gootloader | 755618e7ea05f85de857743d10cdf95bb3c09529b40ec5b430faa0db982aca94

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
17-08-2024 12:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

755618e7ea05f85de857743d10cdf95bb3c09529b40ec5b430faa0db982aca94.js
Size

19.8MB
MD5

1dabc0ec28edb2de81fb7cfdad33ba70
SHA1

5c09c537cc273b0abb16b0ea8183f40a53ebe57a
SHA256

755618e7ea05f85de857743d10cdf95bb3c09529b40ec5b430faa0db982aca94
SHA512

00d954d1b35e1a2bef5918e3083c509bcbf43f463d0c04aec2fc5c8cc685b58a6ac36327d4c14450266f8e3862852c4d52700ca318dca2c982b2a3d3b4d0a1fd
SSDEEP

49152:e+GH+R4FbEc6GhQj579l+4SSNRLFjzW03NZPn3SbYmGBl+Kn8P4BlwUC3kiQijs7:Z3k3k3k3k3k3k3k3K

Score

10^/10

gootloader execution loader

Malware Config

Signatures

GootLoader
JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.
loader gootloader
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid	Process
2728	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description	pid	Process
Token: SeDebugPrivilege	2728	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

taskeng.exewscript.EXEcscript.exe

description	pid	Process	procid_target
PID 2584 wrote to memory of 2476	2584	taskeng.exe	31
PID 2584 wrote to memory of 2476	2584	taskeng.exe	31
PID 2584 wrote to memory of 2476	2584	taskeng.exe	31
PID 2476 wrote to memory of 2976	2476	wscript.EXE	32
PID 2476 wrote to memory of 2976	2476	wscript.EXE	32
PID 2476 wrote to memory of 2976	2476	wscript.EXE	32
PID 2976 wrote to memory of 2728	2976	cscript.exe	34
PID 2976 wrote to memory of 2728	2976	cscript.exe	34
PID 2976 wrote to memory of 2728	2976	cscript.exe	34

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\755618e7ea05f85de857743d10cdf95bb3c09529b40ec5b430faa0db982aca94.js
1⤵
PID:3032

C:\Windows\system32\taskeng.exe
taskeng.exe {20238E82-02C3-41EC-89D5-50EC74BB5C97} S-1-5-21-3434294380-2554721341-1919518612-1000:ELZYPTFV\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2584
- C:\Windows\system32\wscript.EXE
  C:\Windows\system32\wscript.EXE SPONSO~1.JS
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2476
- - C:\Windows\System32\cscript.exe
    "C:\Windows\System32\cscript.exe" "SPONSO~1.JS"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2976
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\SPONSO~1.JS

Filesize
46.0MB

MD5
cfb6843a5aa189d4b9716a595a6af70f

SHA1
98d00922e0b1f79ea24fe6d5128528cc3873a1ef

SHA256
98b7c95fec3e0ec8f85706c5e71351a0c04979c54da52e40ec4f8620bb216d0f

SHA512
d4dbd83e42faf9374373aad51d94f3f51ab90da3d24d93f34e793b33dff20df27cace285846743267f854b9a09d8b29ee8f0bfd9f46581ffb26200ce5b623216

Download Submit
memory/2728-7-0x000000001B7E0000-0x000000001BAC2000-memory.dmp

Filesize
2.9MB

Download
memory/2728-8-0x0000000001E00000-0x0000000001E08000-memory.dmp

Filesize
32KB

Download