gootloader | 9c236eabb385b9402120bb087f0fbaa1b7ec11a897290ac6196d82197bd24ab0

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07-11-2024 14:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Vakhdevi Resume 2024.js
Size

281KB
MD5

bc7a790fcfdc9fe5301c6a15629f67e1
SHA1

2168bf3521db79257ccaa7a5e4dad89082a47107
SHA256

9c236eabb385b9402120bb087f0fbaa1b7ec11a897290ac6196d82197bd24ab0
SHA512

6f87dc8c1dc6c708f29f88723eeb4f193099e962ace3da35dbcd98d1b041d75640e32fc1a88aef0c8fe79760789f98dcd729f673855fd42a4333caeab59f5484
SSDEEP

6144:hap3Ih6nUcdCPxwldTjjt4OfR6tQQaAFmLEnJFZ8aKIDI1foATRZtr:h8lz4OfSGAFmz9j1foATtr

Score

10^/10

gootloader execution loader

Malware Config

Signatures

GootLoader
JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.
loader gootloader
Gootloader family
gootloader
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid	Process
1516	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description	pid	Process
Token: SeDebugPrivilege	1516	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

taskeng.exewscript.EXEcmd.execscript.exe

description	pid	Process	procid_target
PID 3060 wrote to memory of 2808	3060	taskeng.exe	32
PID 3060 wrote to memory of 2808	3060	taskeng.exe	32
PID 3060 wrote to memory of 2808	3060	taskeng.exe	32
PID 2808 wrote to memory of 2596	2808	wscript.EXE	33
PID 2808 wrote to memory of 2596	2808	wscript.EXE	33
PID 2808 wrote to memory of 2596	2808	wscript.EXE	33
PID 2596 wrote to memory of 2980	2596	cmd.exe	35
PID 2596 wrote to memory of 2980	2596	cmd.exe	35
PID 2596 wrote to memory of 2980	2596	cmd.exe	35
PID 2980 wrote to memory of 1516	2980	cscript.exe	36
PID 2980 wrote to memory of 1516	2980	cscript.exe	36
PID 2980 wrote to memory of 1516	2980	cscript.exe	36

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Vakhdevi Resume 2024.js"
1⤵
PID:2016

C:\Windows\system32\taskeng.exe
taskeng.exe {EFDDAEB0-E918-4199-B3FA-CA37C4D85D0A} S-1-5-21-3290804112-2823094203-3137964600-1000:VORHPBAB\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Windows\system32\wscript.EXE
  C:\Windows\system32\wscript.EXE DIGITA~1.JS
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2808
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c cScriPT "DIGITA~1.JS"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2596
  - - C:\Windows\system32\cscript.exe
      cScriPT "DIGITA~1.JS"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2980
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Mozilla\DIGITA~1.JS

Filesize
38.8MB

MD5
d4b3e1d0cfcb710863b1202ed8f2fd89

SHA1
35f6614437fd2aa34609280b699328720f1c6d86

SHA256
fbfb4a676c09566fa60e05cc51654d6de133aa8add30ae7dbfb1a20f95aeb16c

SHA512
c3ac56c12888c7849136d26f8ca23c812cae0ebcff3af1d8f7aa23a798c82b1f1e83d2e1a7602e3dd0e3f49e65dc498679ddbbdcdf64c37dac368630849b2625

Download Submit
memory/1516-10-0x000000001B650000-0x000000001B932000-memory.dmp

Filesize
2.9MB

Download
memory/1516-11-0x0000000001E00000-0x0000000001E08000-memory.dmp

Filesize
32KB

Download