gootkit | 6b6f47abe5a8103adf1b12e5f3651ed24b632a64c5c94ce297a6f9ca0710f772

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
27-04-2024 06:45

Target

02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe
Size

112KB
MD5

02a7e926c827c520122fcf6a4567314c
SHA1

3c30ff40ef14baaf3d7ea74cabafdd0ab4d6b162
SHA256

6b6f47abe5a8103adf1b12e5f3651ed24b632a64c5c94ce297a6f9ca0710f772
SHA512

bdcb94e511b12f5d987cb6c493c74a609c1582020b06545654a6c79a0fd72372d25a716cac4919108639cae484dbb3d39cb2dda39539c309a03f011bf5fed7ad
SSDEEP

3072:3XVn8iDW2JpOxR7eAN1NdO/9T2/Qx5lCAeD2EFnBSr1rvSgA//:3l8qW2J8yA/NdO/kox5lCd2EFnBSr1ry

Score

10^/10

Family

gootkit

Botnet

1001

pell-talak.com

gudsline.com

Attributes

Gootkit
Gootkit is a banking trojan, where large parts are written in node.JS.
trojan banker botnet gootkit

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe

description	pid	process	target process
PID 1816 wrote to memory of 4064	1816	02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe	02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe
PID 1816 wrote to memory of 4064	1816	02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe	02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe
PID 1816 wrote to memory of 4064	1816	02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe	02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1816
- C:\Users\Admin\AppData\Local\Temp\02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\02a7e926c827c520122fcf6a4567314c_JaffaCakes118.exe" ksghsjhquobggchzjliw
  2⤵
  PID:4064

memory/1816-0-0x00000000005D0000-0x00000000005D1000-memory.dmp

Filesize
4KB

Download
memory/1816-3-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1816-2-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1816-1-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1816-4-0x00000000005E0000-0x00000000005E1000-memory.dmp

Filesize
4KB

Download
memory/1816-8-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4064-7-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4064-6-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4064-5-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4064-9-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/4064-14-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/4064-15-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4064-17-0x0000000000570000-0x0000000000571000-memory.dmp

Filesize
4KB

Download