gootkit | 6b6f47abe5a8103adf1b12e5f3651ed24b632a64c5c94ce297a6f9ca0710f772

General

Target

02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe
Size

112KB
MD5

02a7e926c827c520122fcf6a4567314c
SHA1

3c30ff40ef14baaf3d7ea74cabafdd0ab4d6b162
SHA256

6b6f47abe5a8103adf1b12e5f3651ed24b632a64c5c94ce297a6f9ca0710f772
SHA512

bdcb94e511b12f5d987cb6c493c74a609c1582020b06545654a6c79a0fd72372d25a716cac4919108639cae484dbb3d39cb2dda39539c309a03f011bf5fed7ad
SSDEEP

3072:3XVn8iDW2JpOxR7eAN1NdO/9T2/Qx5lCAeD2EFnBSr1rvSgA//:3l8qW2J8yA/NdO/kox5lCd2EFnBSr1ry

Score

10^/10

gootkit 1001 banker botnet trojan

Malware Config

Extracted

Family

gootkit

Botnet

1001

C2

pell-talak.com

gudsline.com

Attributes

vendor_id
1001

Signatures

Gootkit
Gootkit is a banking trojan, where large parts are written in node.JS.
trojan banker botnet gootkit

Drops file in System32 directory 4 IoCs

Processes:

02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015	02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015	02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357	02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357	02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe

Modifies data under HKEY_USERS 42 IoCs

Processes:

02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe

description	pid	process	target process
PID 1664 wrote to memory of 2632	1664	02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe	02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe
PID 1664 wrote to memory of 2632	1664	02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe	02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe
PID 1664 wrote to memory of 2632	1664	02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe	02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe
PID 1664 wrote to memory of 2632	1664	02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe	02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Users\Admin\AppData\Local\Temp\02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe" kxgtatoyoldeiglhjlvh
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:2632

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1664-13-0x0000000002A90000-0x0000000002B59000-memory.dmp

Filesize
804KB

Download
memory/1664-9-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/1664-0-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1664-4-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1664-3-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1664-1-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1664-10-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/1664-18-0x0000000000470000-0x0000000000475000-memory.dmp

Filesize
20KB

Download
memory/1664-2-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1664-16-0x0000000000470000-0x0000000000475000-memory.dmp

Filesize
20KB

Download
memory/1664-12-0x0000000002720000-0x00000000027BF000-memory.dmp

Filesize
636KB

Download
memory/1664-15-0x0000000000460000-0x0000000000461000-memory.dmp

Filesize
4KB

Download
memory/1664-14-0x0000000002B60000-0x0000000002C69000-memory.dmp

Filesize
1.0MB

Download
memory/1664-11-0x0000000002010000-0x000000000213D000-memory.dmp

Filesize
1.2MB

Download
memory/1664-17-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2632-5-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2632-19-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/2632-24-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/2632-37-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads