gootkit | 38933984f5ff8b71c054d1c1155e308ac02377b89315ef17cea859178a30dbab

Analysis

max time kernel
79s
max time network
19s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
16-09-2024 18:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e561ae3cedb6f9fc0ecff559c62788b0_JaffaCakes118.exe
Size

293KB
MD5

e561ae3cedb6f9fc0ecff559c62788b0
SHA1

de34eb34e2c489386fb32dd96469e7fdcef617d9
SHA256

38933984f5ff8b71c054d1c1155e308ac02377b89315ef17cea859178a30dbab
SHA512

c3abd85394b75b05b2bb7c53c28e3d1309226294c16594e6704e009f49353c45de4fcf632222f55529916181ce545485d6fd26d14eecb3db91b625ba9730d757
SSDEEP

6144:PbxOVKPwK8GwP5CltgOX6u99MayBg04b7TbZIb7xx9erp3CHP:j4VKPl8GBlp6u99M1LgTg7cpyv

Score

10^/10

gootkit 8888 banker botnet discovery trojan

Malware Config

Extracted

Family

gootkit

Botnet

8888

sslsecurehost.com

securessl256.com

Attributes

vendor_id
8888

Signatures

Gootkit
Gootkit is a banking trojan, where large parts are written in node.JS.
trojan banker botnet gootkit

Deletes itself 1 IoCs

pid	Process
2944	cmd.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2804 set thread context of 2820	2804	e561ae3cedb6f9fc0ecff559c62788b0_JaffaCakes118.exe	31

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e561ae3cedb6f9fc0ecff559c62788b0_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e561ae3cedb6f9fc0ecff559c62788b0_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mstsc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e561ae3cedb6f9fc0ecff559c62788b0_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2808	mstsc.exe
2808	mstsc.exe
2808	mstsc.exe
2808	mstsc.exe
2808	mstsc.exe
2808	mstsc.exe
2808	mstsc.exe
2808	mstsc.exe
2808	mstsc.exe
2808	mstsc.exe
2808	mstsc.exe
2808	mstsc.exe
2808	mstsc.exe
2808	mstsc.exe
2808	mstsc.exe
2808	mstsc.exe
2808	mstsc.exe
2808	mstsc.exe
2808	mstsc.exe
2808	mstsc.exe
2808	mstsc.exe
2808	mstsc.exe
2808	mstsc.exe
2808	mstsc.exe
2808	mstsc.exe
2808	mstsc.exe
2808	mstsc.exe
2808	mstsc.exe
2808	mstsc.exe
2808	mstsc.exe
2808	mstsc.exe
2808	mstsc.exe
2808	mstsc.exe
2808	mstsc.exe
2808	mstsc.exe
2808	mstsc.exe
2808	mstsc.exe
2808	mstsc.exe
2808	mstsc.exe
2808	mstsc.exe
2808	mstsc.exe
2808	mstsc.exe
2808	mstsc.exe
2808	mstsc.exe
2808	mstsc.exe
2808	mstsc.exe
2808	mstsc.exe
2808	mstsc.exe
2808	mstsc.exe
2808	mstsc.exe
2808	mstsc.exe
2808	mstsc.exe
2808	mstsc.exe
2808	mstsc.exe
2808	mstsc.exe
2808	mstsc.exe
2808	mstsc.exe
2808	mstsc.exe
2808	mstsc.exe
2808	mstsc.exe
2808	mstsc.exe
2808	mstsc.exe
2808	mstsc.exe
2808	mstsc.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2820	e561ae3cedb6f9fc0ecff559c62788b0_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 2804	2216	e561ae3cedb6f9fc0ecff559c62788b0_JaffaCakes118.exe	30
PID 2216 wrote to memory of 2804	2216	e561ae3cedb6f9fc0ecff559c62788b0_JaffaCakes118.exe	30
PID 2216 wrote to memory of 2804	2216	e561ae3cedb6f9fc0ecff559c62788b0_JaffaCakes118.exe	30
PID 2216 wrote to memory of 2804	2216	e561ae3cedb6f9fc0ecff559c62788b0_JaffaCakes118.exe	30
PID 2804 wrote to memory of 2820	2804	e561ae3cedb6f9fc0ecff559c62788b0_JaffaCakes118.exe	31
PID 2804 wrote to memory of 2820	2804	e561ae3cedb6f9fc0ecff559c62788b0_JaffaCakes118.exe	31
PID 2804 wrote to memory of 2820	2804	e561ae3cedb6f9fc0ecff559c62788b0_JaffaCakes118.exe	31
PID 2804 wrote to memory of 2820	2804	e561ae3cedb6f9fc0ecff559c62788b0_JaffaCakes118.exe	31
PID 2804 wrote to memory of 2820	2804	e561ae3cedb6f9fc0ecff559c62788b0_JaffaCakes118.exe	31
PID 2804 wrote to memory of 2820	2804	e561ae3cedb6f9fc0ecff559c62788b0_JaffaCakes118.exe	31
PID 2804 wrote to memory of 2820	2804	e561ae3cedb6f9fc0ecff559c62788b0_JaffaCakes118.exe	31
PID 2804 wrote to memory of 2820	2804	e561ae3cedb6f9fc0ecff559c62788b0_JaffaCakes118.exe	31
PID 2804 wrote to memory of 2820	2804	e561ae3cedb6f9fc0ecff559c62788b0_JaffaCakes118.exe	31
PID 2804 wrote to memory of 2820	2804	e561ae3cedb6f9fc0ecff559c62788b0_JaffaCakes118.exe	31
PID 2820 wrote to memory of 2808	2820	e561ae3cedb6f9fc0ecff559c62788b0_JaffaCakes118.exe	32
PID 2820 wrote to memory of 2808	2820	e561ae3cedb6f9fc0ecff559c62788b0_JaffaCakes118.exe	32
PID 2820 wrote to memory of 2808	2820	e561ae3cedb6f9fc0ecff559c62788b0_JaffaCakes118.exe	32
PID 2820 wrote to memory of 2808	2820	e561ae3cedb6f9fc0ecff559c62788b0_JaffaCakes118.exe	32
PID 2820 wrote to memory of 2808	2820	e561ae3cedb6f9fc0ecff559c62788b0_JaffaCakes118.exe	32
PID 2820 wrote to memory of 2808	2820	e561ae3cedb6f9fc0ecff559c62788b0_JaffaCakes118.exe	32
PID 2820 wrote to memory of 2808	2820	e561ae3cedb6f9fc0ecff559c62788b0_JaffaCakes118.exe	32
PID 2820 wrote to memory of 2808	2820	e561ae3cedb6f9fc0ecff559c62788b0_JaffaCakes118.exe	32
PID 2820 wrote to memory of 2808	2820	e561ae3cedb6f9fc0ecff559c62788b0_JaffaCakes118.exe	32
PID 2808 wrote to memory of 2944	2808	mstsc.exe	33
PID 2808 wrote to memory of 2944	2808	mstsc.exe	33
PID 2808 wrote to memory of 2944	2808	mstsc.exe	33
PID 2808 wrote to memory of 2944	2808	mstsc.exe	33
PID 2944 wrote to memory of 2860	2944	cmd.exe	35
PID 2944 wrote to memory of 2860	2944	cmd.exe	35
PID 2944 wrote to memory of 2860	2944	cmd.exe	35
PID 2944 wrote to memory of 2860	2944	cmd.exe	35

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2860	attrib.exe

C:\Users\Admin\AppData\Local\Temp\e561ae3cedb6f9fc0ecff559c62788b0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e561ae3cedb6f9fc0ecff559c62788b0_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Users\Admin\AppData\Local\Temp\e561ae3cedb6f9fc0ecff559c62788b0_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\e561ae3cedb6f9fc0ecff559c62788b0_JaffaCakes118.exe" -l
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2804
- - C:\Users\Admin\AppData\Local\Temp\e561ae3cedb6f9fc0ecff559c62788b0_JaffaCakes118.exe
    C:\Users\Admin\AppData\Local\Temp\e561ae3cedb6f9fc0ecff559c62788b0_JaffaCakes118.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:2820
  - - C:\Windows\SysWOW64\mstsc.exe
      C:\Windows\System32\mstsc.exe "C:\Users\Admin\AppData\Local\Temp\e561ae3cedb6f9fc0ecff559c62788b0_JaffaCakes118.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2808
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\259490300.bat" "C:\Users\Admin\AppData\Local\Temp\e561ae3cedb6f9fc0ecff559c62788b0_JaffaCakes118.exe""
        5⤵
        Deletes itself
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2944
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib -r -s -h "C:\Users\Admin\AppData\Local\Temp\e561ae3cedb6f9fc0ecff559c62788b0_JaffaCakes118.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:2860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\259490300.bat

Filesize
76B

MD5
b377546c3dfeccc4aaed2f11721a5d9e

SHA1
f79922b9dd9a65856b38fab029eb0bc4b1989a3d

SHA256
b22d63aad518db7636ddfc41c30d6ac6aba84f16efb8ddcc507a3793d33ab2e1

SHA512
0fc08a4c41e106f378771a8c77202c326f9dcd1c1f2c430eef6ecf16ddc562e5c77320e14c16578807028a303b300b4c366109ae0f2dd90c1dc6a68ca5f7b4ab

Download Submit
memory/2808-6-0x0000000000080000-0x00000000000A0000-memory.dmp

Filesize
128KB

Download
memory/2808-15-0x0000000000080000-0x00000000000A0000-memory.dmp

Filesize
128KB

Download
memory/2820-0-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2820-2-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2820-5-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download