Analysis
-
max time kernel
151s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
04-12-2022 18:16
General
-
Target
ae8c191199599e133cac67a50307f96e4b878e4ba04ef2f63cdabb17a39f2542.exe
-
Size
112KB
-
MD5
5a768a70151584deef9a4cd29ff56eb9
-
SHA1
7b8761fb0cd6ab1fdc2a7a3bb3a3bf5115e3a826
-
SHA256
ae8c191199599e133cac67a50307f96e4b878e4ba04ef2f63cdabb17a39f2542
-
SHA512
645e50abbf1221689bd2ac25cf99fbda10b0ec89070a23f2dd78a5e680e009ee6799ce42d7b8968a10243cff87beda66e3b8be09fea27b50de1297d1b85c7ee0
-
SSDEEP
3072:3XVn8iDW2JpOxR7eAN1NdO/9T2/Qx5lCAuD2klHByblbfCQQPf:3l8qW2J8yA/NdO/kox5lCN2klHByblbi
Score
10/10
Malware Config
Extracted
Family
gootkit
Botnet
1001
C2
pell-talak.com
gudsline.com
Attributes
-
vendor_id
1001
Signatures
-
Gootkit
Gootkit is a banking trojan, where large parts are written in node.JS.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ae8c191199599e133cac67a50307f96e4b878e4ba04ef2f63cdabb17a39f2542.exe"C:\Users\Admin\AppData\Local\Temp\ae8c191199599e133cac67a50307f96e4b878e4ba04ef2f63cdabb17a39f2542.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ae8c191199599e133cac67a50307f96e4b878e4ba04ef2f63cdabb17a39f2542.exe"C:\Users\Admin\AppData\Local\Temp\ae8c191199599e133cac67a50307f96e4b878e4ba04ef2f63cdabb17a39f2542.exe" kwzovjzzukghoeswvoyo2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
52KB