Overview
overview
6Static
static
3GoDm.zip
windows7-x64
6GoDm/.git/...sample
windows7-x64
3GoDm/.git/...sample
windows7-x64
3GoDm/.git/...sample
windows7-x64
3GoDm/.git/...sample
windows7-x64
3GoDm/.git/...sample
windows7-x64
3GoDm/.git/...sample
windows7-x64
3GoDm/.git/...sample
windows7-x64
3GoDm/.git/...sample
windows7-x64
3GoDm/.git/...sample
windows7-x64
3GoDm/.git/...sample
windows7-x64
3GoDm/.git/...sample
windows7-x64
3GoDm/.git/...sample
windows7-x64
3GoDm/.git/...sample
windows7-x64
3GoDm/source.exe
windows7-x64
6GoDm/src/c...ent.js
windows7-x64
1GoDm/src/c...per.js
windows7-x64
1GoDm/src/c...ls.vbs
windows7-x64
1GoDm/src/task/task.js
windows7-x64
1Analysis
-
max time kernel
357s -
max time network
359s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25-02-2024 00:35
Static task
static1
Behavioral task
behavioral1
Sample
GoDm.zip
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
GoDm/.git/hooks/applypatch-msg.sample
Resource
win7-20240221-en
Behavioral task
behavioral3
Sample
GoDm/.git/hooks/commit-msg.sample
Resource
win7-20240220-en
Behavioral task
behavioral4
Sample
GoDm/.git/hooks/fsmonitor-watchman.sample
Resource
win7-20240221-en
Behavioral task
behavioral5
Sample
GoDm/.git/hooks/post-update.sample
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
GoDm/.git/hooks/pre-applypatch.sample
Resource
win7-20240221-en
Behavioral task
behavioral7
Sample
GoDm/.git/hooks/pre-commit.sample
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
GoDm/.git/hooks/pre-merge-commit.sample
Resource
win7-20240221-en
Behavioral task
behavioral9
Sample
GoDm/.git/hooks/pre-push.sample
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
GoDm/.git/hooks/pre-rebase.sample
Resource
win7-20240220-en
Behavioral task
behavioral11
Sample
GoDm/.git/hooks/pre-receive.sample
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
GoDm/.git/hooks/prepare-commit-msg.sample
Resource
win7-20240221-en
Behavioral task
behavioral13
Sample
GoDm/.git/hooks/push-to-checkout.sample
Resource
win7-20240220-en
Behavioral task
behavioral14
Sample
GoDm/.git/hooks/update.sample
Resource
win7-20240221-en
Behavioral task
behavioral15
Sample
GoDm/source.exe
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
GoDm/src/client/client.js
Resource
win7-20240221-en
Behavioral task
behavioral17
Sample
GoDm/src/client/roundtripper.js
Resource
win7-20240220-en
Behavioral task
behavioral18
Sample
GoDm/src/client/utils.vbs
Resource
win7-20240221-en
Behavioral task
behavioral19
Sample
GoDm/src/task/task.js
Resource
win7-20240221-en
General
-
Target
GoDm/.git/hooks/fsmonitor-watchman.sample
-
Size
4KB
-
MD5
a0b2633a2c8e97501610bd3f73da66fc
-
SHA1
0ec0ec9ac11111433d17ea79e0ae8cec650dcfa4
-
SHA256
e0549964e93897b519bd8e333c037e51fff0f88ba13e086a331592bf801fa1d0
-
SHA512
5168643c1768ec83554a9066754507a781b6d14251a46a469222d462efc6ca87a72c90679154e8a723349c91e7772b32ac9b08dfe313cded0ee0a6f17885079e
-
SSDEEP
96:GFCscBOvOFXDgRvi/3UCwN4ZlkRo/j5SpoNOBoi+geBIzCa:GFCsEOmWRa8CwN4ZqRo7geEk3IzCa
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\sample_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\sample_auto_file\shell\Read\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\sample_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.sample rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.sample\ = "sample_auto_file" rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\sample_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\sample_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\sample_auto_file rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
AcroRd32.exepid process 2700 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
AcroRd32.exepid process 2700 AcroRd32.exe 2700 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
cmd.exerundll32.exedescription pid process target process PID 2992 wrote to memory of 2836 2992 cmd.exe rundll32.exe PID 2992 wrote to memory of 2836 2992 cmd.exe rundll32.exe PID 2992 wrote to memory of 2836 2992 cmd.exe rundll32.exe PID 2836 wrote to memory of 2700 2836 rundll32.exe AcroRd32.exe PID 2836 wrote to memory of 2700 2836 rundll32.exe AcroRd32.exe PID 2836 wrote to memory of 2700 2836 rundll32.exe AcroRd32.exe PID 2836 wrote to memory of 2700 2836 rundll32.exe AcroRd32.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\GoDm\.git\hooks\fsmonitor-watchman.sample1⤵
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\GoDm\.git\hooks\fsmonitor-watchman.sample2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\GoDm\.git\hooks\fsmonitor-watchman.sample"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2700
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEventsFilesize
3KB
MD5efbef23e1d7680a05a8bbeb9a7f0e306
SHA1ff010ffc142a68b9e62e758ca0ec211fe8a03c63
SHA256a7d0290f02c7ffe9b41017ebc2718745e9c6fb33494d4fd84a4e4262d8f0d0da
SHA512a6848cdb61be6047def8f6d582c25598e91b91a70c29beb4a10bc67b938d05c62d3019aae27f6adef82d27cb973e4c2636b0fdf79b497b2c556b5331da30bb5d