gootloader | 95ae75280d51130009fa5e1b468dfbf6dc8bb1e80d1e1c343892cf3950bfcd14

General

Target

call and put contracts 16318.js
Size

8.8MB
MD5

88ab74d84774855d0a2c24d5a1b50389
SHA1

83ce4e759d3443332eb223689717b4895bd4e6cc
SHA256

f8f3fa45eced0c32fbbf912f3f8ba6100a8b59e14f12a125c88340a47cf7e57b
SHA512

cf5adf3cb923ddb264b6f2182be043859c3c16544bbc2d3c01f0469ca6a25702ece7b140438928067226a334d88ac7567e808ecab5b97731678a2e948e399e87
SSDEEP

49152:kYytwpCQK+aGYytwpCQK+aGYytwpCQK+aGYytwpCQK+aGYytwpCQK+aGYytwpCQO:f

Score

10^/10

gootloader execution loader

Malware Config

Signatures

GootLoader
JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.
loader gootloader

Blocklisted process makes network request 55 IoCs

Processes:

powershell.exe

flow	pid	process
51	932	powershell.exe
69	932	powershell.exe
71	932	powershell.exe
73	932	powershell.exe
74	932	powershell.exe
76	932	powershell.exe
78	932	powershell.exe
79	932	powershell.exe
80	932	powershell.exe
82	932	powershell.exe
85	932	powershell.exe
88	932	powershell.exe
90	932	powershell.exe
92	932	powershell.exe
97	932	powershell.exe
99	932	powershell.exe
101	932	powershell.exe
103	932	powershell.exe
106	932	powershell.exe
108	932	powershell.exe
110	932	powershell.exe
112	932	powershell.exe
114	932	powershell.exe
115	932	powershell.exe
117	932	powershell.exe
119	932	powershell.exe
120	932	powershell.exe
121	932	powershell.exe
122	932	powershell.exe
123	932	powershell.exe
124	932	powershell.exe
125	932	powershell.exe
127	932	powershell.exe
130	932	powershell.exe
132	932	powershell.exe
135	932	powershell.exe
136	932	powershell.exe
137	932	powershell.exe
138	932	powershell.exe
139	932	powershell.exe
140	932	powershell.exe
141	932	powershell.exe
143	932	powershell.exe
145	932	powershell.exe
146	932	powershell.exe
147	932	powershell.exe
148	932	powershell.exe
149	932	powershell.exe
150	932	powershell.exe
151	932	powershell.exe
152	932	powershell.exe
153	932	powershell.exe
154	932	powershell.exe
156	932	powershell.exe
157	932	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

wscript.EXE

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	wscript.EXE

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

powershell.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exe

pid	process
932	powershell.exe
932	powershell.exe
932	powershell.exe
932	powershell.exe
932	powershell.exe
932	powershell.exe
932	powershell.exe
932	powershell.exe
932	powershell.exe
932	powershell.exe
932	powershell.exe
932	powershell.exe
932	powershell.exe
932	powershell.exe
932	powershell.exe
932	powershell.exe
932	powershell.exe
932	powershell.exe
932	powershell.exe
932	powershell.exe
932	powershell.exe
932	powershell.exe
932	powershell.exe
932	powershell.exe
932	powershell.exe
932	powershell.exe
932	powershell.exe
932	powershell.exe
932	powershell.exe
932	powershell.exe
932	powershell.exe
932	powershell.exe
932	powershell.exe
932	powershell.exe
932	powershell.exe
932	powershell.exe
932	powershell.exe
932	powershell.exe
932	powershell.exe
932	powershell.exe
932	powershell.exe
932	powershell.exe
932	powershell.exe
932	powershell.exe
932	powershell.exe
932	powershell.exe
932	powershell.exe
932	powershell.exe
932	powershell.exe
932	powershell.exe
932	powershell.exe
932	powershell.exe
932	powershell.exe
932	powershell.exe
932	powershell.exe
932	powershell.exe
932	powershell.exe
932	powershell.exe
932	powershell.exe
932	powershell.exe
932	powershell.exe
932	powershell.exe
932	powershell.exe
932	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exe

description	pid	process
Token: SeDebugPrivilege	932	powershell.exe
Token: SeIncreaseQuotaPrivilege	932	powershell.exe
Token: SeSecurityPrivilege	932	powershell.exe
Token: SeTakeOwnershipPrivilege	932	powershell.exe
Token: SeLoadDriverPrivilege	932	powershell.exe
Token: SeSystemProfilePrivilege	932	powershell.exe
Token: SeSystemtimePrivilege	932	powershell.exe
Token: SeProfSingleProcessPrivilege	932	powershell.exe
Token: SeIncBasePriorityPrivilege	932	powershell.exe
Token: SeCreatePagefilePrivilege	932	powershell.exe
Token: SeBackupPrivilege	932	powershell.exe
Token: SeRestorePrivilege	932	powershell.exe
Token: SeShutdownPrivilege	932	powershell.exe
Token: SeDebugPrivilege	932	powershell.exe
Token: SeSystemEnvironmentPrivilege	932	powershell.exe
Token: SeRemoteShutdownPrivilege	932	powershell.exe
Token: SeUndockPrivilege	932	powershell.exe
Token: SeManageVolumePrivilege	932	powershell.exe
Token: 33	932	powershell.exe
Token: 34	932	powershell.exe
Token: 35	932	powershell.exe
Token: 36	932	powershell.exe
Token: SeIncreaseQuotaPrivilege	932	powershell.exe
Token: SeSecurityPrivilege	932	powershell.exe
Token: SeTakeOwnershipPrivilege	932	powershell.exe
Token: SeLoadDriverPrivilege	932	powershell.exe
Token: SeSystemProfilePrivilege	932	powershell.exe
Token: SeSystemtimePrivilege	932	powershell.exe
Token: SeProfSingleProcessPrivilege	932	powershell.exe
Token: SeIncBasePriorityPrivilege	932	powershell.exe
Token: SeCreatePagefilePrivilege	932	powershell.exe
Token: SeBackupPrivilege	932	powershell.exe
Token: SeRestorePrivilege	932	powershell.exe
Token: SeShutdownPrivilege	932	powershell.exe
Token: SeDebugPrivilege	932	powershell.exe
Token: SeSystemEnvironmentPrivilege	932	powershell.exe
Token: SeRemoteShutdownPrivilege	932	powershell.exe
Token: SeUndockPrivilege	932	powershell.exe
Token: SeManageVolumePrivilege	932	powershell.exe
Token: 33	932	powershell.exe
Token: 34	932	powershell.exe
Token: 35	932	powershell.exe
Token: 36	932	powershell.exe
Token: SeIncreaseQuotaPrivilege	932	powershell.exe
Token: SeSecurityPrivilege	932	powershell.exe
Token: SeTakeOwnershipPrivilege	932	powershell.exe
Token: SeLoadDriverPrivilege	932	powershell.exe
Token: SeSystemProfilePrivilege	932	powershell.exe
Token: SeSystemtimePrivilege	932	powershell.exe
Token: SeProfSingleProcessPrivilege	932	powershell.exe
Token: SeIncBasePriorityPrivilege	932	powershell.exe
Token: SeCreatePagefilePrivilege	932	powershell.exe
Token: SeBackupPrivilege	932	powershell.exe
Token: SeRestorePrivilege	932	powershell.exe
Token: SeShutdownPrivilege	932	powershell.exe
Token: SeDebugPrivilege	932	powershell.exe
Token: SeSystemEnvironmentPrivilege	932	powershell.exe
Token: SeRemoteShutdownPrivilege	932	powershell.exe
Token: SeUndockPrivilege	932	powershell.exe
Token: SeManageVolumePrivilege	932	powershell.exe
Token: 33	932	powershell.exe
Token: 34	932	powershell.exe
Token: 35	932	powershell.exe
Token: 36	932	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

wscript.EXEcscript.exe

description	pid	process	target process
PID 5056 wrote to memory of 3140	5056	wscript.EXE	cscript.exe
PID 5056 wrote to memory of 3140	5056	wscript.EXE	cscript.exe
PID 3140 wrote to memory of 932	3140	cscript.exe	powershell.exe
PID 3140 wrote to memory of 932	3140	cscript.exe	powershell.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\call and put contracts 16318.js"
1⤵
PID:3780

C:\Windows\system32\wscript.EXE
C:\Windows\system32\wscript.EXE GLOBAL~1.JS
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5056

C:\Windows\System32\cscript.exe
"C:\Windows\System32\cscript.exe" "GLOBAL~1.JS"
2⤵
- Suspicious use of WriteProcessMemory
PID:3140

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell
3⤵
- Blocklisted process makes network request
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:932

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

JavaScript

1

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_krzzulji.ui1.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Sun\GLOBAL~1.JS
Filesize
43.3MB

MD5
4fa4b4d068f722cbfe719be7ab4c8c52

SHA1
1b7b04c22e9bf7075f9c8b6ba88effe50f42bfc5

SHA256
a92381a403a1463b64ebc547de7ec2a4225a7755d23c4e56503582b9cb33c3c8

SHA512
486b1fa557da6ee6ce601514d2682767d3350ffc66fbcf29b50aba6b19d30bd4027bb086dfa5f0599294f31fa16ad598df8ba4e4560ce8f042098ec6ef470643

Download Submit
memory/932-5-0x0000019E1C0F0000-0x0000019E1C112000-memory.dmp

Filesize
136KB

Download
memory/932-13-0x0000019E36BD0000-0x0000019E36C14000-memory.dmp

Filesize
272KB

Download
memory/932-14-0x0000019E36CA0000-0x0000019E36D16000-memory.dmp

Filesize
472KB

Download
memory/932-15-0x0000019E36F10000-0x0000019E36F3A000-memory.dmp

Filesize
168KB

Download
memory/932-16-0x0000019E36F10000-0x0000019E36F34000-memory.dmp

Filesize
144KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads