gootloader | 5f33086e8fca641e909feb0a5e3c8d12f2648c5b66ef8c4104ddd9fb1e13cf5d

Analysis

max time kernel
149s
max time network
93s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/05/2026, 03:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmpaqpzxfw8.js
Size 1.7MB
Sample260523-d4l3qaex6v
SHA256 5f33086e8fca641e909feb0a5e3c8d12f2648c5b66ef8c4104ddd9fb1e13cf5d
MD5 1e0cdd304697afdb18b534ade8835c1b
SHA1 54ec60d1b49dba582a1dcec5dbf7d425b17f3d8a
SHA512 8d12758fab876823a515353a7feacf4c2f3b7a8509811ea7017699f77f860f5cc9cc4165644b8ebd76271f0141720bf5ee5378dfd7f58c1409dc61c5240d32af
SSDEEP 12288:Sef4Ybhfw4Y/3z2z+FIE5AlQlDu90TsDJWx5u1xNydLpg8hC6gQl6GfwgqqQkv2N:Sezbhfj8AWHu1/wD5HroObm
TLSH
T12185B749FBD05101B867729D4E9F708EE17C501FB941AC88BD4CA8A43F9A22457EEF78
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution gootloader loader persistence

Malware Config

Signatures

Family: GootLoader
JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.
loader gootloader
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1060	powershell.exe
1060	powershell.exe
1060	powershell.exe
1060	powershell.exe
1060	powershell.exe
1060	powershell.exe
1060	powershell.exe
1060	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1060	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 6064 wrote to memory of 2792	6064	wscript.EXE	83
PID 2792 wrote to memory of 1060	2792	cscript.exe	85

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\tmpaqpzxfw8.js
1⤵
PID:4492

C:\Windows\system32\wscript.exe
wscript
1⤵
PID:4576

C:\Windows\system32\wscript.EXE
C:\Windows\system32\wscript.EXE PROSPE~1.JS
1⤵
- Suspicious use of WriteProcessMemory
PID:6064
- C:\Windows\System32\cscript.exe
  "C:\Windows\System32\cscript.exe" "PROSPE~1.JS"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2792
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_iv5dflo3.fax.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_iv5dflo3.fax.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

PROSPE~1.JS

Path C:\Users\Admin\AppData\Roaming\Sun\PROSPE~1.JS
Size 46.9MB
SHA256 c54b7e7b5d4bd7d12c8070960914b0e8821c34336af90155cd11ad85ec3a35fc
MD5 9429ade70205d0a19253e74526c18fca
SHA1 f95484e374282cacabf1258fab88549c192effbf
SHA512 da5be25ab1aa0641c5c88ec98d62182f689bb10bb753cf27152c8ed31f282d8da9ce38086fc00d2dd39b93ba12f54a3ff565d90ad7843ba064bef592b76d7ead
SSDEEP 6144:wL0L0L0L0L0L0L0L0L0L0L0L0L0L0L0L0L0L0L0L0L0L0L0L0L0L0L0L0L0L0L0Y:A
TLSH
T1B9B76CFEF1DAD07261DB39A4EB170439EA6188C186820255F3614F742A8FA1E0A5FDD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1060-9-0x00000236E0FC0000-0x00000236E0FE2000-memory.dmp

Download

memory/1060-10-0x00000236E1510000-0x00000236E1556000-memory.dmp

Download

memory/1060-11-0x00000236C7EF0000-0x00000236C89B2000-memory.dmp

Download

memory/1060-13-0x00000236C7EF0000-0x00000236C89B2000-memory.dmp

Download

memory/1060-14-0x00000236C7EF0000-0x00000236C89B2000-memory.dmp

Download

memory/1060-15-0x00000236C7EF0000-0x00000236C89B2000-memory.dmp

Download

memory/1060-16-0x00000236C7EF0000-0x00000236C89B2000-memory.dmp

Download