51a5678e3dcba33c7201090bbaa09a6d04ebd14eaa8a5c7e56a18a4ab7611acc

General

Target
jaffacakes118_Trojan.Win32.Gofot.crg.exe
Size 366KB
Sample261018-v5bf2sswew
SHA256 51a5678e3dcba33c7201090bbaa09a6d04ebd14eaa8a5c7e56a18a4ab7611acc
MD5 d10d3347530959aa15ac35ffebf2e4d7
SHA1 25810fea82d399a5cbcc5591fb116217488692ee
SHA512 c100e24c5abad2ef50c44ebbfd89a41a1bfb7f137cffeacde7526bf99b5141a18ce992142d62d942281cf45abfcba03bf464a9f7504b4ee83475ae9a2bc238d0
SSDEEP 6144:Je34uRAKkpJ8SnUfdJF7dRacRN5mGwRQwIJLHHNhjVnlo7OpjPwBiiKOI2FiqOpC:+OD8LJF7LIvRFuLHRnppjPk82s8Jd
TLSH
T13984228AD5E1ACBFFD83863262FDF15AE67F13901121682F439567AD3E9022D09449CF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
260	BomulBoxC.exe

Loads dropped DLL 3 IoCs

pid	Process
4436	jaffacakes118_Trojan.Win32.Gofot.crg.exe
4436	jaffacakes118_Trojan.Win32.Gofot.crg.exe
4436	jaffacakes118_Trojan.Win32.Gofot.crg.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\BomulBox = "C:\\Program Files (x86)\\BomulBox\\BomulBoxC.exe /RUN"	BomulBoxC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\BomulBox = "C:\\Program Files (x86)\\BomulBox\\BomulBoxC.exe /RUN"	jaffacakes118_Trojan.Win32.Gofot.crg.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\BomulBox\BomulBoxC.exe	jaffacakes118_Trojan.Win32.Gofot.crg.exe
File created	C:\Program Files (x86)\BomulBox\UninstallExpressService.exe	jaffacakes118_Trojan.Win32.Gofot.crg.exe
File created	C:\Program Files (x86)\BomulBox\Uninstall.exe	jaffacakes118_Trojan.Win32.Gofot.crg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	BomulBoxC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	BomulBoxC.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BomulBoxC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan.Win32.Gofot.crg.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4436	jaffacakes118_Trojan.Win32.Gofot.crg.exe
4436	jaffacakes118_Trojan.Win32.Gofot.crg.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
260	BomulBoxC.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4436 wrote to memory of 260	4436	jaffacakes118_Trojan.Win32.Gofot.crg.exe	89

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Gofot.crg.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Gofot.crg.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4436
- C:\Program Files (x86)\BomulBox\BomulBoxC.exe
  "C:\Program Files (x86)\BomulBox\BomulBoxC.exe" UPDATE
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BomulBoxC.exe

Path C:\Program Files (x86)\BomulBox\BomulBoxC.exe
Size 725KB
SHA256 22e20debb0b8d4de152ef122e11cbef1d94d8df74b99a96c3b6afa8ca14a2e85
MD5 5bcd355f7594869c3df982f0b6092e89
SHA1 3c19ee9e83eb26da2ccca276817667642e734b8d
SHA512 5dc8dd48c7b98b1ea485b30c29140c86ee9a285319bfc873c9599e2327425cbb72111b656b08805d143d476fa4717b7e38e441f1f29a24429a439d054fccd3b5
SSDEEP 6144:EVjPCGHUYoWwgkbRUCNgsF0NywJWvAf1WTvCZ3jvyJiTcPDqlzIEAJg80SoQD2dk:8jpZkNlNgy29WTvCxLy0TjZAe80So+j
TLSH
T1FDF46A0177F1C1F6C68286320DBB931963B2FE965B24AAC737D83B5F9E351D16A38211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KillProcDLL.dll

Path C:\Users\Admin\AppData\Local\Temp\nso8C49.tmp\KillProcDLL.dll
Size 44KB
SHA256 1af3ac7d3176af42e8594ba0c33821d3318f4eea5cbb799bf8fab58e480efe0e
MD5 3599d30554ad65dc29fc689217d2152e
SHA1 8f5fcc313b667a1de2d56573bcf98d43fd0d4ff9
SHA512 846776b1d908b5204667715ffdfd3a6c76dface1677e8b1e5156ceac2ef0a739f68b48ccbb919c9e08d6ff359a93174bf0b90def7d48cee54cd3c41d8d8575f2
SSDEEP 768:oY6+2hD1lu3SFh80Z9pe7nJRJ3QN8DOUVowlo+J:76xhZlM0h/9panJ73CSFl
TLSH
T1F8137D117C8285F3C59A457962D91F575B3F66001BF580871FFA1A6EAF372E0AA3E302
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nso8C49.tmp\System.dll
Size 11KB
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
TLSH
T1CA325C5993A0C1F3D5A0823C0D973A7B1779722016B14FA3CFA35842AE196D7AC7D227
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4436-10-0x0000000002830000-0x000000000283C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads