gootkit | 7166921e37458ba67f1e96a7ed289edf0e6157664f8e8e84767a215c9ecc9cd3

General

Target

370af9bb1ec73c9348ca53d9bf28b7cb_JaffaCakes118.exe
Size

189KB
MD5

370af9bb1ec73c9348ca53d9bf28b7cb
SHA1

44e8c64a1e3a2f7e22c35daffb349b8736247659
SHA256

7166921e37458ba67f1e96a7ed289edf0e6157664f8e8e84767a215c9ecc9cd3
SHA512

c160e94ab54994c432c35509a0ad815dc5edbda7108b543e464c45b095c958d46d0646bc4f9971cae6d1021ffb90de62a6956c189936d6cc6badaf98e4849b2c
SSDEEP

3072:ZZ1EuyleuFqObco92BjB3hkyRQW3BaG3oJYsYrQ14nqWsyPzO0w8Rh5:ZZ13luD9OwiBaGDU0OH8T

Score

10^/10

gootkit 2862 banker botnet trojan

Malware Config

Extracted

Family

gootkit

Botnet

2862

C2

roma.simplebutmatters.com

dom.jmitchelldayton.com

Attributes

vendor_id
2862

Signatures

Gootkit
Gootkit is a banking trojan, where large parts are written in node.JS.
trojan banker botnet gootkit

Modifies Internet Explorer Protected Mode 1 TTPs 5 IoCs

Modify Registry

T1112

Processes:

370af9bb1ec73c9348ca53d9bf28b7cb_JaffaCakes118.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\2500 = "3"	370af9bb1ec73c9348ca53d9bf28b7cb_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3"	370af9bb1ec73c9348ca53d9bf28b7cb_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3"	370af9bb1ec73c9348ca53d9bf28b7cb_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3"	370af9bb1ec73c9348ca53d9bf28b7cb_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3"	370af9bb1ec73c9348ca53d9bf28b7cb_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

370af9bb1ec73c9348ca53d9bf28b7cb_JaffaCakes118.exe

pid	process
4660	370af9bb1ec73c9348ca53d9bf28b7cb_JaffaCakes118.exe
4660	370af9bb1ec73c9348ca53d9bf28b7cb_JaffaCakes118.exe
4660	370af9bb1ec73c9348ca53d9bf28b7cb_JaffaCakes118.exe
4660	370af9bb1ec73c9348ca53d9bf28b7cb_JaffaCakes118.exe
4660	370af9bb1ec73c9348ca53d9bf28b7cb_JaffaCakes118.exe
4660	370af9bb1ec73c9348ca53d9bf28b7cb_JaffaCakes118.exe
4660	370af9bb1ec73c9348ca53d9bf28b7cb_JaffaCakes118.exe
4660	370af9bb1ec73c9348ca53d9bf28b7cb_JaffaCakes118.exe
4660	370af9bb1ec73c9348ca53d9bf28b7cb_JaffaCakes118.exe
4660	370af9bb1ec73c9348ca53d9bf28b7cb_JaffaCakes118.exe
4660	370af9bb1ec73c9348ca53d9bf28b7cb_JaffaCakes118.exe
4660	370af9bb1ec73c9348ca53d9bf28b7cb_JaffaCakes118.exe
4660	370af9bb1ec73c9348ca53d9bf28b7cb_JaffaCakes118.exe
4660	370af9bb1ec73c9348ca53d9bf28b7cb_JaffaCakes118.exe
4660	370af9bb1ec73c9348ca53d9bf28b7cb_JaffaCakes118.exe
4660	370af9bb1ec73c9348ca53d9bf28b7cb_JaffaCakes118.exe
4660	370af9bb1ec73c9348ca53d9bf28b7cb_JaffaCakes118.exe
4660	370af9bb1ec73c9348ca53d9bf28b7cb_JaffaCakes118.exe
4660	370af9bb1ec73c9348ca53d9bf28b7cb_JaffaCakes118.exe
4660	370af9bb1ec73c9348ca53d9bf28b7cb_JaffaCakes118.exe
4660	370af9bb1ec73c9348ca53d9bf28b7cb_JaffaCakes118.exe
4660	370af9bb1ec73c9348ca53d9bf28b7cb_JaffaCakes118.exe
4660	370af9bb1ec73c9348ca53d9bf28b7cb_JaffaCakes118.exe
4660	370af9bb1ec73c9348ca53d9bf28b7cb_JaffaCakes118.exe
4660	370af9bb1ec73c9348ca53d9bf28b7cb_JaffaCakes118.exe
4660	370af9bb1ec73c9348ca53d9bf28b7cb_JaffaCakes118.exe
4660	370af9bb1ec73c9348ca53d9bf28b7cb_JaffaCakes118.exe
4660	370af9bb1ec73c9348ca53d9bf28b7cb_JaffaCakes118.exe
4660	370af9bb1ec73c9348ca53d9bf28b7cb_JaffaCakes118.exe
4660	370af9bb1ec73c9348ca53d9bf28b7cb_JaffaCakes118.exe
4660	370af9bb1ec73c9348ca53d9bf28b7cb_JaffaCakes118.exe
4660	370af9bb1ec73c9348ca53d9bf28b7cb_JaffaCakes118.exe
4660	370af9bb1ec73c9348ca53d9bf28b7cb_JaffaCakes118.exe
4660	370af9bb1ec73c9348ca53d9bf28b7cb_JaffaCakes118.exe
4660	370af9bb1ec73c9348ca53d9bf28b7cb_JaffaCakes118.exe
4660	370af9bb1ec73c9348ca53d9bf28b7cb_JaffaCakes118.exe
4660	370af9bb1ec73c9348ca53d9bf28b7cb_JaffaCakes118.exe
4660	370af9bb1ec73c9348ca53d9bf28b7cb_JaffaCakes118.exe
4660	370af9bb1ec73c9348ca53d9bf28b7cb_JaffaCakes118.exe
4660	370af9bb1ec73c9348ca53d9bf28b7cb_JaffaCakes118.exe
4660	370af9bb1ec73c9348ca53d9bf28b7cb_JaffaCakes118.exe
4660	370af9bb1ec73c9348ca53d9bf28b7cb_JaffaCakes118.exe
4660	370af9bb1ec73c9348ca53d9bf28b7cb_JaffaCakes118.exe
4660	370af9bb1ec73c9348ca53d9bf28b7cb_JaffaCakes118.exe
4660	370af9bb1ec73c9348ca53d9bf28b7cb_JaffaCakes118.exe
4660	370af9bb1ec73c9348ca53d9bf28b7cb_JaffaCakes118.exe
4660	370af9bb1ec73c9348ca53d9bf28b7cb_JaffaCakes118.exe
4660	370af9bb1ec73c9348ca53d9bf28b7cb_JaffaCakes118.exe
4660	370af9bb1ec73c9348ca53d9bf28b7cb_JaffaCakes118.exe
4660	370af9bb1ec73c9348ca53d9bf28b7cb_JaffaCakes118.exe
4660	370af9bb1ec73c9348ca53d9bf28b7cb_JaffaCakes118.exe
4660	370af9bb1ec73c9348ca53d9bf28b7cb_JaffaCakes118.exe
4660	370af9bb1ec73c9348ca53d9bf28b7cb_JaffaCakes118.exe
4660	370af9bb1ec73c9348ca53d9bf28b7cb_JaffaCakes118.exe
4660	370af9bb1ec73c9348ca53d9bf28b7cb_JaffaCakes118.exe
4660	370af9bb1ec73c9348ca53d9bf28b7cb_JaffaCakes118.exe
4660	370af9bb1ec73c9348ca53d9bf28b7cb_JaffaCakes118.exe
4660	370af9bb1ec73c9348ca53d9bf28b7cb_JaffaCakes118.exe
4660	370af9bb1ec73c9348ca53d9bf28b7cb_JaffaCakes118.exe
4660	370af9bb1ec73c9348ca53d9bf28b7cb_JaffaCakes118.exe
4660	370af9bb1ec73c9348ca53d9bf28b7cb_JaffaCakes118.exe
4660	370af9bb1ec73c9348ca53d9bf28b7cb_JaffaCakes118.exe
4660	370af9bb1ec73c9348ca53d9bf28b7cb_JaffaCakes118.exe
4660	370af9bb1ec73c9348ca53d9bf28b7cb_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

370af9bb1ec73c9348ca53d9bf28b7cb_JaffaCakes118.exe

description	pid	process	target process
PID 4660 wrote to memory of 2712	4660	370af9bb1ec73c9348ca53d9bf28b7cb_JaffaCakes118.exe	370af9bb1ec73c9348ca53d9bf28b7cb_JaffaCakes118.exe
PID 4660 wrote to memory of 2712	4660	370af9bb1ec73c9348ca53d9bf28b7cb_JaffaCakes118.exe	370af9bb1ec73c9348ca53d9bf28b7cb_JaffaCakes118.exe
PID 4660 wrote to memory of 2712	4660	370af9bb1ec73c9348ca53d9bf28b7cb_JaffaCakes118.exe	370af9bb1ec73c9348ca53d9bf28b7cb_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\370af9bb1ec73c9348ca53d9bf28b7cb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\370af9bb1ec73c9348ca53d9bf28b7cb_JaffaCakes118.exe"
1⤵
- Modifies Internet Explorer Protected Mode
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4660
- C:\Users\Admin\AppData\Local\Temp\370af9bb1ec73c9348ca53d9bf28b7cb_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\370af9bb1ec73c9348ca53d9bf28b7cb_JaffaCakes118.exe --vwxyz
  2⤵
  PID:2712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2712-8-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4660-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4660-3-0x00000000021D0000-0x00000000021D1000-memory.dmp

Filesize
4KB

Download
memory/4660-2-0x00000000021C0000-0x00000000021C1000-memory.dmp

Filesize
4KB

Download
memory/4660-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4660-7-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads