gootloader | 4d60dfdac38cb8a9f91835e822ea145b0ca22ecf69752866ee6f76182837e123 | Triage

Analysis

max time kernel
165s
max time network
168s
platform
windows10-1703_x64
resource
win10-20220718-en
submitted
28-07-2022 10:43

Sharing

Report Analysis Logs

General

Target

55775a482c209de328186372085686514974418f3d33356d81d015d01e4905d9.js

Score

10^/10

gootloader loader

Malware Config

Signatures

GootLoader
JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.
loader gootloader
Blocklisted process makes network request 3 IoCs

Processes:

wscript.exe

flow pid process

6 2452 wscript.exe
8 2452 wscript.exe
10 2452 wscript.exe

Script User-Agent 3 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	10	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	6	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	8	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\55775a482c209de328186372085686514974418f3d33356d81d015d01e4905d9.js
1⤵
- Blocklisted process makes network request
PID:2452

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...