5763f5a4cdeae5f7b7a58fe0b43c78b2cfb7dd9cf5dd0e81d58dd832d3a28ec7

Analysis

max time kernel
205s
max time network
275s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
25-05-2024 21:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Gooat___Proxyless.exe
Size

10.3MB
MD5

b0f6c5b9a9f85de55ccb5eb3f367427a
SHA1

d12ab7413c42a5c569f973352f286e2a69f3d121
SHA256

5763f5a4cdeae5f7b7a58fe0b43c78b2cfb7dd9cf5dd0e81d58dd832d3a28ec7
SHA512

24abefbac3746f401a2bd9d80b9ca9b15dafb6e029eb7d32ed8397fae7e8ccf4c9480aa3fc301247e76b3047d0e1f8682c59c316e3c53f748334f9c627a01e17
SSDEEP

196608:xP8UstFS1/wbITLwOjUq5DfyGgrwBdnpkYRM6WyoY0gVlF:x1obI/zDfDgrc66UI

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 20 IoCs

Processes:

Gooat___Proxyless.exe

pid	process
4832	Gooat___Proxyless.exe
4832	Gooat___Proxyless.exe
4832	Gooat___Proxyless.exe
4832	Gooat___Proxyless.exe
4832	Gooat___Proxyless.exe
4832	Gooat___Proxyless.exe
4832	Gooat___Proxyless.exe
4832	Gooat___Proxyless.exe
4832	Gooat___Proxyless.exe
4832	Gooat___Proxyless.exe
4832	Gooat___Proxyless.exe
4832	Gooat___Proxyless.exe
4832	Gooat___Proxyless.exe
4832	Gooat___Proxyless.exe
4832	Gooat___Proxyless.exe
4832	Gooat___Proxyless.exe
4832	Gooat___Proxyless.exe
4832	Gooat___Proxyless.exe
4832	Gooat___Proxyless.exe
4832	Gooat___Proxyless.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

vlc.exe

pid process

2128 vlc.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

vlc.exe

pid process

2128 vlc.exe
Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

vlc.exe

pid process

2128 vlc.exe
2128 vlc.exe
2128 vlc.exe
2128 vlc.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

vlc.exe

pid process

2128 vlc.exe
2128 vlc.exe
2128 vlc.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

vlc.exe

pid process

2128 vlc.exe

pid	process
2128	vlc.exe

pid	process
2128	vlc.exe

pid	process
2128	vlc.exe
2128	vlc.exe
2128	vlc.exe
2128	vlc.exe

pid	process
2128	vlc.exe
2128	vlc.exe
2128	vlc.exe

pid	process
2128	vlc.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

Gooat___Proxyless.exeGooat___Proxyless.exe

description	pid	process	target process
PID 5024 wrote to memory of 4832	5024	Gooat___Proxyless.exe	Gooat___Proxyless.exe
PID 5024 wrote to memory of 4832	5024	Gooat___Proxyless.exe	Gooat___Proxyless.exe
PID 4832 wrote to memory of 4600	4832	Gooat___Proxyless.exe	cmd.exe
PID 4832 wrote to memory of 4600	4832	Gooat___Proxyless.exe	cmd.exe
PID 4832 wrote to memory of 3164	4832	Gooat___Proxyless.exe	cmd.exe
PID 4832 wrote to memory of 3164	4832	Gooat___Proxyless.exe	cmd.exe
PID 4832 wrote to memory of 3992	4832	Gooat___Proxyless.exe	cmd.exe
PID 4832 wrote to memory of 3992	4832	Gooat___Proxyless.exe	cmd.exe
PID 4832 wrote to memory of 1872	4832	Gooat___Proxyless.exe	cmd.exe
PID 4832 wrote to memory of 1872	4832	Gooat___Proxyless.exe	cmd.exe
PID 4832 wrote to memory of 1448	4832	Gooat___Proxyless.exe	cmd.exe
PID 4832 wrote to memory of 1448	4832	Gooat___Proxyless.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\Gooat___Proxyless.exe
"C:\Users\Admin\AppData\Local\Temp\Gooat___Proxyless.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5024

C:\Users\Admin\AppData\Local\Temp\Gooat___Proxyless.exe
"C:\Users\Admin\AppData\Local\Temp\Gooat___Proxyless.exe"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4832

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:4600

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:3164

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:3992

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:1872

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:1448

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\PushTest.MTS"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2128

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI50242\MSVCP140.dll
Filesize
564KB

MD5
1ba6d1cf0508775096f9e121a24e5863

SHA1
df552810d779476610da3c8b956cc921ed6c91ae

SHA256
74892d9b4028c05debaf0b9b5d9dc6d22f7956fa7d7eee00c681318c26792823

SHA512
9887d9f5838aa1555ea87968e014edfe2f7747f138f1b551d1f609bc1d5d8214a5fdab0d76fcac98864c1da5eb81405ca373b2a30cb12203c011d89ea6d069af

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50242\VCRUNTIME140.dll
Filesize
95KB

MD5
f34eb034aa4a9735218686590cba2e8b

SHA1
2bc20acdcb201676b77a66fa7ec6b53fa2644713

SHA256
9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1

SHA512
d27d5e65e8206bd7923cf2a3c4384fec0fc59e8bc29e25f8c03d039f3741c01d1a8c82979d7b88c10b209db31fbbec23909e976b3ee593dc33481f0050a445af

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50242\VCRUNTIME140_1.dll
Filesize
36KB

MD5
135359d350f72ad4bf716b764d39e749

SHA1
2e59d9bbcce356f0fece56c9c4917a5cacec63d7

SHA256
34048abaa070ecc13b318cea31425f4ca3edd133d350318ac65259e6058c8b32

SHA512
cf23513d63ab2192c78cae98bd3fea67d933212b630be111fa7e03be3e92af38e247eb2d3804437fd0fda70fdc87916cd24cf1d3911e9f3bfb2cc4ab72b459ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50242\_brotli.cp310-win_amd64.pyd
Filesize
861KB

MD5
6d44fd95c62c6415999ebc01af40574b

SHA1
a5aee5e107d883d1490257c9702913c12b49b22a

SHA256
58bacb135729a70102356c2d110651f1735bf40a602858941e13bdeabfacab4a

SHA512
59b6c07079f979ad4a27ec394eab3fdd2d2d15d106544246fe38f4eb1c9e12672f11d4a8efb5a2a508690ce2677edfac85eb793e2f6a5f8781b258c421119ff3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50242\_bz2.pyd
Filesize
81KB

MD5
86d1b2a9070cd7d52124126a357ff067

SHA1
18e30446fe51ced706f62c3544a8c8fdc08de503

SHA256
62173a8fadd4bf4dd71ab89ea718754aa31620244372f0c5bbbae102e641a60e

SHA512
7db4b7e0c518a02ae901f4b24e3860122acc67e38e73f98f993fe99eb20bb3aa539db1ed40e63d6021861b54f34a5f5a364907ffd7da182adea68bbdd5c2b535

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50242\_ctypes.pyd
Filesize
120KB

MD5
1635a0c5a72df5ae64072cbb0065aebe

SHA1
c975865208b3369e71e3464bbcc87b65718b2b1f

SHA256
1ea3dd3df393fa9b27bf6595be4ac859064cd8ef9908a12378a6021bba1cb177

SHA512
6e34346ea8a0aacc29ccd480035da66e280830a7f3d220fd2f12d4cfa3e1c03955d58c0b95c2674aea698a36a1b674325d3588483505874c2ce018135320ff99

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50242\_hashlib.pyd
Filesize
63KB

MD5
d4674750c732f0db4c4dd6a83a9124fe

SHA1
fd8d76817abc847bb8359a7c268acada9d26bfd5

SHA256
caa4d2f8795e9a55e128409cc016e2cc5c694cb026d7058fc561e4dd131ed1c9

SHA512
97d57cfb80dd9dd822f2f30f836e13a52f771ee8485bc0fd29236882970f6bfbdfaac3f2e333bba5c25c20255e8c0f5ad82d8bc8a6b6e2f7a07ea94a9149c81e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50242\_lzma.pyd
Filesize
154KB

MD5
7447efd8d71e8a1929be0fac722b42dc

SHA1
6080c1b84c2dcbf03dcc2d95306615ff5fce49a6

SHA256
60793c8592193cfbd00fd3e5263be4315d650ba4f9e4fda9c45a10642fd998be

SHA512
c6295d45ed6c4f7534c1a38d47ddc55fea8b9f62bbdc0743e4d22e8ad0484984f8ab077b73e683d0a92d11bf6588a1ae395456cfa57da94bb2a6c4a1b07984de

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50242\_queue.pyd
Filesize
30KB

MD5
d8c1b81bbc125b6ad1f48a172181336e

SHA1
3ff1d8dcec04ce16e97e12263b9233fbf982340c

SHA256
925f05255f4aae0997dc4ec94d900fd15950fd840685d5b8aa755427c7422b14

SHA512
ccc9f0d3aca66729832f26be12f8e7021834bbee1f4a45da9451b1aa5c2e63126c0031d223af57cf71fad2c85860782a56d78d8339b35720194df139076e0772

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50242\_socket.pyd
Filesize
77KB

MD5
819166054fec07efcd1062f13c2147ee

SHA1
93868ebcd6e013fda9cd96d8065a1d70a66a2a26

SHA256
e6deb751039cd5424a139708475ce83f9c042d43e650765a716cb4a924b07e4f

SHA512
da3a440c94cb99b8af7d2bc8f8f0631ae9c112bd04badf200edbf7ea0c48d012843b4a9fb9f1e6d3a9674fd3d4eb6f0fa78fd1121fad1f01f3b981028538b666

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50242\_ssl.pyd
Filesize
156KB

MD5
7910fb2af40e81bee211182cffec0a06

SHA1
251482ed44840b3c75426dd8e3280059d2ca06c6

SHA256
d2a7999e234e33828888ad455baa6ab101d90323579abc1095b8c42f0f723b6f

SHA512
bfe6506feb27a592fe9cf1db7d567d0d07f148ef1a2c969f1e4f7f29740c6bb8ccf946131e65fe5aa8ede371686c272b0860bd4c0c223195aaa1a44f59301b27

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50242\base_library.zip
Filesize
812KB

MD5
866832ed5917cf86a813066281bf0214

SHA1
9fb6b981d418d36b12c3f1ea16606f5e0badb9f7

SHA256
64996668360584314d84d7e4fcd89549715741572e14f6c63e59be0a40f44647

SHA512
80ee6c3fd857b959e5c6a4f9f77b5af19394402dad0c6909100a7d711fd4df76a4b6c6eaa5ae0380193cb9702a4dc53e01524ce797b278eef848a6a97e83bb11

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50242\certifi\cacert.pem
Filesize
259KB

MD5
ea4ee2af66c4c57b8a275867e9dc07cd

SHA1
d904976736e6db3c69c304e96172234078242331

SHA256
fa883829ebb8cd2a602f9b21c1f85de24cf47949d520bceb1828b4cd1cb6906c

SHA512
4114105f63e72b54e506d06168b102a9130263576200fb21532140c0e9936149259879ac30a8b78f15ae7cb0b59b043db5154091312da731ac16e67e6314c412

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50242\libcrypto-1_1.dll
Filesize
3.3MB

MD5
9d7a0c99256c50afd5b0560ba2548930

SHA1
76bd9f13597a46f5283aa35c30b53c21976d0824

SHA256
9b7b4a0ad212095a8c2e35c71694d8a1764cd72a829e8e17c8afe3a55f147939

SHA512
cb39aa99b9d98c735fdacf1c5ed68a4d09d11f30262b91f6aa48c3f8520eff95e499400d0ce7e280ca7a90ff6d7141d2d893ef0b33a8803a1cadb28ba9a9e3e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50242\libffi-7.dll
Filesize
32KB

MD5
eef7981412be8ea459064d3090f4b3aa

SHA1
c60da4830ce27afc234b3c3014c583f7f0a5a925

SHA256
f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

SHA512
dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50242\libssl-1_1.dll
Filesize
688KB

MD5
bec0f86f9da765e2a02c9237259a7898

SHA1
3caa604c3fff88e71f489977e4293a488fb5671c

SHA256
d74ce01319ae6f54483a19375524aa39d9f5fd91f06cf7df238ca25e043130fd

SHA512
ffbc4e5ffdb49704e7aa6d74533e5af76bbe5db297713d8e59bd296143fe5f145fbb616b343eed3c48eceaccccc2431630470d8975a4a17c37eafcc12edd19f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50242\python3.DLL
Filesize
64KB

MD5
fd4a39e7c1f7f07cf635145a2af0dc3a

SHA1
05292ba14acc978bb195818499a294028ab644bd

SHA256
dc909eb798a23ba8ee9f8e3f307d97755bc0d2dc0cb342cedae81fbbad32a8a9

SHA512
37d3218bc767c44e8197555d3fa18d5aad43a536cfe24ac17bf8a3084fb70bd4763ccfd16d2df405538b657f720871e0cd312dfeb7f592f3aac34d9d00d5a643

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50242\python310.dll
Filesize
4.3MB

MD5
63a1fa9259a35eaeac04174cecb90048

SHA1
0dc0c91bcd6f69b80dcdd7e4020365dd7853885a

SHA256
14b06796f288bc6599e458fb23a944ab0c843e9868058f02a91d4606533505ed

SHA512
896caa053f48b1e4102e0f41a7d13d932a746eea69a894ae564ef5a84ef50890514deca6496e915aae40a500955220dbc1b1016fe0b8bcdde0ad81b2917dea8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50242\select.pyd
Filesize
29KB

MD5
a653f35d05d2f6debc5d34daddd3dfa1

SHA1
1a2ceec28ea44388f412420425665c3781af2435

SHA256
db85f2f94d4994283e1055057372594538ae11020389d966e45607413851d9e9

SHA512
5aede99c3be25b1a962261b183ae7a7fb92cb0cb866065dc9cd7bb5ff6f41cc8813d2cc9de54670a27b3ad07a33b833eaa95a5b46dad7763ca97dfa0c1ce54c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50242\unicodedata.pyd
Filesize
1.1MB

MD5
81d62ad36cbddb4e57a91018f3c0816e

SHA1
fe4a4fc35df240b50db22b35824e4826059a807b

SHA256
1fb2d66c056f69e8bbdd8c6c910e72697874dae680264f8fb4b4df19af98aa2e

SHA512
7d15d741378e671591356dfaad4e1e03d3f5456cbdf87579b61d02a4a52ab9b6ecbffad3274cede8c876ea19eaeb8ba4372ad5986744d430a29f50b9caffb75d

Download Submit
memory/2128-85-0x00007FFE9D840000-0x00007FFE9D874000-memory.dmp

Filesize
208KB

Download
memory/2128-84-0x00007FF699EB0000-0x00007FF699FA8000-memory.dmp

Filesize
992KB

Download
memory/2128-86-0x00007FFE8BAE0000-0x00007FFE8BD96000-memory.dmp

Filesize
2.7MB

Download
memory/2128-87-0x00007FFE8A5F0000-0x00007FFE8B6A0000-memory.dmp

Filesize
16.7MB

Download