Analysis

  • max time kernel
    150s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    26-05-2024 19:21

General

  • Target

    768d2bef26975c7c15767944a71259d4_JaffaCakes118.exe

  • Size

    188KB

  • MD5

    768d2bef26975c7c15767944a71259d4

  • SHA1

    38d4f37014982484377ae2cea3e0bddf0a770667

  • SHA256

    b03c0d9a936644e05ec1abb6463bca88cf6300d31c60138037bd951af676db6d

  • SHA512

    976a8d0495ed74ed1417fa2af3201455fd3912bd76dd3c5ec41a5fe680428ee20abab174bb6ddfe075593a9798fd2fe4754a8c0e26739284388a3fd65f31dcf0

  • SSDEEP

    3072:Wjyvr5Ps+g8SYkQy6aOEV2/uxq1WolGLmt01hji3mF7zS1rCkFSXQVDLU6:OyvrJbtEVm4qvlPgAmFnEFyQVDw6

Malware Config

Extracted

Family

gootkit

Botnet

2855

C2

me.jmitchelldayton.com

otnhmtkwodm1.site

Attributes
  • vendor_id

    2855

Signatures

  • Gootkit

    Gootkit is a banking trojan, where large parts are written in node.JS.

  • Modifies Internet Explorer Protected Mode 1 TTPs 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\768d2bef26975c7c15767944a71259d4_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\768d2bef26975c7c15767944a71259d4_JaffaCakes118.exe"
    1⤵
    • Modifies Internet Explorer Protected Mode
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2436
    • C:\Users\Admin\AppData\Local\Temp\768d2bef26975c7c15767944a71259d4_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\768d2bef26975c7c15767944a71259d4_JaffaCakes118.exe --vwxyz
      2⤵
        PID:3032

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2436-0-0x0000000000400000-0x0000000000432000-memory.dmp

      Filesize

      200KB

    • memory/2436-2-0x0000000000400000-0x0000000000432000-memory.dmp

      Filesize

      200KB

    • memory/2436-1-0x0000000000400000-0x0000000000432000-memory.dmp

      Filesize

      200KB

    • memory/2436-4-0x0000000000230000-0x0000000000231000-memory.dmp

      Filesize

      4KB

    • memory/2436-3-0x0000000000220000-0x0000000000221000-memory.dmp

      Filesize

      4KB

    • memory/2436-9-0x0000000000400000-0x0000000000432000-memory.dmp

      Filesize

      200KB

    • memory/3032-10-0x0000000000400000-0x0000000000432000-memory.dmp

      Filesize

      200KB