gootkit | aa2ebb9abf516d6a530683727d18aea01fab4698d908904fc8e622fec00a8aca

Analysis

max time kernel
55s
max time network
189s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
08-11-2022 05:23

Target

aa2ebb9abf516d6a530683727d18aea01fab4698d908904fc8e622fec00a8aca.exe
Size

97KB
MD5

0912d7f53812a0ab61e0c1001eb107f0
SHA1

a9f1039a88b5ccd210c9dbf227ea23bcb562993d
SHA256

aa2ebb9abf516d6a530683727d18aea01fab4698d908904fc8e622fec00a8aca
SHA512

aa21ee7607c8d928550ef9cd47638f65ecade923629d072fe91bd9a0a6e23853eb585d75917273ef7104e91f2da032db736764d3d1f09124e2bec92332049f7f
SSDEEP

3072:7W+EGGxgfhI/5KOEwvDRRVkT6KsRPKfXE:7NhyuhIBpRRVgsRP2

Score

10^/10

Family

gootkit

Botnet

1001

pell-talak.com

gudsline.com

Attributes

Gootkit
Gootkit is a banking trojan, where large parts are written in node.JS.
trojan banker botnet gootkit

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

aa2ebb9abf516d6a530683727d18aea01fab4698d908904fc8e622fec00a8aca.exe

description	pid	process	target process
PID 240 wrote to memory of 1756	240	aa2ebb9abf516d6a530683727d18aea01fab4698d908904fc8e622fec00a8aca.exe	aa2ebb9abf516d6a530683727d18aea01fab4698d908904fc8e622fec00a8aca.exe
PID 240 wrote to memory of 1756	240	aa2ebb9abf516d6a530683727d18aea01fab4698d908904fc8e622fec00a8aca.exe	aa2ebb9abf516d6a530683727d18aea01fab4698d908904fc8e622fec00a8aca.exe
PID 240 wrote to memory of 1756	240	aa2ebb9abf516d6a530683727d18aea01fab4698d908904fc8e622fec00a8aca.exe	aa2ebb9abf516d6a530683727d18aea01fab4698d908904fc8e622fec00a8aca.exe
PID 240 wrote to memory of 1756	240	aa2ebb9abf516d6a530683727d18aea01fab4698d908904fc8e622fec00a8aca.exe	aa2ebb9abf516d6a530683727d18aea01fab4698d908904fc8e622fec00a8aca.exe

C:\Users\Admin\AppData\Local\Temp\aa2ebb9abf516d6a530683727d18aea01fab4698d908904fc8e622fec00a8aca.exe
"C:\Users\Admin\AppData\Local\Temp\aa2ebb9abf516d6a530683727d18aea01fab4698d908904fc8e622fec00a8aca.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:240
- C:\Users\Admin\AppData\Local\Temp\aa2ebb9abf516d6a530683727d18aea01fab4698d908904fc8e622fec00a8aca.exe
  "C:\Users\Admin\AppData\Local\Temp\aa2ebb9abf516d6a530683727d18aea01fab4698d908904fc8e622fec00a8aca.exe" kxmxvrnolckvzblfjuop
  2⤵
  PID:1756

memory/240-54-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/240-55-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/240-56-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1756-57-0x0000000000000000-mapping.dmp

Download
memory/1756-61-0x00000000753C1000-0x00000000753C3000-memory.dmp

Filesize
8KB

Download
memory/1756-62-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download