Resubmissions

03-10-2024 15:47

241003-s77adswhlg 8

03-10-2024 15:39

241003-s31l2ssgrr 8

03-10-2024 15:35

241003-s1stessgjn 8

03-10-2024 15:25

241003-strmsasdlp 8

Analysis

  • max time kernel
    166s
  • max time network
    162s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    03-10-2024 15:25

General

  • Target

    https://github.com/JackDoesMalwares/Gocullinator

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

    When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://github.com/JackDoesMalwares/Gocullinator"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2348
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://github.com/JackDoesMalwares/Gocullinator
      2⤵
      • Subvert Trust Controls: Mark-of-the-Web Bypass
      • Checks processor information in registry
      • Modifies registry class
      • NTFS ADS
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1720
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1720.0.1034615697\453941653" -parentBuildID 20221007134813 -prefsHandle 1264 -prefMapHandle 1224 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {02517c96-9d21-4232-9572-1c8a3e932c9d} 1720 "\\.\pipe\gecko-crash-server-pipe.1720" 1388 10df1958 gpu
        3⤵
          PID:2176
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1720.1.1266703297\1404935228" -parentBuildID 20221007134813 -prefsHandle 1544 -prefMapHandle 1540 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c849fbc8-a6e0-4cb9-975f-4d8153481169} 1720 "\\.\pipe\gecko-crash-server-pipe.1720" 1556 f70e58 socket
          3⤵
            PID:572
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1720.2.1473720956\328632323" -childID 1 -isForBrowser -prefsHandle 2060 -prefMapHandle 2056 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 896 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f886b97b-713b-4dfc-9177-45859a76e875} 1720 "\\.\pipe\gecko-crash-server-pipe.1720" 2072 19096558 tab
            3⤵
              PID:2144
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1720.3.420888998\1911356028" -childID 2 -isForBrowser -prefsHandle 2760 -prefMapHandle 2756 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 896 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e62a3277-5b6e-41e6-83d6-59d5130dd75b} 1720 "\\.\pipe\gecko-crash-server-pipe.1720" 2772 14fa3f58 tab
              3⤵
                PID:2932
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1720.4.53340760\72235287" -childID 3 -isForBrowser -prefsHandle 3948 -prefMapHandle 3944 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 896 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2dd3639d-ad7a-498d-82c0-8ad25f87a6a6} 1720 "\\.\pipe\gecko-crash-server-pipe.1720" 3960 216f0358 tab
                3⤵
                  PID:2524
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1720.5.833979994\1769965580" -childID 4 -isForBrowser -prefsHandle 4060 -prefMapHandle 4064 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 896 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a1a0e1ff-afef-4786-84db-91d0a7587dd5} 1720 "\\.\pipe\gecko-crash-server-pipe.1720" 4048 21960d58 tab
                  3⤵
                    PID:1668
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1720.6.1070054537\1888999325" -childID 5 -isForBrowser -prefsHandle 4236 -prefMapHandle 4240 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 896 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b4471606-40f8-4f33-a5bc-dd68d5caf268} 1720 "\\.\pipe\gecko-crash-server-pipe.1720" 4224 21962258 tab
                    3⤵
                      PID:1892
                    • C:\Users\Admin\Downloads\RBXMCPQKVAOE.exe
                      "C:\Users\Admin\Downloads\RBXMCPQKVAOE.exe"
                      3⤵
                      • Executes dropped EXE
                      • Writes to the Master Boot Record (MBR)
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3008

                Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\o97f221x.default-release\activity-stream.discovery_stream.json.tmp

                  Filesize

                  23KB

                  MD5

                  c241be5d8627926ad2ff5f0517251b40

                  SHA1

                  b2cc4b844967d2260542966daa2f7498a04140c0

                  SHA256

                  1ae8e5e30570e45a18a86af752244a959a4fbdf2d56106c419d2761386ea0c2d

                  SHA512

                  caeffc44074ca1173021f4f21030b43ca22431648d6d29358261c5f4239932bf56fd734bc941fae9b81013ad55d1859a876882334a924185f8fba07bd03c35d7

                • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                  Filesize

                  442KB

                  MD5

                  85430baed3398695717b0263807cf97c

                  SHA1

                  fffbee923cea216f50fce5d54219a188a5100f41

                  SHA256

                  a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

                  SHA512

                  06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

                • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                  Filesize

                  8.0MB

                  MD5

                  a01c5ecd6108350ae23d2cddf0e77c17

                  SHA1

                  c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

                  SHA256

                  345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

                  SHA512

                  b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\datareporting\glean\db\data.safe.bin

                  Filesize

                  2KB

                  MD5

                  3fff00c0617a7331a6a58a33b8474a91

                  SHA1

                  5915511995f31c1baf16e6e19575800b0242d42a

                  SHA256

                  6ba5399e82344ad9903977a38a2815543378300ada54c65657927ee1bf267ec6

                  SHA512

                  d22d65e7f3a5ab74fcfccfb486b5f5fa129f2ec77cae60a81397b1834ae7eab3041f5707376cd5cfce7e3a176e893ab66c9dc6dadb3e75ce68b591c45e6824e8

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\datareporting\glean\pending_pings\4e615eb9-9854-4325-9ba0-8b8ac5062fd4

                  Filesize

                  10KB

                  MD5

                  d1f0ff3e55e0ff723298b9b723036643

                  SHA1

                  5f78678b3a802ae5171737d23bb8c4b4cd86526a

                  SHA256

                  4313396b8c75de4e14551e7bc7b11c638b67726df610f668cd3d4218bbcc33b5

                  SHA512

                  866578cee50c2d61f6efcc3114bd10a1c89a9d2c1925f7e55e4e90e979b54e85a5635112090fc8c97e8c9976ac1f65b752dc2b9676211ed302f3be96b0136a77

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\datareporting\glean\pending_pings\759b2cf7-c048-493f-9b37-8d99d2e9f050

                  Filesize

                  745B

                  MD5

                  a259d73664a44030fac7ef819666951f

                  SHA1

                  dcc801660d4da5a327d87782acf4ba98cdf8545f

                  SHA256

                  4b7cdca502f3aaaebfac8a3ecee28df4e9ff315d9f6c1d0da98db7ec65cd5b58

                  SHA512

                  2a030fa1886aef307b8023b13e4c06e016c4b26bc7c45a8ca36be244050f4fd6da4b2e5d5d98ac319ff29da58468301f5f7f393ceb428666fbc71c62814bac64

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

                  Filesize

                  997KB

                  MD5

                  fe3355639648c417e8307c6d051e3e37

                  SHA1

                  f54602d4b4778da21bc97c7238fc66aa68c8ee34

                  SHA256

                  1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

                  SHA512

                  8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

                  Filesize

                  116B

                  MD5

                  3d33cdc0b3d281e67dd52e14435dd04f

                  SHA1

                  4db88689282fd4f9e9e6ab95fcbb23df6e6485db

                  SHA256

                  f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

                  SHA512

                  a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

                  Filesize

                  479B

                  MD5

                  49ddb419d96dceb9069018535fb2e2fc

                  SHA1

                  62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

                  SHA256

                  2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

                  SHA512

                  48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

                  Filesize

                  372B

                  MD5

                  8be33af717bb1b67fbd61c3f4b807e9e

                  SHA1

                  7cf17656d174d951957ff36810e874a134dd49e0

                  SHA256

                  e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

                  SHA512

                  6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

                  Filesize

                  11.8MB

                  MD5

                  33bf7b0439480effb9fb212efce87b13

                  SHA1

                  cee50f2745edc6dc291887b6075ca64d716f495a

                  SHA256

                  8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

                  SHA512

                  d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

                  Filesize

                  1KB

                  MD5

                  688bed3676d2104e7f17ae1cd2c59404

                  SHA1

                  952b2cdf783ac72fcb98338723e9afd38d47ad8e

                  SHA256

                  33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

                  SHA512

                  7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

                  Filesize

                  1KB

                  MD5

                  937326fead5fd401f6cca9118bd9ade9

                  SHA1

                  4526a57d4ae14ed29b37632c72aef3c408189d91

                  SHA256

                  68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

                  SHA512

                  b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\prefs-1.js

                  Filesize

                  7KB

                  MD5

                  3605385899c7ee3a2a078f7907cd3bb5

                  SHA1

                  7121bd76659b7202cc67c26ad73c6f619a3009d9

                  SHA256

                  8fa23562d6b3c0952969d52e116574b68c3a1c637103a89368533826c62d4a92

                  SHA512

                  d580c9a14cbd67e722a436ab6dab953a10beb1cff2e3ba263b6b3efe60c14e93a2a92c2d244bab29a68688895bba8c0127d2c50ffcc9ab8b93fd9fb74eba1664

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\prefs.js

                  Filesize

                  6KB

                  MD5

                  e92a2a01741b0cfb84d219884389ac73

                  SHA1

                  4aa48331d2fa6cd16362c8d4128d8e7b806a4dfa

                  SHA256

                  d0511c3539a92e2892daa499d02613e8ef114ff4a0f6d9904456a28e9c35b886

                  SHA512

                  c08cf2003059c6ca0084909caeeeccad2a7e8a5eba3a605c50d4eec807e3c66ffee02891f817076e80d95d92f21c68cdfedd2eadba100779c9739fd8218f9234

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\prefs.js

                  Filesize

                  6KB

                  MD5

                  345dedd4cbe6c4ca4c4212e77279f5b4

                  SHA1

                  8fe95d7fccb32e01f2d07095efc83199df8d6bd5

                  SHA256

                  bd0f88a85f676b7c5f323d116fbe4542db3faa629f7e925cdd6f07b55d44e47c

                  SHA512

                  937d280563617202dc5070cdd480fc54860622ec0efee7d1cacab42f0fd4e4ef4a6e0edc544fa65fd0c55b01b48d38ab2b36a6fd3f5e880402fc36f86b9c6d09

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\sessionstore-backups\recovery.jsonlz4

                  Filesize

                  3KB

                  MD5

                  d8513ef23fff8121b03cfadd510765bd

                  SHA1

                  359410ebcb215b0b3507e2a494c09589307b780d

                  SHA256

                  fe59441a6d6630db65ab4d4ff463c48e52f6d3e7f4611dd23966c1ce3a3215db

                  SHA512

                  14b7117f1f81cd174b24a40023c8ff71ae409578a24a841378a66634d4c30b0706f9b240e2037826ca0a5b827c4155bfe6f489cb17bc8da772614440fddd6c95

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\sessionstore-backups\recovery.jsonlz4

                  Filesize

                  3KB

                  MD5

                  df659f1015e547460fa6ff1401ea3e82

                  SHA1

                  8170ef4206a5476f48e3f92e1b16afe7c0d99bc5

                  SHA256

                  8049b14fbbf355a0500e4b71366347c1da03f9bf25994c2aa0d9336ea9cbd4ad

                  SHA512

                  6d1f85416a2aa3f9785f34063c18bcaaa15faea1a66fcf48452aab69620684a10ce60649a858bf98bb9f60a8c701d1a53e570a3ab27cb6484271f0d70013983c

                • C:\Users\Admin\Downloads\RBXMCPQKVAOE.exe

                  Filesize

                  18KB

                  MD5

                  37b2ae3d81f0090ffd447506ce737cfe

                  SHA1

                  59d4ece8c1b01bca1606283a53666a71092ae9e9

                  SHA256

                  b66ffd832f2b39df63a44427e56dab12b2d3bceb8c109b58b7a297bb943c28a0

                  SHA512

                  54574e4f15c94eaeecde086740e9117252f119ffde3be556b220e06e73c41ea11b4682921b44d79b76a60f610802f1feae054c322bbfdad4551e1edf355e79ec