gootloader | 4d60dfdac38cb8a9f91835e822ea145b0ca22ecf69752866ee6f76182837e123 | Triage

Analysis

max time kernel
150s
max time network
152s
platform
windows10_x64
resource
win10-20220414-en
submitted
28-07-2022 10:43

Sharing

Report Analysis Logs

General

Target

b28f40b8f1fee4e985198f6980e26ed069cfe79915991a9ec671d7ece0934875.js

Score

10^/10

gootloader loader

Malware Config

Signatures

GootLoader
JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.
loader gootloader
Blocklisted process makes network request 3 IoCs

Processes:

wscript.exe

flow pid process

8 2612 wscript.exe
10 2612 wscript.exe
12 2612 wscript.exe

Script User-Agent 3 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	10	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	12	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	8	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\b28f40b8f1fee4e985198f6980e26ed069cfe79915991a9ec671d7ece0934875.js
1⤵
- Blocklisted process makes network request
PID:2612

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...