gootloader | 17f6626dbe0995d97a0415480e88a6df8203c25a7d33973464172d547ab726d1 | Triage

Resubmissions

02-08-2022 18:51

220802-xhw6cabcgr 8

02-08-2022 18:40

220802-xbggbahhe7 1

Analysis

max time kernel
219s
max time network
247s
platform
windows10-1703_x64
resource
win10-20220718-en
submitted
02-08-2022 18:51

Sharing

Report Analysis Logs

General

Target

Va_private_road_maintenance_agreement_form (qxwv).js

Score

10^/10

gootloader loader

Malware Config

Signatures

GootLoader
JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.
loader gootloader
Blocklisted process makes network request 3 IoCs

Processes:

wscript.exe

flow pid process

7 2492 wscript.exe
9 2492 wscript.exe
11 2492 wscript.exe

Script User-Agent 3 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	7	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	9	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	11	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Va_private_road_maintenance_agreement_form (qxwv).js"
1⤵
- Blocklisted process makes network request
PID:2492

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...