gootloader | db8d4db2a61b23914bc24bc2cef8aba013df1d0fc23d60fce7378ae22bfb26a7

Analysis

max time kernel
119s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14/11/2024, 10:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b868a88c78e8f58481cd319f15a4d64bd7610431eb90e2f0d9264889489cf973.js
Size

483KB
MD5

eac33be6bac86920722d19845e4819ad
SHA1

60e75ff64eb5ec43770cc8acb509eb97c23b1953
SHA256

b868a88c78e8f58481cd319f15a4d64bd7610431eb90e2f0d9264889489cf973
SHA512

214f603d8faafc2adfe732ae740722869782315ac24c23551cc52ceb1d37a9f242e85bc5368d9e4eb7f90eb26b96b7029d3bcccd4e38cbe10abb74f0c8235a2c
SSDEEP

6144:UQhZlvBulaxl4khEfD3xA7Biagmd4iLAmWR6GSF:f3hEfD3xeiagmd4iLAmWR6j

Score

10^/10

gootloader execution loader

Malware Config

Signatures

GootLoader
JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.
loader gootloader
Gootloader family
gootloader

Blocklisted process makes network request 4 IoCs

flow	pid	Process
34	2928	wscript.exe
42	2928	wscript.exe
44	2928	wscript.exe
48	2928	wscript.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Script User-Agent 4 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	48	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	34	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	42	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	44	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\b868a88c78e8f58481cd319f15a4d64bd7610431eb90e2f0d9264889489cf973.js
1⤵
- Blocklisted process makes network request
PID:2928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads