gootloader | 2244857f09480a53b563b730618354ca3a96a6f7d4e445d5b0b6da6102c4ee96

Analysis

max time kernel
260s
max time network
264s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
02/09/2022, 08:10

Target
2244857f09480a53b563b730618354ca3a96a6f7d4e445d5b0b6da6102c4ee96.js
Size 483KB
Sample220902-j2n27aafgm
SHA256 2244857f09480a53b563b730618354ca3a96a6f7d4e445d5b0b6da6102c4ee96
MD5 f4a0dcd2304e0566f6d748292274d488
SHA1 dde42481b533892f5738c17dcd1b986b27b116bb
SHA512 f2d9fbe6096a6df8ae1a48b5f782337267351ce18e2887430ce18762a5e6653664780870468829f7fcf90ba6aad1c3c8e0ac0f7a19fe47f622d9e00dfb7b7bc5
SSDEEP 6144:qQjm7ZTulaHl4fhEfD3IA7Iiagmd4iLAmW865SF:K1ghEfD3IJiagmd4iLAmW86m
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gootloader loader

GootLoader
JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.
loader gootloader

Blocklisted process makes network request 2 IoCs

flow	pid	Process
20	1644	wscript.exe
22	1644	wscript.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	20	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\2244857f09480a53b563b730618354ca3a96a6f7d4e445d5b0b6da6102c4ee96.js
1⤵
- Blocklisted process makes network request
PID:1644