gootloader | da8ab3b3e15f2d0119d79e7a0db25a0d15399a21186e5eea039a5f30547e59b4

Analysis

max time kernel
133s
max time network
131s
platform
windows10-1703_x64
resource
win10-20240214-en
resource tags

arch:x64arch:x86image:win10-20240214-enlocale:en-usos:windows10-1703-x64system
submitted
18/03/2024, 14:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
61b0b9be83f47f7691800f81208dbacdbabe49734d22ab889defccb87e2bd9b9.js
Size 840KB
Sample240318-rlg8psag77
SHA256 61b0b9be83f47f7691800f81208dbacdbabe49734d22ab889defccb87e2bd9b9
MD5 f48bef9e5bb14466f5fdefa019f1ca72
SHA1 d67335910dcbd1477d224f37464959e17c4c8e7a
SHA512 552288243eaa98e60915d637f0aa3ca8907b9fa5492ea2fcbc1af7ea4a926e1647db5a7c6c3987d1333708037be5d9f48005297c374da91d5785103c08a2c560
SSDEEP 24576:wKCgo+ogQc5WfNnZmD/nNZYqErPea8ToxxkWpyQTaSFNE3NEr:wKCgo+ogQc5WfNnZmD/nXYqEiP+kWpyK
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gootloader loader

Malware Config

Signatures

GootLoader
JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.
loader gootloader
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
3252	powershell.exe
3252	powershell.exe
3252	powershell.exe
3252	powershell.exe
3252	powershell.exe
3252	powershell.exe
3252	powershell.exe
3252	powershell.exe
3252	powershell.exe
3252	powershell.exe
3252	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3252	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 4836	2384	wscript.EXE	76
PID 2384 wrote to memory of 4836	2384	wscript.EXE	76
PID 4836 wrote to memory of 3252	4836	cscript.exe	78
PID 4836 wrote to memory of 3252	4836	cscript.exe	78

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\61b0b9be83f47f7691800f81208dbacdbabe49734d22ab889defccb87e2bd9b9.js
1⤵
PID:2724

\??\c:\windows\system32\wscript.EXE
c:\windows\system32\wscript.EXE PROTEI~1.JS
1⤵
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Windows\System32\cscript.exe
  "C:\Windows\System32\cscript.exe" "PROTEI~1.JS"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4836
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_qamsjuzc.sxi.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qamsjuzc.sxi.ps1
Size 1B
SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
MD5 c4ca4238a0b923820dcc509a6f75849b
SHA1 356a192b7913b04c54574d18c28d46e6395428ab
SHA512 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
MD5 SHA1 SHA512

Submit Download

PROTEI~1.JS

Path C:\Users\Admin\AppData\Roaming\Adobe\PROTEI~1.JS
Size 14.8MB
SHA256 3303af845f009202c774cbd2615586aed6922a5403a9c948496300911a8c5024
MD5 8a50374d30d593f279331b4d303c2689
SHA1 31a41c5d979e7742eb2e1bf5c0d516889759de4d
SHA512 f549f3fded8f6db3248711da7e22775eb6c730aa964eab703b7d3326b6b86113dc25e36716b83ebf094b39ebe841b2c04cd98465b6d6a3c9f14a786c02c47aa5
SSDEEP 98304:C22222222222222222222222222222222222222222222222222222222222222g:/
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3252-37-0x0000013B3BB50000-0x0000013B3BB8C000-memory.dmp

Download

memory/3252-9-0x0000013B3BBF0000-0x0000013B3BC00000-memory.dmp

Download

memory/3252-10-0x0000013B23660000-0x0000013B23682000-memory.dmp

Download

memory/3252-8-0x0000013B3BBF0000-0x0000013B3BC00000-memory.dmp

Download

memory/3252-7-0x00007FF9D8560000-0x00007FF9D8F4C000-memory.dmp

Download

memory/3252-48-0x0000013B3C1E0000-0x0000013B3C256000-memory.dmp

Download

memory/3252-57-0x0000013B3BBF0000-0x0000013B3BC00000-memory.dmp

Download

memory/3252-65-0x0000013B3BBF0000-0x0000013B3BC00000-memory.dmp

Download

memory/3252-97-0x00007FF9D8560000-0x00007FF9D8F4C000-memory.dmp

Download

memory/3252-98-0x0000013B3BBF0000-0x0000013B3BC00000-memory.dmp

Download

memory/3252-99-0x0000013B3BBF0000-0x0000013B3BC00000-memory.dmp

Download

memory/3252-132-0x0000013B3BBF0000-0x0000013B3BC00000-memory.dmp

Download

memory/3252-133-0x0000013B3BBF0000-0x0000013B3BC00000-memory.dmp

Download