gootloader | c3d9f7a1303c30f70fc683dc2ffd6177e47fa0b1f524ec24790c956a2df226d1

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 18:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c3d9f7a1303c30f70fc683dc2ffd6177e47fa0b1f524ec24790c956a2df226d1.js
Size

9.9MB
MD5

528045881d2bd02bc605bafd7217e4bc
SHA1

a029dfb91a872648ccc55b657c1a4099de672baa
SHA256

c3d9f7a1303c30f70fc683dc2ffd6177e47fa0b1f524ec24790c956a2df226d1
SHA512

4446ca5e1d15ec649ecc2fae2d7be9bab83bcc0efe8521aef64288b6e68843c96c6687dd979d9020e5062568e117f46a43f11a88aa970cd8fd25b95e80ee47de
SSDEEP

49152:1SytwpCQK+UTSytwpCQK+UTSytwpCQK+UTSytwpCQK+UTSytwpCQK+UTSytwpCQ8:R

Score

10^/10

gootloader execution loader

Malware Config

Signatures

GootLoader
JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.
loader gootloader
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

2708 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 2708 powershell.exe

pid	process
2708	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2708	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

taskeng.exewscript.EXEcscript.exe

description	pid	process	target process
PID 2608 wrote to memory of 2972	2608	taskeng.exe	wscript.EXE
PID 2608 wrote to memory of 2972	2608	taskeng.exe	wscript.EXE
PID 2608 wrote to memory of 2972	2608	taskeng.exe	wscript.EXE
PID 2972 wrote to memory of 2504	2972	wscript.EXE	cscript.exe
PID 2972 wrote to memory of 2504	2972	wscript.EXE	cscript.exe
PID 2972 wrote to memory of 2504	2972	wscript.EXE	cscript.exe
PID 2504 wrote to memory of 2708	2504	cscript.exe	powershell.exe
PID 2504 wrote to memory of 2708	2504	cscript.exe	powershell.exe
PID 2504 wrote to memory of 2708	2504	cscript.exe	powershell.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\c3d9f7a1303c30f70fc683dc2ffd6177e47fa0b1f524ec24790c956a2df226d1.js
1⤵
PID:1228

C:\Windows\system32\taskeng.exe
taskeng.exe {1EA95679-2645-4004-82C2-4AF400F02AA1} S-1-5-21-3452737119-3959686427-228443150-1000:QGTQZTRE\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2608

C:\Windows\system32\wscript.EXE
C:\Windows\system32\wscript.EXE INTELL~1.JS
2⤵
- Suspicious use of WriteProcessMemory
PID:2972

C:\Windows\System32\cscript.exe
"C:\Windows\System32\cscript.exe" "INTELL~1.JS"
3⤵
- Suspicious use of WriteProcessMemory
PID:2504

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2708

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\INTELL~1.JS
Filesize
41.2MB

MD5
7596ea9dc5f8b060c16fa702815d5b48

SHA1
ae60d29d8ec476b5cb21381316d69e516e5e78cd

SHA256
8548e66f56b8d4bc0f6a724ad954ba2e336b8e82d75a7a62eaf2134904ebdcab

SHA512
62d5a7e28dad745ce1a3dc16f32a65aaa00337b86dc5d8608f84f96ca7aecae91dcc51ef792ca6b0c479900e8504a59fb60129c05106d43825a5b5a3f840dc69

Download Submit
memory/2708-7-0x000000001B620000-0x000000001B902000-memory.dmp

Filesize
2.9MB

Download
memory/2708-8-0x0000000001F50000-0x0000000001F58000-memory.dmp

Filesize
32KB

Download