gootloader | 17696097b3244366652cb10df5e3a8e84b030dc636f23784ec77894e09d5a091

Analysis

max time kernel
291s
max time network
294s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
26/08/2022, 11:14

Target
Home_depot_equipment_rental_agreement (zst).js
Size 483KB
Sample220826-ncejnscfc4
SHA256 71c4b8f69cd8d834dbca5f0617f05f47fd10a966c2363c8a37d7665ed8935a60
MD5 e21d595b5d57b33bfa53c744e004d415
SHA1 aa20caa63ee743a4dd559437621b1ba33169e669
SHA512 b773a31306fab407d6217b3a23528ca0c574ec580bafc7bb2e431e837337331ce2823ca051242c4ddc7f1360bbcb086236d7f76df060016fc8d196a84b07e6ac
SSDEEP 6144:aQzL/bulaKl4khEfD3xA7Fiagmd4iLAmWf67SF:XShEfD3xMiagmd4iLAmWf6Y
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gootloader loader

GootLoader
JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.
loader gootloader

Blocklisted process makes network request 2 IoCs

flow	pid	Process
7	3896	wscript.exe
9	3896	wscript.exe

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	9	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	7	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Home_depot_equipment_rental_agreement (zst).js"
1⤵
- Blocklisted process makes network request
PID:3896