gootloader | 9c236eabb385b9402120bb087f0fbaa1b7ec11a897290ac6196d82197bd24ab0

Analysis

max time kernel
114s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
08-11-2024 03:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9c236eabb385b9402120bb087f0fbaa1b7ec11a897290ac6196d82197bd24ab0.js
Size

281KB
MD5

bc7a790fcfdc9fe5301c6a15629f67e1
SHA1

2168bf3521db79257ccaa7a5e4dad89082a47107
SHA256

9c236eabb385b9402120bb087f0fbaa1b7ec11a897290ac6196d82197bd24ab0
SHA512

6f87dc8c1dc6c708f29f88723eeb4f193099e962ace3da35dbcd98d1b041d75640e32fc1a88aef0c8fe79760789f98dcd729f673855fd42a4333caeab59f5484
SSDEEP

6144:hap3Ih6nUcdCPxwldTjjt4OfR6tQQaAFmLEnJFZ8aKIDI1foATRZtr:h8lz4OfSGAFmz9j1foATtr

Score

10^/10

gootloader execution loader

Malware Config

Signatures

GootLoader
JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.
loader gootloader
Gootloader family
gootloader
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid	Process
1180	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description	pid	Process
Token: SeDebugPrivilege	1180	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

taskeng.exewscript.EXEcmd.execscript.exe

description	pid	Process	procid_target
PID 2792 wrote to memory of 112	2792	taskeng.exe	30
PID 2792 wrote to memory of 112	2792	taskeng.exe	30
PID 2792 wrote to memory of 112	2792	taskeng.exe	30
PID 112 wrote to memory of 1500	112	wscript.EXE	31
PID 112 wrote to memory of 1500	112	wscript.EXE	31
PID 112 wrote to memory of 1500	112	wscript.EXE	31
PID 1500 wrote to memory of 3064	1500	cmd.exe	33
PID 1500 wrote to memory of 3064	1500	cmd.exe	33
PID 1500 wrote to memory of 3064	1500	cmd.exe	33
PID 3064 wrote to memory of 1180	3064	cscript.exe	34
PID 3064 wrote to memory of 1180	3064	cscript.exe	34
PID 3064 wrote to memory of 1180	3064	cscript.exe	34

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\9c236eabb385b9402120bb087f0fbaa1b7ec11a897290ac6196d82197bd24ab0.js
1⤵
PID:2336

C:\Windows\system32\taskeng.exe
taskeng.exe {D09EBAF6-F40C-453B-A096-888BB2122C95} S-1-5-21-3692679935-4019334568-335155002-1000:BCXRJFKE\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Windows\system32\wscript.EXE
  C:\Windows\system32\wscript.EXE DIGITA~1.JS
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:112
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c cScriPT "DIGITA~1.JS"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1500
  - - C:\Windows\system32\cscript.exe
      cScriPT "DIGITA~1.JS"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3064
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Mozilla\DIGITA~1.JS

Filesize
38.8MB

MD5
d4b3e1d0cfcb710863b1202ed8f2fd89

SHA1
35f6614437fd2aa34609280b699328720f1c6d86

SHA256
fbfb4a676c09566fa60e05cc51654d6de133aa8add30ae7dbfb1a20f95aeb16c

SHA512
c3ac56c12888c7849136d26f8ca23c812cae0ebcff3af1d8f7aa23a798c82b1f1e83d2e1a7602e3dd0e3f49e65dc498679ddbbdcdf64c37dac368630849b2625

Download Submit
memory/1180-10-0x000000001B3F0000-0x000000001B6D2000-memory.dmp

Filesize
2.9MB

Download
memory/1180-11-0x0000000002290000-0x0000000002298000-memory.dmp

Filesize
32KB

Download