gootkit | 704ae96ace7072fa4cff2ad775286ec2654c4b07b31a1e5767e06847e75f45b2

General

Target

704ae96ace7072fa4cff2ad775286ec2654c4b07b31a1e5767e06847e75f45b2.exe
Size

191KB
MD5

3c413d0ce7376823e40a0a2d6360ec36
SHA1

1a58304f05fcd4cd42758978fac8999db13ef862
SHA256

704ae96ace7072fa4cff2ad775286ec2654c4b07b31a1e5767e06847e75f45b2
SHA512

d9b079895e47e4ec49013e1b54d2013418b04247c0a2ab465af374f8ffa21c50a3f4235c75d61777db56de4da0409109e030de6ebc8144558fccd8dff2ba5510

Score

10^/10

gootkit 2860 banker botnet trojan

Malware Config

Extracted

Family

gootkit

Botnet

2860

C2

adp.reevesandcompany.com

picturecrafting.site

Attributes

vendor_id
2860

Signatures

Gootkit
Gootkit is a banking trojan, where large parts are written in node.JS.
trojan banker botnet gootkit

Modifies Internet Explorer Protected Mode 1 TTPs 5 IoCs

Modify Registry

T1112

Processes:

704ae96ace7072fa4cff2ad775286ec2654c4b07b31a1e5767e06847e75f45b2.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3"	704ae96ace7072fa4cff2ad775286ec2654c4b07b31a1e5767e06847e75f45b2.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\2500 = "3"	704ae96ace7072fa4cff2ad775286ec2654c4b07b31a1e5767e06847e75f45b2.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3"	704ae96ace7072fa4cff2ad775286ec2654c4b07b31a1e5767e06847e75f45b2.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3"	704ae96ace7072fa4cff2ad775286ec2654c4b07b31a1e5767e06847e75f45b2.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3"	704ae96ace7072fa4cff2ad775286ec2654c4b07b31a1e5767e06847e75f45b2.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

704ae96ace7072fa4cff2ad775286ec2654c4b07b31a1e5767e06847e75f45b2.exe

pid	process
4532	704ae96ace7072fa4cff2ad775286ec2654c4b07b31a1e5767e06847e75f45b2.exe
4532	704ae96ace7072fa4cff2ad775286ec2654c4b07b31a1e5767e06847e75f45b2.exe
4532	704ae96ace7072fa4cff2ad775286ec2654c4b07b31a1e5767e06847e75f45b2.exe
4532	704ae96ace7072fa4cff2ad775286ec2654c4b07b31a1e5767e06847e75f45b2.exe
4532	704ae96ace7072fa4cff2ad775286ec2654c4b07b31a1e5767e06847e75f45b2.exe
4532	704ae96ace7072fa4cff2ad775286ec2654c4b07b31a1e5767e06847e75f45b2.exe
4532	704ae96ace7072fa4cff2ad775286ec2654c4b07b31a1e5767e06847e75f45b2.exe
4532	704ae96ace7072fa4cff2ad775286ec2654c4b07b31a1e5767e06847e75f45b2.exe
4532	704ae96ace7072fa4cff2ad775286ec2654c4b07b31a1e5767e06847e75f45b2.exe
4532	704ae96ace7072fa4cff2ad775286ec2654c4b07b31a1e5767e06847e75f45b2.exe
4532	704ae96ace7072fa4cff2ad775286ec2654c4b07b31a1e5767e06847e75f45b2.exe
4532	704ae96ace7072fa4cff2ad775286ec2654c4b07b31a1e5767e06847e75f45b2.exe
4532	704ae96ace7072fa4cff2ad775286ec2654c4b07b31a1e5767e06847e75f45b2.exe
4532	704ae96ace7072fa4cff2ad775286ec2654c4b07b31a1e5767e06847e75f45b2.exe
4532	704ae96ace7072fa4cff2ad775286ec2654c4b07b31a1e5767e06847e75f45b2.exe
4532	704ae96ace7072fa4cff2ad775286ec2654c4b07b31a1e5767e06847e75f45b2.exe
4532	704ae96ace7072fa4cff2ad775286ec2654c4b07b31a1e5767e06847e75f45b2.exe
4532	704ae96ace7072fa4cff2ad775286ec2654c4b07b31a1e5767e06847e75f45b2.exe
4532	704ae96ace7072fa4cff2ad775286ec2654c4b07b31a1e5767e06847e75f45b2.exe
4532	704ae96ace7072fa4cff2ad775286ec2654c4b07b31a1e5767e06847e75f45b2.exe
4532	704ae96ace7072fa4cff2ad775286ec2654c4b07b31a1e5767e06847e75f45b2.exe
4532	704ae96ace7072fa4cff2ad775286ec2654c4b07b31a1e5767e06847e75f45b2.exe
4532	704ae96ace7072fa4cff2ad775286ec2654c4b07b31a1e5767e06847e75f45b2.exe
4532	704ae96ace7072fa4cff2ad775286ec2654c4b07b31a1e5767e06847e75f45b2.exe
4532	704ae96ace7072fa4cff2ad775286ec2654c4b07b31a1e5767e06847e75f45b2.exe
4532	704ae96ace7072fa4cff2ad775286ec2654c4b07b31a1e5767e06847e75f45b2.exe
4532	704ae96ace7072fa4cff2ad775286ec2654c4b07b31a1e5767e06847e75f45b2.exe
4532	704ae96ace7072fa4cff2ad775286ec2654c4b07b31a1e5767e06847e75f45b2.exe
4532	704ae96ace7072fa4cff2ad775286ec2654c4b07b31a1e5767e06847e75f45b2.exe
4532	704ae96ace7072fa4cff2ad775286ec2654c4b07b31a1e5767e06847e75f45b2.exe
4532	704ae96ace7072fa4cff2ad775286ec2654c4b07b31a1e5767e06847e75f45b2.exe
4532	704ae96ace7072fa4cff2ad775286ec2654c4b07b31a1e5767e06847e75f45b2.exe
4532	704ae96ace7072fa4cff2ad775286ec2654c4b07b31a1e5767e06847e75f45b2.exe
4532	704ae96ace7072fa4cff2ad775286ec2654c4b07b31a1e5767e06847e75f45b2.exe
4532	704ae96ace7072fa4cff2ad775286ec2654c4b07b31a1e5767e06847e75f45b2.exe
4532	704ae96ace7072fa4cff2ad775286ec2654c4b07b31a1e5767e06847e75f45b2.exe
4532	704ae96ace7072fa4cff2ad775286ec2654c4b07b31a1e5767e06847e75f45b2.exe
4532	704ae96ace7072fa4cff2ad775286ec2654c4b07b31a1e5767e06847e75f45b2.exe
4532	704ae96ace7072fa4cff2ad775286ec2654c4b07b31a1e5767e06847e75f45b2.exe
4532	704ae96ace7072fa4cff2ad775286ec2654c4b07b31a1e5767e06847e75f45b2.exe
4532	704ae96ace7072fa4cff2ad775286ec2654c4b07b31a1e5767e06847e75f45b2.exe
4532	704ae96ace7072fa4cff2ad775286ec2654c4b07b31a1e5767e06847e75f45b2.exe
4532	704ae96ace7072fa4cff2ad775286ec2654c4b07b31a1e5767e06847e75f45b2.exe
4532	704ae96ace7072fa4cff2ad775286ec2654c4b07b31a1e5767e06847e75f45b2.exe
4532	704ae96ace7072fa4cff2ad775286ec2654c4b07b31a1e5767e06847e75f45b2.exe
4532	704ae96ace7072fa4cff2ad775286ec2654c4b07b31a1e5767e06847e75f45b2.exe
4532	704ae96ace7072fa4cff2ad775286ec2654c4b07b31a1e5767e06847e75f45b2.exe
4532	704ae96ace7072fa4cff2ad775286ec2654c4b07b31a1e5767e06847e75f45b2.exe
4532	704ae96ace7072fa4cff2ad775286ec2654c4b07b31a1e5767e06847e75f45b2.exe
4532	704ae96ace7072fa4cff2ad775286ec2654c4b07b31a1e5767e06847e75f45b2.exe
4532	704ae96ace7072fa4cff2ad775286ec2654c4b07b31a1e5767e06847e75f45b2.exe
4532	704ae96ace7072fa4cff2ad775286ec2654c4b07b31a1e5767e06847e75f45b2.exe
4532	704ae96ace7072fa4cff2ad775286ec2654c4b07b31a1e5767e06847e75f45b2.exe
4532	704ae96ace7072fa4cff2ad775286ec2654c4b07b31a1e5767e06847e75f45b2.exe
4532	704ae96ace7072fa4cff2ad775286ec2654c4b07b31a1e5767e06847e75f45b2.exe
4532	704ae96ace7072fa4cff2ad775286ec2654c4b07b31a1e5767e06847e75f45b2.exe
4532	704ae96ace7072fa4cff2ad775286ec2654c4b07b31a1e5767e06847e75f45b2.exe
4532	704ae96ace7072fa4cff2ad775286ec2654c4b07b31a1e5767e06847e75f45b2.exe
4532	704ae96ace7072fa4cff2ad775286ec2654c4b07b31a1e5767e06847e75f45b2.exe
4532	704ae96ace7072fa4cff2ad775286ec2654c4b07b31a1e5767e06847e75f45b2.exe
4532	704ae96ace7072fa4cff2ad775286ec2654c4b07b31a1e5767e06847e75f45b2.exe
4532	704ae96ace7072fa4cff2ad775286ec2654c4b07b31a1e5767e06847e75f45b2.exe
4532	704ae96ace7072fa4cff2ad775286ec2654c4b07b31a1e5767e06847e75f45b2.exe
4532	704ae96ace7072fa4cff2ad775286ec2654c4b07b31a1e5767e06847e75f45b2.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

704ae96ace7072fa4cff2ad775286ec2654c4b07b31a1e5767e06847e75f45b2.exe

description	pid	process	target process
PID 4532 wrote to memory of 1544	4532	704ae96ace7072fa4cff2ad775286ec2654c4b07b31a1e5767e06847e75f45b2.exe	704ae96ace7072fa4cff2ad775286ec2654c4b07b31a1e5767e06847e75f45b2.exe
PID 4532 wrote to memory of 1544	4532	704ae96ace7072fa4cff2ad775286ec2654c4b07b31a1e5767e06847e75f45b2.exe	704ae96ace7072fa4cff2ad775286ec2654c4b07b31a1e5767e06847e75f45b2.exe
PID 4532 wrote to memory of 1544	4532	704ae96ace7072fa4cff2ad775286ec2654c4b07b31a1e5767e06847e75f45b2.exe	704ae96ace7072fa4cff2ad775286ec2654c4b07b31a1e5767e06847e75f45b2.exe

C:\Users\Admin\AppData\Local\Temp\704ae96ace7072fa4cff2ad775286ec2654c4b07b31a1e5767e06847e75f45b2.exe
"C:\Users\Admin\AppData\Local\Temp\704ae96ace7072fa4cff2ad775286ec2654c4b07b31a1e5767e06847e75f45b2.exe"
1⤵
- Modifies Internet Explorer Protected Mode
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4532
- C:\Users\Admin\AppData\Local\Temp\704ae96ace7072fa4cff2ad775286ec2654c4b07b31a1e5767e06847e75f45b2.exe
  C:\Users\Admin\AppData\Local\Temp\704ae96ace7072fa4cff2ad775286ec2654c4b07b31a1e5767e06847e75f45b2.exe --vwxyz
  2⤵
  PID:1544

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1544-133-0x0000000000000000-mapping.dmp

Download
memory/4532-131-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4532-132-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads