Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
20-05-2024 05:19
General
-
Target
5d5ec039c6e151b1d7119f9aae350c0d_JaffaCakes118.exe
-
Size
104KB
-
MD5
5d5ec039c6e151b1d7119f9aae350c0d
-
SHA1
7a654ff2489ff36d08ff73343669a40a3c45ea73
-
SHA256
8646105621d6c01b212cede10b2fde39c70d76d8cece3bb957c2e4b5176fd9d1
-
SHA512
e76391fcc6a5fe8134831dbfc245e6f99b601a638ce7571495e597512f3a96f031d63e0db6bfc15e980944c72537a930b28144932bebfe82a687121853353fa5
-
SSDEEP
3072:Lx78Ll6UnxKC6FWhd9aP6YsaS+LQXyjPoU:F7QDxvwWhdgCYspXuo
Score
10/10
Malware Config
Extracted
Family
gootkit
Botnet
1001
C2
pell-talak.com
gudsline.com
Attributes
-
vendor_id
1001
Signatures
-
Gootkit
Gootkit is a banking trojan, where large parts are written in node.JS.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5d5ec039c6e151b1d7119f9aae350c0d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d5ec039c6e151b1d7119f9aae350c0d_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5d5ec039c6e151b1d7119f9aae350c0d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d5ec039c6e151b1d7119f9aae350c0d_JaffaCakes118.exe" keqstcubefnpwghhtnfr2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
116KB
-
Filesize
116KB
-
Filesize
52KB
-
Filesize
52KB
-
Filesize
4KB
-
Filesize
116KB
-
Filesize
116KB
-
Filesize
4KB
-
Filesize
116KB
-
Filesize
116KB
-
Filesize
4KB
-
Filesize
116KB
-
Filesize
116KB