gootkit | ae8c191199599e133cac67a50307f96e4b878e4ba04ef2f63cdabb17a39f2542

Analysis

max time kernel
51s
max time network
153s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04-12-2022 18:16

Target

ae8c191199599e133cac67a50307f96e4b878e4ba04ef2f63cdabb17a39f2542.exe
Size

112KB
MD5

5a768a70151584deef9a4cd29ff56eb9
SHA1

7b8761fb0cd6ab1fdc2a7a3bb3a3bf5115e3a826
SHA256

ae8c191199599e133cac67a50307f96e4b878e4ba04ef2f63cdabb17a39f2542
SHA512

645e50abbf1221689bd2ac25cf99fbda10b0ec89070a23f2dd78a5e680e009ee6799ce42d7b8968a10243cff87beda66e3b8be09fea27b50de1297d1b85c7ee0
SSDEEP

3072:3XVn8iDW2JpOxR7eAN1NdO/9T2/Qx5lCAuD2klHByblbfCQQPf:3l8qW2J8yA/NdO/kox5lCN2klHByblbi

Score

10^/10

Family

gootkit

Botnet

1001

pell-talak.com

gudsline.com

Attributes

Gootkit
Gootkit is a banking trojan, where large parts are written in node.JS.
trojan banker botnet gootkit

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

ae8c191199599e133cac67a50307f96e4b878e4ba04ef2f63cdabb17a39f2542.exe

description	pid	process	target process
PID 1184 wrote to memory of 1860	1184	ae8c191199599e133cac67a50307f96e4b878e4ba04ef2f63cdabb17a39f2542.exe	ae8c191199599e133cac67a50307f96e4b878e4ba04ef2f63cdabb17a39f2542.exe
PID 1184 wrote to memory of 1860	1184	ae8c191199599e133cac67a50307f96e4b878e4ba04ef2f63cdabb17a39f2542.exe	ae8c191199599e133cac67a50307f96e4b878e4ba04ef2f63cdabb17a39f2542.exe
PID 1184 wrote to memory of 1860	1184	ae8c191199599e133cac67a50307f96e4b878e4ba04ef2f63cdabb17a39f2542.exe	ae8c191199599e133cac67a50307f96e4b878e4ba04ef2f63cdabb17a39f2542.exe
PID 1184 wrote to memory of 1860	1184	ae8c191199599e133cac67a50307f96e4b878e4ba04ef2f63cdabb17a39f2542.exe	ae8c191199599e133cac67a50307f96e4b878e4ba04ef2f63cdabb17a39f2542.exe

C:\Users\Admin\AppData\Local\Temp\ae8c191199599e133cac67a50307f96e4b878e4ba04ef2f63cdabb17a39f2542.exe
"C:\Users\Admin\AppData\Local\Temp\ae8c191199599e133cac67a50307f96e4b878e4ba04ef2f63cdabb17a39f2542.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1184
- C:\Users\Admin\AppData\Local\Temp\ae8c191199599e133cac67a50307f96e4b878e4ba04ef2f63cdabb17a39f2542.exe
  "C:\Users\Admin\AppData\Local\Temp\ae8c191199599e133cac67a50307f96e4b878e4ba04ef2f63cdabb17a39f2542.exe" kdwjfqszidjhykvdxunp
  2⤵
  PID:1860

memory/1184-54-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1184-55-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1184-56-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1860-57-0x0000000000000000-mapping.dmp

Download
memory/1860-61-0x0000000074BB1000-0x0000000074BB3000-memory.dmp

Filesize
8KB

Download
memory/1860-62-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download