gootloader | d5f002f72d7727b2f4f862f7c1c110c40e83fb6d955b57d538b2a9c792f3db43

General

Target
tmp8e2qiaqn.js
Size 483KB
Sample260523-ehdd5ae14x
SHA256 d5f002f72d7727b2f4f862f7c1c110c40e83fb6d955b57d538b2a9c792f3db43
MD5 9fed4cdbb7eb659411081b724af1d526
SHA1 5fc431d3a90e8356a4ca2f0b04ff5eaab21f58b2
SHA512 63717d2fa15c30cb1fcc927ab526b1e2e552bf50024c5b6560ff8391b79c7bbe12e01c0abb230f4d6427474557a2628b2cdd1078c8ac983c96637cdec4554118
SSDEEP 6144:GQZmSuulaxl4khEfD3xA7Wiagmd4iLAmW46jSF:XChEfD3xviagmd4iLAmW46w
TLSH
T135B4A40EABEB3326C52371799F5F9004A535840B661AEC1D7D4C93880F5863D9ABBFE4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution gootloader loader spyware trojan

Malware Config

Signatures

Family: GootLoader
JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.
loader gootloader

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
26	2668	wscript.exe
28	2668	wscript.exe
30	2668	wscript.exe
32	2668	wscript.exe
36	2668	wscript.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\EC86C353D7ACB54DE76F11647914E8F384C5E6A3	wscript.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\EC86C353D7ACB54DE76F11647914E8F384C5E6A3\Blob = 030000000100000014000000ec86c353d7acb54de76f11647914e8f384c5e6a3140000000100000014000000050054ec10aa7ec0bcfae8e8faf4ca5a756a633b0400000001000000100000008f5ebf48e443f516cc9f670129e83a960f00000001000000300000004532f606268a8ed6a08f5c2201e6598ecf441c433237d7ac6922b59214fc298472b32ac5ca3b95cf08f1f388226295011900000001000000100000003c31749fc7e7b153defc2881857af4ac5c0000000100000004000000000c0000180000000100000010000000ea6089055218053dd01e37e1d806eedf2000000001000000650600003082066130820449a00302010202105d6cd94be7fe0ed6a546901329bde49c300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3233303830323030303030305a170d3333303830313233353935395a305c310b30090603550406130255533121301f060355040a13184e6574776f726b20536f6c7574696f6e73204c2e4c2e432e312a3028060355040313214e6574776f726b20536f6c7574696f6e73205253412044562053534c2043412033308201a2300d06092a864886f70d01010105000382018f003082018a0282018100840fa97c3a1355c41420649ccd2d2b9eae02dc764bc6064cc22b7f8d78e921d90e791c8cd08467c8ac6ce23195ceec6c769573d8265560bb819732006120335ca7a5fe53bcfc40435d7c772a116716c93c43c63d2dce87243f916e4b1f9fc7e67cdd2687f22351661b598f1c14b22fdb2a1d94cfde97f99980d03b6563660b4c0369c582319b3ae965eedb70f838f2b2973bcf60f065086ee3c1eee4304419794d82c52938fe1634d374d137595e1587570b1a3709133755aab3a72138cd9cab3f65228fd2eb192ecadb3c13c375bcd58e65ff9c2814cf90329059bf62d8fde555e2267d8df7f770d6fb36a93a8aacea8c351bb556fec051aecc2dc1034d35faa72b221d925df40be769c155e2478922afd27ae37abc0575cf279ceb3d453a0eeccb9f5e1f50b22d32980569ba5fb5a568323c6c5e8d99fd26e399ad037154f92c5869f45f5119125cde97ceb8d71ecb6445edb7b41ac776b8b28f15e5eb920223aedeb3367d6e630cb96745f02a822b1159d25b053a07b937a920fec27a09890203010001a38201703082016c301f0603551d230418301680145379bf5aaa2b4acf5480e1d89bc09df2b20366cb301d0603551d0e04160414050054ec10aa7ec0bcfae8e8faf4ca5a756a633b300e0603551d0f0101ff04040302018630120603551d130101ff040830060101ff020100301d0603551d250416301406082b0601050507030106082b0601050507030230220603551d20041b3019300d060b2b06010401b231010202043008060667810c01020130500603551d1f044930473045a043a041863f687474703a2f2f63726c2e7573657274727573742e636f6d2f55534552547275737452534143657274696669636174696f6e417574686f726974792e63726c307106082b0601050507010104653063303a06082b06010505073002862e687474703a2f2f6372742e7573657274727573742e636f6d2f55534552547275737452534141414143412e637274302506082b060105050730018619687474703a2f2f6f6373702e7573657274727573742e636f6d300d06092a864886f70d01010c0500038202010066b2aa695d6528074c4c1128b12de257f912d750822612214e900d341e32ea80b71c2b18d80dbd045850f85678caa88d5118d945937b5a97daf332f9f22226e7a65840639f65e1e8dab5e6b5063a323eca159801e238cdf039f3770de1cc399fdafb4e1a2e164877ddaef00148957b13707fdc31c22c12108591ede7cc4c87ca525589430ad7b620de191ab83a470eec35e9219de99fe23add56f0dac5dcf5af500b7b245962fc3f354a40ed1fd709c42f6599bd62f3a9421a176edc27c9da9c4577cfc528627975d2a36f3f8a869bf2285222e37d9fc14afd27ae2896730b1e1b3e4bd01affb55b603d5f365c7c9135d34472baa548c141042ff56010d9d5b7198a4449786af76856edb720de9b829ee67463b64171e59c28a1990d50da3bc50ad34388cd656e6b74bd1c5243df1eaf200436eed84631d9751b944087ee4d3bb2fb3ed47ab60d255a5584d1b8e18c645f5857f9ae999466289de9c670e31489eb9bf14e7ec0e61a2fed0c7c404aa305df775dcb4d408b1eeb643944389e678b76bc76278d043c4b4f14f6b7bee7882a2ad8a4932a7b92fa8b9d51c4c5889ed73dc9632df2f93870fb9d2df007fb505443c10dd70618e493205d0de0322779a110027e0f93d4cd2a4aa47ae8a69be4a0348b1b892ebf121929502be396714cf1d8b19b07b157f05b0f653244f5b028b6756f965a6be1cdd2144ce784a4f84846	wscript.exe

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	26	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	28	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\tmp8e2qiaqn.js
1⤵
- Badlisted process makes network request
- Modifies system certificate store
PID:2668