gootloader | 634a0445dadb743f7aeba2ae1e21b5fbbdc0f97b8dee7c05956af13b9b71a20f

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11-10-2024 15:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

where_are_billing_agreements_in_paypal44719.js
Size

9.0MB
MD5

a0d20f1a37a1a6cf597fb88b46d3adb6
SHA1

32d273e782822067a59da5233f81fea827f7a3d6
SHA256

634a0445dadb743f7aeba2ae1e21b5fbbdc0f97b8dee7c05956af13b9b71a20f
SHA512

eee428877297df38e8fe3468e7da8640887d291b43ae2cc2beaec239e31dc6aa18d849b7fd50b067a02d79d53041864d57d1e4f11a198e1543c474290886853d
SSDEEP

49152:cvcjJPV9ivcjJPV9ivcjJPV9ivcjJPV9ivcjJPV9ivcjJPV9ivcjJPV9l:fPVbPVbPVbPVbPVbPVbPVD

Score

10^/10

gootloader execution loader

Malware Config

Signatures

GootLoader
JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.
loader gootloader
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1572	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1572	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 2680	2692	taskeng.exe	32
PID 2692 wrote to memory of 2680	2692	taskeng.exe	32
PID 2692 wrote to memory of 2680	2692	taskeng.exe	32
PID 2680 wrote to memory of 2564	2680	wscript.EXE	33
PID 2680 wrote to memory of 2564	2680	wscript.EXE	33
PID 2680 wrote to memory of 2564	2680	wscript.EXE	33
PID 2564 wrote to memory of 1572	2564	cscript.exe	35
PID 2564 wrote to memory of 1572	2564	cscript.exe	35
PID 2564 wrote to memory of 1572	2564	cscript.exe	35

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\where_are_billing_agreements_in_paypal44719.js
1⤵
PID:276

C:\Windows\system32\taskeng.exe
taskeng.exe {9580696D-811A-4EEE-8787-9CB34C360840} S-1-5-21-3063565911-2056067323-3330884624-1000:KHBTHJFA\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Windows\system32\wscript.EXE
  C:\Windows\system32\wscript.EXE FREEDO~1.JS
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2680
- - C:\Windows\System32\cscript.exe
    "C:\Windows\System32\cscript.exe" FREEDO~1.JS
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2564
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Mozilla\FREEDO~1.JS

Filesize
38.9MB

MD5
712ed6d4a7d5c92a4db039462484091f

SHA1
4fb2a7bd32e0dead1932f31576f9fbc897a0588e

SHA256
04cd92c15c9f5cb00b8a96a5695d39031957c0e621277caa512242556b039ec9

SHA512
8813ce5cf49d91616c78b82aedd6aae59b43795a60c0ac39eebe8bea0a17faf1da5c69d0046693472bbde151595fcce85c6f7b21e6ce98c36a7fc832c31487d5

Download Submit
memory/1572-7-0x000000001B680000-0x000000001B962000-memory.dmp

Filesize
2.9MB

Download
memory/1572-8-0x0000000001D90000-0x0000000001D98000-memory.dmp

Filesize
32KB

Download