gootloader | d3c937335f6eadbe0b2436070e757dfff0b64724d86bf63c0a10aae4d84c5ea4

Analysis

max time kernel
585s
max time network
591s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22/01/2024, 17:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

pa collective agreement pay 48068.js
Size

841KB
MD5

20ed9076de590f5fc5222bf55a7da796
SHA1

d362f70891b7e00deaae577fc24059429fc02b97
SHA256

d3c937335f6eadbe0b2436070e757dfff0b64724d86bf63c0a10aae4d84c5ea4
SHA512

15d051a5636d47a5fa497dd3de509632593c49a19aaf1a11c6bc2856b7a3193a48e7ea940b3b5aa1971f03d7e5050dff1162338f847f2a48403d66cc76d0b407
SSDEEP

24576:RTCgo+ogQc5WfNnZmD/ncnjqA39e+JhtS+WpyQTSEFNE3NEr:RTCgo+ogQc5WfNnZmD/nCjqA4GNWpyQF

Score

10^/10

gootloader loader

Malware Config

Signatures

GootLoader
JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.
loader gootloader

Blocklisted process makes network request 17 IoCs

flow	pid	Process
63	3764	powershell.exe
71	3764	powershell.exe
73	3764	powershell.exe
76	3764	powershell.exe
78	3764	powershell.exe
80	3764	powershell.exe
82	3764	powershell.exe
83	3764	powershell.exe
91	3764	powershell.exe
97	3764	powershell.exe
101	3764	powershell.exe
104	3764	powershell.exe
106	3764	powershell.exe
107	3764	powershell.exe
109	3764	powershell.exe
111	3764	powershell.exe
112	3764	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Control Panel\International\Geo\Nation	wscript.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	powershell.exe

Suspicious behavior: EnumeratesProcesses 44 IoCs

pid	Process
3764	powershell.exe
3764	powershell.exe
3764	powershell.exe
3764	powershell.exe
3764	powershell.exe
3764	powershell.exe
3764	powershell.exe
3764	powershell.exe
3764	powershell.exe
3764	powershell.exe
3764	powershell.exe
3764	powershell.exe
3764	powershell.exe
3764	powershell.exe
3764	powershell.exe
3764	powershell.exe
3764	powershell.exe
3764	powershell.exe
3764	powershell.exe
3764	powershell.exe
3764	powershell.exe
3764	powershell.exe
3764	powershell.exe
3764	powershell.exe
3764	powershell.exe
3764	powershell.exe
3764	powershell.exe
3764	powershell.exe
3764	powershell.exe
3764	powershell.exe
3764	powershell.exe
3764	powershell.exe
3764	powershell.exe
3764	powershell.exe
3764	powershell.exe
3764	powershell.exe
3764	powershell.exe
3764	powershell.exe
3764	powershell.exe
3764	powershell.exe
3764	powershell.exe
3764	powershell.exe
3764	powershell.exe
3764	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3764	powershell.exe
Token: SeIncreaseQuotaPrivilege	3764	powershell.exe
Token: SeSecurityPrivilege	3764	powershell.exe
Token: SeTakeOwnershipPrivilege	3764	powershell.exe
Token: SeLoadDriverPrivilege	3764	powershell.exe
Token: SeSystemProfilePrivilege	3764	powershell.exe
Token: SeSystemtimePrivilege	3764	powershell.exe
Token: SeProfSingleProcessPrivilege	3764	powershell.exe
Token: SeIncBasePriorityPrivilege	3764	powershell.exe
Token: SeCreatePagefilePrivilege	3764	powershell.exe
Token: SeBackupPrivilege	3764	powershell.exe
Token: SeRestorePrivilege	3764	powershell.exe
Token: SeShutdownPrivilege	3764	powershell.exe
Token: SeDebugPrivilege	3764	powershell.exe
Token: SeSystemEnvironmentPrivilege	3764	powershell.exe
Token: SeRemoteShutdownPrivilege	3764	powershell.exe
Token: SeUndockPrivilege	3764	powershell.exe
Token: SeManageVolumePrivilege	3764	powershell.exe
Token: 33	3764	powershell.exe
Token: 34	3764	powershell.exe
Token: 35	3764	powershell.exe
Token: 36	3764	powershell.exe
Token: SeIncreaseQuotaPrivilege	3764	powershell.exe
Token: SeSecurityPrivilege	3764	powershell.exe
Token: SeTakeOwnershipPrivilege	3764	powershell.exe
Token: SeLoadDriverPrivilege	3764	powershell.exe
Token: SeSystemProfilePrivilege	3764	powershell.exe
Token: SeSystemtimePrivilege	3764	powershell.exe
Token: SeProfSingleProcessPrivilege	3764	powershell.exe
Token: SeIncBasePriorityPrivilege	3764	powershell.exe
Token: SeCreatePagefilePrivilege	3764	powershell.exe
Token: SeBackupPrivilege	3764	powershell.exe
Token: SeRestorePrivilege	3764	powershell.exe
Token: SeShutdownPrivilege	3764	powershell.exe
Token: SeDebugPrivilege	3764	powershell.exe
Token: SeSystemEnvironmentPrivilege	3764	powershell.exe
Token: SeRemoteShutdownPrivilege	3764	powershell.exe
Token: SeUndockPrivilege	3764	powershell.exe
Token: SeManageVolumePrivilege	3764	powershell.exe
Token: 33	3764	powershell.exe
Token: 34	3764	powershell.exe
Token: 35	3764	powershell.exe
Token: 36	3764	powershell.exe
Token: SeIncreaseQuotaPrivilege	3764	powershell.exe
Token: SeSecurityPrivilege	3764	powershell.exe
Token: SeTakeOwnershipPrivilege	3764	powershell.exe
Token: SeLoadDriverPrivilege	3764	powershell.exe
Token: SeSystemProfilePrivilege	3764	powershell.exe
Token: SeSystemtimePrivilege	3764	powershell.exe
Token: SeProfSingleProcessPrivilege	3764	powershell.exe
Token: SeIncBasePriorityPrivilege	3764	powershell.exe
Token: SeCreatePagefilePrivilege	3764	powershell.exe
Token: SeBackupPrivilege	3764	powershell.exe
Token: SeRestorePrivilege	3764	powershell.exe
Token: SeShutdownPrivilege	3764	powershell.exe
Token: SeDebugPrivilege	3764	powershell.exe
Token: SeSystemEnvironmentPrivilege	3764	powershell.exe
Token: SeRemoteShutdownPrivilege	3764	powershell.exe
Token: SeUndockPrivilege	3764	powershell.exe
Token: SeManageVolumePrivilege	3764	powershell.exe
Token: 33	3764	powershell.exe
Token: 34	3764	powershell.exe
Token: 35	3764	powershell.exe
Token: 36	3764	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 4168	2028	wscript.EXE	98
PID 2028 wrote to memory of 4168	2028	wscript.EXE	98
PID 4168 wrote to memory of 3764	4168	cscript.exe	100
PID 4168 wrote to memory of 3764	4168	cscript.exe	100

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\pa collective agreement pay 48068.js"
1⤵
PID:4300

C:\Windows\system32\wscript.EXE
C:\Windows\system32\wscript.EXE COLLEG~1.JS
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\System32\cscript.exe
  "C:\Windows\System32\cscript.exe" "COLLEG~1.JS"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4168
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell
    3⤵
    - Blocklisted process makes network request
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cbn41las.5wr.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Adobe\COLLEG~1.JS

Filesize
2.5MB

MD5
f152d2a25e8cd509c04f7ab8117b87b4

SHA1
1bf75691bbee3b47d3af2e76fd4beb529c648b00

SHA256
fe8af72f17c31c23ad4e774aad16014f525c70b64f160692ba36fff8c052d577

SHA512
858fba3a3e26899228e00ebf1b6b2253d78c09676d277a8f92b36fc545bee3692572cb5b1a40a45ef6e622f526e5bfe0277e5977bc023a84c6c160f69a0616ac

Download Submit
memory/3764-18-0x0000021391BD0000-0x0000021391BE0000-memory.dmp

Filesize
64KB

Download
memory/3764-19-0x00000213AC8C0000-0x00000213AC8EA000-memory.dmp

Filesize
168KB

Download
memory/3764-14-0x00007FFF8DA30000-0x00007FFF8E4F1000-memory.dmp

Filesize
10.8MB

Download
memory/3764-16-0x0000021391BD0000-0x0000021391BE0000-memory.dmp

Filesize
64KB

Download
memory/3764-15-0x0000021391BD0000-0x0000021391BE0000-memory.dmp

Filesize
64KB

Download
memory/3764-17-0x00000213AC6E0000-0x00000213AC756000-memory.dmp

Filesize
472KB

Download
memory/3764-8-0x0000021391BE0000-0x0000021391C02000-memory.dmp

Filesize
136KB

Download
memory/3764-13-0x00000213AC610000-0x00000213AC654000-memory.dmp

Filesize
272KB

Download
memory/3764-20-0x00000213AC8C0000-0x00000213AC8E4000-memory.dmp

Filesize
144KB

Download
memory/3764-22-0x00007FFF8DA30000-0x00007FFF8E4F1000-memory.dmp

Filesize
10.8MB

Download
memory/3764-23-0x0000021391BD0000-0x0000021391BE0000-memory.dmp

Filesize
64KB

Download
memory/3764-24-0x0000021391BD0000-0x0000021391BE0000-memory.dmp

Filesize
64KB

Download
memory/3764-25-0x0000021391BD0000-0x0000021391BE0000-memory.dmp

Filesize
64KB

Download
memory/3764-26-0x0000021391BD0000-0x0000021391BE0000-memory.dmp

Filesize
64KB

Download
memory/3764-27-0x0000021391BD0000-0x0000021391BE0000-memory.dmp

Filesize
64KB

Download
memory/3764-28-0x0000021391BD0000-0x0000021391BE0000-memory.dmp

Filesize
64KB

Download