⤵
- Checks BIOS information in registry
- Modifies Internet Explorer Protected Mode
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3112
- C:\Users\Admin\AppData\Local\Temp\4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe
  C:\Users\Admin\AppData\Local\Temp\4b507c772a51849ca0959c05bdd8733d41adaa55fb13d2c7e0419ad1f5418f3f.exe --vwxyz
  2⤵
  - Checks BIOS information in registry
  PID:3320

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3112-131-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3112-133-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3320-130-0x0000000000000000-mapping.dmp

Download
memory/3320-132-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads