gootloader | e7771079263512d163af5874c0e1888d6f80741161cb44c4a83d23cae817add8 | Triage

Analysis

max time kernel
151s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
submitted
27-07-2022 14:20

Sharing

Report Analysis Logs

General

Target

55775a482c209de328186372085686514974418f3d33356d81d015d01e4905d9.js

Score

10^/10

gootloader loader

Malware Config

Signatures

GootLoader
JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.
loader gootloader
Blocklisted process makes network request 3 IoCs

Processes:

wscript.exe

flow pid process

46 2228 wscript.exe
48 2228 wscript.exe
52 2228 wscript.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4988 4072 WerFault.exe

Script User-Agent 3 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	46	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	48	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	52	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\55775a482c209de328186372085686514974418f3d33356d81d015d01e4905d9.js
1⤵
- Blocklisted process makes network request
PID:2228

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 440 -p 4072 -ip 4072
1⤵
PID:2000

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 4072 -s 2492
1⤵
- Program crash
PID:4988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...