gootloader | 355893759803e5af9b4a891b879d46731ae0c2db8e18f5640f659e83a36d515b

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
31/05/2024, 13:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
355893759803e5af9b4a891b879d46731ae0c2db8e18f5640f659e83a36d515b.js
Size 5.5MB
Sample240531-qymtaaba39
SHA256 355893759803e5af9b4a891b879d46731ae0c2db8e18f5640f659e83a36d515b
MD5 43ee65fc654fff1170650c70f17d1c66
SHA1 6f2097bb5c59f507b6667d61e24d0456372b2ec1
SHA512 52736248ac81d9d0248b9e900d02a4752ee6cf7487eedbcc8e5d8af81fc1f3b7a5831c84417cfb02404c4abac146bcbc6097908ccb23e316302360a9cf81d533
SSDEEP 49152:iytwpCQK+7YytwpCQK+7YytwpCQK+7YytwpCQK+7YytwpCQK+7p:K
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gootloader execution loader

Malware Config

Signatures

GootLoader
JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.
loader gootloader
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2752	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2752	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 2540	2468	taskeng.exe	31
PID 2468 wrote to memory of 2540	2468	taskeng.exe	31
PID 2468 wrote to memory of 2540	2468	taskeng.exe	31
PID 2540 wrote to memory of 1532	2540	wscript.EXE	32
PID 2540 wrote to memory of 1532	2540	wscript.EXE	32
PID 2540 wrote to memory of 1532	2540	wscript.EXE	32
PID 1532 wrote to memory of 2752	1532	cscript.exe	34
PID 1532 wrote to memory of 2752	1532	cscript.exe	34
PID 1532 wrote to memory of 2752	1532	cscript.exe	34

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\355893759803e5af9b4a891b879d46731ae0c2db8e18f5640f659e83a36d515b.js
1⤵
PID:1932

C:\Windows\system32\taskeng.exe
taskeng.exe {3C2FC400-0A01-4AA1-91DA-63D3120F6300} S-1-5-21-3691908287-3775019229-3534252667-1000:UOTHCPHQ\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Windows\system32\wscript.EXE
  C:\Windows\system32\wscript.EXE PROTEI~1.JS
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2540
- - C:\Windows\System32\cscript.exe
    "C:\Windows\System32\cscript.exe" "PROTEI~1.JS"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1532
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

PROTEI~1.JS

Path C:\Users\Admin\AppData\Roaming\Microsoft\PROTEI~1.JS
Size 40.4MB
SHA256 990c2baa7682d3d82e381073d6863b253de016e463d187c33b47eb640403bf24
MD5 c6a273b19e10310450e4713dc8771496
SHA1 d4382e603518d25dfe60a31c0a025cb4c3ba6d77
SHA512 a342c8e308f1ec111816bf1d66b931b6c27c05f7501c9cd6164b1f1fbe930a6f8e8df92f0dd61a1ff620cdd7fbabed8d4820b88960d974dd0747a2480fa3bbb6
SSDEEP 3072:34n4n4n4n4n4n4n4n4n4n4n4n4n4n4n4n4n4n4n4n4n4n4n4n4n4n4n4n4n4n4n/:I
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2752-7-0x000000001B670000-0x000000001B952000-memory.dmp

Download

memory/2752-8-0x0000000002890000-0x0000000002898000-memory.dmp

Download