gootloader | 960033ac1c00dcfdb15824bad9caa0628ef504f09a044f20e08811b43dea1a25

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 11:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
960033ac1c00dcfdb15824bad9caa0628ef504f09a044f20e08811b43dea1a25.js
Size 4.4MB
Sample240516-ngc7eaaa6x
SHA256 960033ac1c00dcfdb15824bad9caa0628ef504f09a044f20e08811b43dea1a25
MD5 9dd44659701cd13e09719a67063528d7
SHA1 fa4f5570342fc78eed41f57f842ad77902ea583d
SHA512 12d034ccc27bae909d6b2fe68467a98c42761808e4a4e09c2545edb56b99c496d13e527efda57e23de9b5cc4fd0ce74fa0cc7c8580b5990ad8a20ccac86bd1a2
SSDEEP 49152:UrytwpCQK+I2rytwpCQK+I2rytwpCQK+I2rytwpCQK+Ip:v
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gootloader execution loader

Malware Config

Signatures

GootLoader
JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.
loader gootloader
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1340	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1340	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 2308	1936	taskeng.exe	29
PID 1936 wrote to memory of 2308	1936	taskeng.exe	29
PID 1936 wrote to memory of 2308	1936	taskeng.exe	29
PID 2308 wrote to memory of 2428	2308	wscript.EXE	32
PID 2308 wrote to memory of 2428	2308	wscript.EXE	32
PID 2308 wrote to memory of 2428	2308	wscript.EXE	32
PID 2428 wrote to memory of 1340	2428	cscript.exe	34
PID 2428 wrote to memory of 1340	2428	cscript.exe	34
PID 2428 wrote to memory of 1340	2428	cscript.exe	34

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\960033ac1c00dcfdb15824bad9caa0628ef504f09a044f20e08811b43dea1a25.js
1⤵
PID:1732

C:\Windows\system32\taskeng.exe
taskeng.exe {721DFBAA-6DD8-4367-86FD-4C828C65D86D} S-1-5-21-481678230-3773327859-3495911762-1000:UIBNQNMA\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Windows\system32\wscript.EXE
  C:\Windows\system32\wscript.EXE WEBAPP~1.JS
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2308
- - C:\Windows\System32\cscript.exe
    "C:\Windows\System32\cscript.exe" "WEBAPP~1.JS"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2428
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WEBAPP~1.JS

Path C:\Users\Admin\AppData\Roaming\Mozilla\WEBAPP~1.JS
Size 42.0MB
SHA256 2b677398d6117383edfdb58262595c9b94cf1790cd78a393f1a764e7d778f60e
MD5 7896d53721f607a1f31afcd9f6fdb897
SHA1 e4cd28e49530c01a5b03b46d915741bd9079fec6
SHA512 939ae2c0c3408db700f50ee2fbc2f9e75591c388d6292c90240df074a30a2a8102abba201db0f58d1c803e6b032b0e85a19057f3cc3c445ac6c44421f72339ac
SSDEEP 12288:VooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooA:K
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1340-7-0x000000001B770000-0x000000001BA52000-memory.dmp

Download

memory/1340-8-0x0000000002240000-0x0000000002248000-memory.dmp

Download