gootloader | 3a6b63ad36a63d6bea80e500a728327926006894ca0c97ea89470e3d0575329b | Triage

Analysis

max time kernel
209s
max time network
214s
platform
windows10-1703_x64
resource
win10-20220722-en
submitted
28-07-2022 16:02

Sharing

Report Analysis Logs

General

Target

bb28b429112ef5d4d4cbdc0adbafbe5291532414a09bd970567fbaa644c5fe81.js

Score

10^/10

gootloader loader

Malware Config

Signatures

GootLoader
JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.
loader gootloader
Blocklisted process makes network request 3 IoCs

Processes:

wscript.exe

flow pid process

5 4596 wscript.exe
7 4596 wscript.exe
9 4596 wscript.exe

Script User-Agent 3 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	5	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	7	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	9	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\bb28b429112ef5d4d4cbdc0adbafbe5291532414a09bd970567fbaa644c5fe81.js
1⤵
- Blocklisted process makes network request
PID:4596

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...