gootkit | aa2ebb9abf516d6a530683727d18aea01fab4698d908904fc8e622fec00a8aca

Analysis

max time kernel
90s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
08-11-2022 05:23

Target

aa2ebb9abf516d6a530683727d18aea01fab4698d908904fc8e622fec00a8aca.exe
Size

97KB
MD5

0912d7f53812a0ab61e0c1001eb107f0
SHA1

a9f1039a88b5ccd210c9dbf227ea23bcb562993d
SHA256

aa2ebb9abf516d6a530683727d18aea01fab4698d908904fc8e622fec00a8aca
SHA512

aa21ee7607c8d928550ef9cd47638f65ecade923629d072fe91bd9a0a6e23853eb585d75917273ef7104e91f2da032db736764d3d1f09124e2bec92332049f7f
SSDEEP

3072:7W+EGGxgfhI/5KOEwvDRRVkT6KsRPKfXE:7NhyuhIBpRRVgsRP2

Score

10^/10

Family

gootkit

Botnet

1001

pell-talak.com

gudsline.com

Attributes

Gootkit
Gootkit is a banking trojan, where large parts are written in node.JS.
trojan banker botnet gootkit

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

aa2ebb9abf516d6a530683727d18aea01fab4698d908904fc8e622fec00a8aca.exe

description	pid	process	target process
PID 4972 wrote to memory of 3816	4972	aa2ebb9abf516d6a530683727d18aea01fab4698d908904fc8e622fec00a8aca.exe	aa2ebb9abf516d6a530683727d18aea01fab4698d908904fc8e622fec00a8aca.exe
PID 4972 wrote to memory of 3816	4972	aa2ebb9abf516d6a530683727d18aea01fab4698d908904fc8e622fec00a8aca.exe	aa2ebb9abf516d6a530683727d18aea01fab4698d908904fc8e622fec00a8aca.exe
PID 4972 wrote to memory of 3816	4972	aa2ebb9abf516d6a530683727d18aea01fab4698d908904fc8e622fec00a8aca.exe	aa2ebb9abf516d6a530683727d18aea01fab4698d908904fc8e622fec00a8aca.exe

C:\Users\Admin\AppData\Local\Temp\aa2ebb9abf516d6a530683727d18aea01fab4698d908904fc8e622fec00a8aca.exe
"C:\Users\Admin\AppData\Local\Temp\aa2ebb9abf516d6a530683727d18aea01fab4698d908904fc8e622fec00a8aca.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4972

C:\Users\Admin\AppData\Local\Temp\aa2ebb9abf516d6a530683727d18aea01fab4698d908904fc8e622fec00a8aca.exe
"C:\Users\Admin\AppData\Local\Temp\aa2ebb9abf516d6a530683727d18aea01fab4698d908904fc8e622fec00a8aca.exe" kfkdxynbjjlmhveeimrn
2⤵
PID:3816

memory/3816-135-0x0000000000000000-mapping.dmp

Download
memory/3816-137-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3816-138-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3816-136-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3816-139-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/4972-132-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4972-133-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4972-134-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download