Analysis
-
max time kernel
145s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
08-11-2022 06:55
General
-
Target
aa055c92547679de5e334d1b2f280090ae327837f880f43ac1fdbb9f333c3bdb.exe
-
Size
96KB
-
MD5
7b69d0eb0522f429eceffd28a45a6614
-
SHA1
595a82453fb5d7db6f5f3a4a4e43e42c62e5d98c
-
SHA256
aa055c92547679de5e334d1b2f280090ae327837f880f43ac1fdbb9f333c3bdb
-
SHA512
e04f935bd1ddc0b1b52a9c9feb948d321b67b0d9917584258a5b5cb60e822cfc2a0e5814a9a162104212e5e2f4d49c9fc1d605301c27e0612d8b9df315bca0c8
-
SSDEEP
1536:LSGilXVXRErrlWa34Eflzoc5ltNNFdNwi1cIAD0FZEeDHIBFJwdT1BClf5E+w7SH:GpS4EflocPtNNheD47dxBU5Nw7S3j
Score
10/10
Malware Config
Extracted
Family
gootkit
Botnet
1001
C2
pell-talak.com
gudsline.com
Attributes
-
vendor_id
1001
Signatures
-
Gootkit
Gootkit is a banking trojan, where large parts are written in node.JS.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\aa055c92547679de5e334d1b2f280090ae327837f880f43ac1fdbb9f333c3bdb.exe"C:\Users\Admin\AppData\Local\Temp\aa055c92547679de5e334d1b2f280090ae327837f880f43ac1fdbb9f333c3bdb.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\aa055c92547679de5e334d1b2f280090ae327837f880f43ac1fdbb9f333c3bdb.exe"C:\Users\Admin\AppData\Local\Temp\aa055c92547679de5e334d1b2f280090ae327837f880f43ac1fdbb9f333c3bdb.exe" ktjsfbdsfysjspmhgkbk2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
52KB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
108KB