gootloader | 60fb7d5d08e4b91eb6978af3bcf3cc0143834fe0e98c7c3a7af7f7d52084e961

Analysis

max time kernel
141s
max time network
143s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
13/09/2022, 12:54

Target
Iowa_uniform_premarital_agreement_act (ashi).js
Size 483KB
Sample220913-p5aa4affc6
SHA256 8869891e2142771fc5457c26edc1192022704647e0ce6b4d06b6c238b8e1cd2e
MD5 2a7e6581759011ecddedac7800afef34
SHA1 3c7bccab2789a97a511bcc34acd9a20402f491e7
SHA512 e2b3447f8a1b3b12651801f7cc0e866a385111af8e4644ebaf0d8523f6d29f6add598c27c3afec2f50fae304008767a8505a391605ed32cfcb84576cdd81fb2f
SSDEEP 6144:+6Q/XSQulaxl4khEfD3hz7qiagmd4iLAmW96hGF:+qMhEfD3hCiagmd4iLAmW96y
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gootloader loader

GootLoader
JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.
loader gootloader

Blocklisted process makes network request 3 IoCs

Script User-Agent 3 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	8	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	10	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	6	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Iowa_uniform_premarital_agreement_act (ashi).js"
1⤵
- Blocklisted process makes network request
PID:3192