Analysis

  • max time kernel
    163s
  • max time network
    172s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-11-2022 19:09

General

  • Target

    0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe

  • Size

    189KB

  • MD5

    84a6b69a72f274cde26972ae3ef0ff13

  • SHA1

    bc30f84067ed408b34892e23a1916512010d7ee2

  • SHA256

    0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b

  • SHA512

    b501438d74a2e744552165a5a0345993bd74512d659d86bf37f9d0d351e2a116d02bf85995126e89e48c468d5fc8e3c2c13f7f89bed62a42034764b7ed4b1a93

  • SSDEEP

    3072:7gHJtiqAdeqgQS7RFAhADrXlJLzPb8R7Hi+xv+eSdu+g58QYwW/lioQ:7o6dgQeRlHXlJLzPK7P6Z+8QYn/l

Malware Config

Extracted

Family

gootkit

Botnet

2862

C2

roma.simplebutmatters.com

dom.jmitchelldayton.com

Attributes
  • vendor_id

    2862

Signatures

  • Gootkit

    Gootkit is a banking trojan, where large parts are written in node.JS.

  • Modifies Internet Explorer Protected Mode 1 TTPs 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe
    "C:\Users\Admin\AppData\Local\Temp\0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe"
    1⤵
    • Modifies Internet Explorer Protected Mode
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4132
    • C:\Users\Admin\AppData\Local\Temp\0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe
      C:\Users\Admin\AppData\Local\Temp\0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe --vwxyz
      2⤵
        PID:3060

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4132-132-0x0000000000400000-0x0000000000432000-memory.dmp

      Filesize

      200KB

    • memory/4132-133-0x0000000000400000-0x0000000000432000-memory.dmp

      Filesize

      200KB