gootloader | 666e249275d61963bf4220af39016a2d11ac30c6a27d0503179625636665bae6

Analysis

max time kernel
150s
max time network
152s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
29-09-2022 10:29

Target

bc00599c450caca3d02adf1c35c3c6882797870c917d79059edc971c0a9ffffd.js
Size

483KB
MD5

4519970bd4974c77a1093a6f4df43011
SHA1

ed333af10b36ce7b7c0655b8b56a0e46b8d567cc
SHA256

bc00599c450caca3d02adf1c35c3c6882797870c917d79059edc971c0a9ffffd
SHA512

4c41171a9bbc731f15e404b80627fe3bf139fa974cd1adbe6346fcc2cc2220575d8086a4dc12f5fdc48abd4d193bf650359eb316cf03b7b07a0e82df3a4044bd
SSDEEP

6144:DQbXQSula5l4khEfD3xA7tiagmd4iLAmW36aXF:tEhEfD3xciagmd4iLAmW360

Score

10^/10

gootloader loader

GootLoader
JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.
loader gootloader
Blocklisted process makes network request 3 IoCs

Processes:

wscript.exe

flow pid process

10 4436 wscript.exe
12 4436 wscript.exe
14 4436 wscript.exe

Script User-Agent 3 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	12	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	14	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	10	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\bc00599c450caca3d02adf1c35c3c6882797870c917d79059edc971c0a9ffffd.js
1⤵
- Blocklisted process makes network request
PID:4436