gootloader | 3ff7002133b24cf5d0fc2ab6164bc3285e6aea09b35ab6a382af72d56abca6e0

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07/03/2025, 13:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

guarantor for rental agreement ontario 63415.js
Size

841KB
MD5

3dd58dbf8ad6e951b32428ea6c392162
SHA1

1b07118f9cbb86f42ea34020df4665d28683f934
SHA256

07f4d8779c73139723c8880cbd966154bdba4d8b45bf00578778f7500fc37333
SHA512

53ee7c2243aa09841371dd2c6d09ffd05e0567c44821008b389253b10cf1501622aab1b040f1bf39066d08b8597a12cc9430931dbdb7a88acfeebaf6c8618d02
SSDEEP

24576:ovCgo+ogQc5WfNnZmD/nq79qiJle69PGwWpyQTa+FNE3NEr:ovCgo+ogQc5WfNnZmD/nc9qiaGWpyQT3

Score

10^/10

gootloader execution loader

Malware Config

Signatures

GootLoader
JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.
loader gootloader
Gootloader family
gootloader
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2412	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2412	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2696 wrote to memory of 2600	2696	taskeng.exe	32
PID 2696 wrote to memory of 2600	2696	taskeng.exe	32
PID 2696 wrote to memory of 2600	2696	taskeng.exe	32
PID 2600 wrote to memory of 2592	2600	wscript.EXE	33
PID 2600 wrote to memory of 2592	2600	wscript.EXE	33
PID 2600 wrote to memory of 2592	2600	wscript.EXE	33
PID 2592 wrote to memory of 2412	2592	cscript.exe	35
PID 2592 wrote to memory of 2412	2592	cscript.exe	35
PID 2592 wrote to memory of 2412	2592	cscript.exe	35

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\guarantor for rental agreement ontario 63415.js"
1⤵
PID:2536

C:\Windows\system32\taskeng.exe
taskeng.exe {3DF6B257-1F14-44C4-85BD-44A13B3E7C91} S-1-5-21-2872745919-2748461613-2989606286-1000:CCJBVTGQ\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Windows\system32\wscript.EXE
  C:\Windows\system32\wscript.EXE LIVERT~1.JS
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2600
- - C:\Windows\System32\cscript.exe
    "C:\Windows\System32\cscript.exe" "LIVERT~1.JS"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2592
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Macromedia\LIVERT~1.JS

Filesize
39.9MB

MD5
be00e37c595506cc2ab7c6e56e3cb17e

SHA1
e2ec00d95e514caf0e8196b9819b27b34246f4b4

SHA256
2beb5f6dd4acb25a52a4d1d487606d0a7b469d45908ae4f7d8a3b1df1468dc40

SHA512
b82b7861eaf4f8666d8dd139a2fae5684474636b67032bed5b73476f289220b9006f7081c76647aa489a7886ff3ca0b6c2e14f541c868033eff73d8f175008a2

Download Submit
memory/2412-7-0x000000001B530000-0x000000001B812000-memory.dmp

Filesize
2.9MB

Download
memory/2412-8-0x0000000002810000-0x0000000002818000-memory.dmp

Filesize
32KB

Download