gootloader | 10608406cf8f819b2b9deb339a9d1db16a770e6b257228dc9920f1b00207e923

Analysis

max time kernel
100s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09-10-2024 15:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

10608406cf8f819b2b9deb339a9d1db16a770e6b257228dc9920f1b00207e923N.js
Size

483KB
MD5

c26bc6518f47a63c4e419a8a68ce6e10
SHA1

4fcb47ae4ae3e131d5135b0d9900aaae1e65c4e9
SHA256

10608406cf8f819b2b9deb339a9d1db16a770e6b257228dc9920f1b00207e923
SHA512

f91d30aea3bbc8ced5e37040e267786ff406cd00284075de4210b81d32ba445bf3ab28b6bf4bd69445412200e684ae309b01282f8a63401529553ec39bfaf7a8
SSDEEP

6144:dQI3Z8ulahl4BhEfDdxe7RiagmdEiLAmWR64S4:JnhEfDdxeiagmdEiLAmWR6o

Score

10^/10

gootloader execution loader

Malware Config

Signatures

GootLoader
JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.
loader gootloader
Blocklisted process makes network request 4 IoCs

Processes:

wscript.exe

flow pid process

36 3340 wscript.exe
38 3340 wscript.exe
42 3340 wscript.exe
51 3340 wscript.exe
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

flow	pid	process
36	3340	wscript.exe
38	3340	wscript.exe
42	3340	wscript.exe
51	3340	wscript.exe

Script User-Agent 4 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	36	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	38	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	42	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	51	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\10608406cf8f819b2b9deb339a9d1db16a770e6b257228dc9920f1b00207e923N.js
1⤵
- Blocklisted process makes network request
PID:3340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads