Overview
overview
6Static
static
3GoDm.zip
windows7-x64
6GoDm/.git/...sample
windows7-x64
3GoDm/.git/...sample
windows7-x64
3GoDm/.git/...sample
windows7-x64
3GoDm/.git/...sample
windows7-x64
3GoDm/.git/...sample
windows7-x64
3GoDm/.git/...sample
windows7-x64
3GoDm/.git/...sample
windows7-x64
3GoDm/.git/...sample
windows7-x64
3GoDm/.git/...sample
windows7-x64
3GoDm/.git/...sample
windows7-x64
3GoDm/.git/...sample
windows7-x64
3GoDm/.git/...sample
windows7-x64
3GoDm/.git/...sample
windows7-x64
3GoDm/source.exe
windows7-x64
6GoDm/src/c...ent.js
windows7-x64
1GoDm/src/c...per.js
windows7-x64
1GoDm/src/c...ls.vbs
windows7-x64
1GoDm/src/task/task.js
windows7-x64
1Analysis
-
max time kernel
357s -
max time network
361s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25-02-2024 00:35
Static task
static1
Behavioral task
behavioral1
Sample
GoDm.zip
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
GoDm/.git/hooks/applypatch-msg.sample
Resource
win7-20240221-en
Behavioral task
behavioral3
Sample
GoDm/.git/hooks/commit-msg.sample
Resource
win7-20240220-en
Behavioral task
behavioral4
Sample
GoDm/.git/hooks/fsmonitor-watchman.sample
Resource
win7-20240221-en
Behavioral task
behavioral5
Sample
GoDm/.git/hooks/post-update.sample
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
GoDm/.git/hooks/pre-applypatch.sample
Resource
win7-20240221-en
Behavioral task
behavioral7
Sample
GoDm/.git/hooks/pre-commit.sample
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
GoDm/.git/hooks/pre-merge-commit.sample
Resource
win7-20240221-en
Behavioral task
behavioral9
Sample
GoDm/.git/hooks/pre-push.sample
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
GoDm/.git/hooks/pre-rebase.sample
Resource
win7-20240220-en
Behavioral task
behavioral11
Sample
GoDm/.git/hooks/pre-receive.sample
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
GoDm/.git/hooks/prepare-commit-msg.sample
Resource
win7-20240221-en
Behavioral task
behavioral13
Sample
GoDm/.git/hooks/push-to-checkout.sample
Resource
win7-20240220-en
Behavioral task
behavioral14
Sample
GoDm/.git/hooks/update.sample
Resource
win7-20240221-en
Behavioral task
behavioral15
Sample
GoDm/source.exe
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
GoDm/src/client/client.js
Resource
win7-20240221-en
Behavioral task
behavioral17
Sample
GoDm/src/client/roundtripper.js
Resource
win7-20240220-en
Behavioral task
behavioral18
Sample
GoDm/src/client/utils.vbs
Resource
win7-20240221-en
Behavioral task
behavioral19
Sample
GoDm/src/task/task.js
Resource
win7-20240221-en
General
-
Target
GoDm/.git/hooks/update.sample
-
Size
3KB
-
MD5
647ae13c682f7827c22f5fc08a03674e
-
SHA1
730e6bd5225478bab6147b7a62a6e2ae21d40507
-
SHA256
8d5f2fa83e103cf08b57eaa67521df9194f45cbdbcb37da52ad586097a14d106
-
SHA512
be3780974589d06eddba6fa0aa15a3e3dfe390e2827a1a6ae5cb83d6ac47e79ef9b1bbb53f067372f8dc70db0350d3770e78537fd3cfe734200ff824eca4cada
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\sample_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\sample_auto_file\shell\Read\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\sample_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\.sample\ = "sample_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\sample_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\sample_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\sample_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\.sample rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
AcroRd32.exepid process 2056 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
AcroRd32.exepid process 2056 AcroRd32.exe 2056 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
cmd.exerundll32.exedescription pid process target process PID 1364 wrote to memory of 2636 1364 cmd.exe rundll32.exe PID 1364 wrote to memory of 2636 1364 cmd.exe rundll32.exe PID 1364 wrote to memory of 2636 1364 cmd.exe rundll32.exe PID 2636 wrote to memory of 2056 2636 rundll32.exe AcroRd32.exe PID 2636 wrote to memory of 2056 2636 rundll32.exe AcroRd32.exe PID 2636 wrote to memory of 2056 2636 rundll32.exe AcroRd32.exe PID 2636 wrote to memory of 2056 2636 rundll32.exe AcroRd32.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\GoDm\.git\hooks\update.sample1⤵
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\GoDm\.git\hooks\update.sample2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\GoDm\.git\hooks\update.sample"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2056
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEventsFilesize
3KB
MD57ce3030f427c73c3e0b58ca4cafe11a1
SHA19b01d81d02f5eee7c1b59fff37d0842d3d011ede
SHA25601b5006b6e31977f07289980ada8daa189b59f63892855f27934af976536f00d
SHA5120129404fd62914e2b15160f0c2b4e1ae84405411a574695cc425409872f00d6af6b32ef5a68ffc574ecf01498e9f9e5c16815c2696b3e488e50b89ea45368d91