gootloader | 39e57f888df18a927d66ea343badddd691952fafa1625a01497be903de381750

General

Target

pa collective agreement pay 44189.js
Size

18.5MB
MD5

9a85a58f8b7f117cf590d03a2ff14b38
SHA1

c813b5ef1649cda4da12a2c2ada177756695549c
SHA256

39e57f888df18a927d66ea343badddd691952fafa1625a01497be903de381750
SHA512

03a7b10c5156d8643e8d84e9d7278658e9bf7dc01067d3cf649802da872bbd3f093bd9f9727a4ec4185a890ece15ab9e78b4258b5cba493fbb659baec8be9027
SSDEEP

49152:RU508dPXWR4ba/JOtdF5pHE2lsfiaahM3o43ORV59VDKtDOU508dPXWR4ba/JOtZ:5c43mPc43mPc43mPc43ml

Score

10^/10

gootloader execution loader

Malware Config

Signatures

GootLoader
JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.
loader gootloader

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

wscript.EXE

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	wscript.EXE

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

powershell.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	powershell.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

powershell.exe

pid	process
4736	powershell.exe
4736	powershell.exe
4736	powershell.exe
4736	powershell.exe
4736	powershell.exe
4736	powershell.exe
4736	powershell.exe
4736	powershell.exe
4736	powershell.exe
4736	powershell.exe
4736	powershell.exe
4736	powershell.exe
4736	powershell.exe
4736	powershell.exe
4736	powershell.exe
4736	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exe

description	pid	process
Token: SeDebugPrivilege	4736	powershell.exe
Token: SeIncreaseQuotaPrivilege	4736	powershell.exe
Token: SeSecurityPrivilege	4736	powershell.exe
Token: SeTakeOwnershipPrivilege	4736	powershell.exe
Token: SeLoadDriverPrivilege	4736	powershell.exe
Token: SeSystemProfilePrivilege	4736	powershell.exe
Token: SeSystemtimePrivilege	4736	powershell.exe
Token: SeProfSingleProcessPrivilege	4736	powershell.exe
Token: SeIncBasePriorityPrivilege	4736	powershell.exe
Token: SeCreatePagefilePrivilege	4736	powershell.exe
Token: SeBackupPrivilege	4736	powershell.exe
Token: SeRestorePrivilege	4736	powershell.exe
Token: SeShutdownPrivilege	4736	powershell.exe
Token: SeDebugPrivilege	4736	powershell.exe
Token: SeSystemEnvironmentPrivilege	4736	powershell.exe
Token: SeRemoteShutdownPrivilege	4736	powershell.exe
Token: SeUndockPrivilege	4736	powershell.exe
Token: SeManageVolumePrivilege	4736	powershell.exe
Token: 33	4736	powershell.exe
Token: 34	4736	powershell.exe
Token: 35	4736	powershell.exe
Token: 36	4736	powershell.exe
Token: SeIncreaseQuotaPrivilege	4736	powershell.exe
Token: SeSecurityPrivilege	4736	powershell.exe
Token: SeTakeOwnershipPrivilege	4736	powershell.exe
Token: SeLoadDriverPrivilege	4736	powershell.exe
Token: SeSystemProfilePrivilege	4736	powershell.exe
Token: SeSystemtimePrivilege	4736	powershell.exe
Token: SeProfSingleProcessPrivilege	4736	powershell.exe
Token: SeIncBasePriorityPrivilege	4736	powershell.exe
Token: SeCreatePagefilePrivilege	4736	powershell.exe
Token: SeBackupPrivilege	4736	powershell.exe
Token: SeRestorePrivilege	4736	powershell.exe
Token: SeShutdownPrivilege	4736	powershell.exe
Token: SeDebugPrivilege	4736	powershell.exe
Token: SeSystemEnvironmentPrivilege	4736	powershell.exe
Token: SeRemoteShutdownPrivilege	4736	powershell.exe
Token: SeUndockPrivilege	4736	powershell.exe
Token: SeManageVolumePrivilege	4736	powershell.exe
Token: 33	4736	powershell.exe
Token: 34	4736	powershell.exe
Token: 35	4736	powershell.exe
Token: 36	4736	powershell.exe
Token: SeIncreaseQuotaPrivilege	4736	powershell.exe
Token: SeSecurityPrivilege	4736	powershell.exe
Token: SeTakeOwnershipPrivilege	4736	powershell.exe
Token: SeLoadDriverPrivilege	4736	powershell.exe
Token: SeSystemProfilePrivilege	4736	powershell.exe
Token: SeSystemtimePrivilege	4736	powershell.exe
Token: SeProfSingleProcessPrivilege	4736	powershell.exe
Token: SeIncBasePriorityPrivilege	4736	powershell.exe
Token: SeCreatePagefilePrivilege	4736	powershell.exe
Token: SeBackupPrivilege	4736	powershell.exe
Token: SeRestorePrivilege	4736	powershell.exe
Token: SeShutdownPrivilege	4736	powershell.exe
Token: SeDebugPrivilege	4736	powershell.exe
Token: SeSystemEnvironmentPrivilege	4736	powershell.exe
Token: SeRemoteShutdownPrivilege	4736	powershell.exe
Token: SeUndockPrivilege	4736	powershell.exe
Token: SeManageVolumePrivilege	4736	powershell.exe
Token: 33	4736	powershell.exe
Token: 34	4736	powershell.exe
Token: 35	4736	powershell.exe
Token: 36	4736	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

wscript.EXEcscript.exe

description	pid	process	target process
PID 2108 wrote to memory of 4520	2108	wscript.EXE	cscript.exe
PID 2108 wrote to memory of 4520	2108	wscript.EXE	cscript.exe
PID 4520 wrote to memory of 4736	4520	cscript.exe	powershell.exe
PID 4520 wrote to memory of 4736	4520	cscript.exe	powershell.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\pa collective agreement pay 44189.js"
1⤵
PID:3680

C:\Windows\system32\wscript.EXE
C:\Windows\system32\wscript.EXE CUSTOM~1.JS
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2108

C:\Windows\System32\cscript.exe
"C:\Windows\System32\cscript.exe" "CUSTOM~1.JS"
2⤵
- Suspicious use of WriteProcessMemory
PID:4520

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell
3⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4736

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

JavaScript

1

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lpmv3cey.rbq.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\CUSTOM~1.JS
Filesize
40.4MB

MD5
44516882544e8625047d65e4e387558a

SHA1
b1b40ad6df4787e7b147c15574bfb942696d0806

SHA256
bf39eae265ae10f2ce2865e2f37172721164453111c068890bc94e3e5b07f204

SHA512
6968f62b1d14a87af37fbeb9a4356d734c103fb26d6a3d2949c42c44130d4a95585c80b25d012f529b0a05e9028df2f6cc8171b58f3e2fcaf5036513fff2bd73

Download Submit
memory/4736-4-0x00000135538D0000-0x00000135538F2000-memory.dmp

Filesize
136KB

Download
memory/4736-13-0x0000013555C00000-0x0000013555C44000-memory.dmp

Filesize
272KB

Download
memory/4736-14-0x0000013556050000-0x00000135560C6000-memory.dmp

Filesize
472KB

Download
memory/4736-15-0x0000013556290000-0x00000135562BA000-memory.dmp

Filesize
168KB

Download
memory/4736-16-0x0000013556290000-0x00000135562B4000-memory.dmp

Filesize
144KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads