Overview
overview
6Static
static
3GoDm/.git/...sample
windows11-21h2-x64
3GoDm/.git/...sample
windows11-21h2-x64
3GoDm/.git/...sample
windows11-21h2-x64
3GoDm/.git/...sample
windows11-21h2-x64
3GoDm/.git/...sample
windows11-21h2-x64
3GoDm/.git/...sample
windows11-21h2-x64
3GoDm/.git/...sample
windows11-21h2-x64
3GoDm/.git/...sample
windows11-21h2-x64
3GoDm/.git/...sample
windows11-21h2-x64
3GoDm/.git/...sample
windows11-21h2-x64
3GoDm/.git/...sample
windows11-21h2-x64
3GoDm/.git/...sample
windows11-21h2-x64
3GoDm/.git/...sample
windows11-21h2-x64
3GoDm/source.exe
windows11-21h2-x64
6GoDm/src/c...ent.js
windows11-21h2-x64
3GoDm/src/c...per.js
windows11-21h2-x64
3GoDm/src/c...ls.vbs
windows11-21h2-x64
1GoDm/src/task/task.js
windows11-21h2-x64
3Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
28-06-2024 00:04
Static task
static1
Behavioral task
behavioral1
Sample
GoDm/.git/hooks/applypatch-msg.sample
Resource
win11-20240508-en
Behavioral task
behavioral2
Sample
GoDm/.git/hooks/commit-msg.sample
Resource
win11-20240611-en
Behavioral task
behavioral3
Sample
GoDm/.git/hooks/fsmonitor-watchman.sample
Resource
win11-20240508-en
Behavioral task
behavioral4
Sample
GoDm/.git/hooks/post-update.sample
Resource
win11-20240611-en
Behavioral task
behavioral5
Sample
GoDm/.git/hooks/pre-applypatch.sample
Resource
win11-20240508-en
Behavioral task
behavioral6
Sample
GoDm/.git/hooks/pre-commit.sample
Resource
win11-20240611-en
Behavioral task
behavioral7
Sample
GoDm/.git/hooks/pre-merge-commit.sample
Resource
win11-20240611-en
Behavioral task
behavioral8
Sample
GoDm/.git/hooks/pre-push.sample
Resource
win11-20240508-en
Behavioral task
behavioral9
Sample
GoDm/.git/hooks/pre-rebase.sample
Resource
win11-20240611-en
Behavioral task
behavioral10
Sample
GoDm/.git/hooks/pre-receive.sample
Resource
win11-20240508-en
Behavioral task
behavioral11
Sample
GoDm/.git/hooks/prepare-commit-msg.sample
Resource
win11-20240508-en
Behavioral task
behavioral12
Sample
GoDm/.git/hooks/push-to-checkout.sample
Resource
win11-20240611-en
Behavioral task
behavioral13
Sample
GoDm/.git/hooks/update.sample
Resource
win11-20240611-en
Behavioral task
behavioral14
Sample
GoDm/source.exe
Resource
win11-20240508-en
Behavioral task
behavioral15
Sample
GoDm/src/client/client.js
Resource
win11-20240419-en
Behavioral task
behavioral16
Sample
GoDm/src/client/roundtripper.js
Resource
win11-20240611-en
Behavioral task
behavioral17
Sample
GoDm/src/client/utils.vbs
Resource
win11-20240419-en
Behavioral task
behavioral18
Sample
GoDm/src/task/task.js
Resource
win11-20240611-en
General
-
Target
GoDm/source.exe
-
Size
13.5MB
-
MD5
5df1ae0ac565c650821135785b158021
-
SHA1
25d21ca9c049a6ab821734093a58c1b9fd7789e4
-
SHA256
43f604cdb1bc8ceab09dfffe2198e7d7829712ab834a1c5c7fe5171c8c5368fb
-
SHA512
fc734695cdc694e218675aeea07386e35a47b2f23a71608ef07be10f5a1e80dcc24b6177d28597a74a06cb4a65cab5506bfc5d197a3a420f61b6a52e29aa1da0
-
SSDEEP
196608:sZhXsph78ipqLZINPMTQB6YoTu19lcviP1sfGbbU0:7L78BLZdTQB6Yok9lco1P3
Malware Config
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
source.exedescription pid process target process PID 2936 wrote to memory of 4048 2936 source.exe cmd.exe PID 2936 wrote to memory of 4048 2936 source.exe cmd.exe PID 2936 wrote to memory of 2836 2936 source.exe cmd.exe PID 2936 wrote to memory of 2836 2936 source.exe cmd.exe PID 2936 wrote to memory of 3632 2936 source.exe cmd.exe PID 2936 wrote to memory of 3632 2936 source.exe cmd.exe PID 2936 wrote to memory of 1600 2936 source.exe cmd.exe PID 2936 wrote to memory of 1600 2936 source.exe cmd.exe PID 2936 wrote to memory of 1668 2936 source.exe cmd.exe PID 2936 wrote to memory of 1668 2936 source.exe cmd.exe PID 2936 wrote to memory of 4572 2936 source.exe cmd.exe PID 2936 wrote to memory of 4572 2936 source.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\GoDm\source.exe"C:\Users\Admin\AppData\Local\Temp\GoDm\source.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Windows\system32\cmd.execmd /c cls2⤵PID:4048
-
C:\Windows\system32\cmd.execmd /c cls2⤵PID:2836
-
C:\Windows\system32\cmd.execmd /c cls2⤵PID:3632
-
C:\Windows\system32\cmd.execmd /c cls2⤵PID:1600
-
C:\Windows\system32\cmd.execmd /c cls2⤵PID:1668
-
C:\Windows\system32\cmd.execmd /c cls2⤵PID:4572