gootloader | d429010f33716072895b7a05c0559b474d26ab945a44be798ee3a98648408620

Analysis

max time kernel
149s
max time network
98s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 15:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmpjzdrmwed.js
Size 8.8MB
Sample260602-s9ecdshv7z
SHA256 d429010f33716072895b7a05c0559b474d26ab945a44be798ee3a98648408620
MD5 00292f0d5306d7af3cca60dbab62c9db
SHA1 c55d08e20cb92c08e2c821ae5a7b578d4e4d8928
SHA512 cbceecc97f67ddae93cb7c07b944d7b3b0489ecce46bb2b820b3e09169622c6837f8dcd85b7b043b0d7ded3b1cfe695f240b2b8554194f1178620a2842fc00c0
SSDEEP 49152:uytwpCQK+HMytwpCQK+HMytwpCQK+HMytwpCQK+HMytwpCQK+HMytwpCQK+HMytN:n
TLSH
T1B1962A5D7FF21122065771B64ABFA00AF2B98413941CD954F96CC3D02FE092986FBEE9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution gootloader loader persistence

Malware Config

Signatures

Family: GootLoader
JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.
loader gootloader
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3672	powershell.exe
3672	powershell.exe
3672	powershell.exe
3672	powershell.exe
3672	powershell.exe
3672	powershell.exe
3672	powershell.exe
3672	powershell.exe
3672	powershell.exe
3672	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3672	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2800 wrote to memory of 2700	2800	wscript.EXE	84
PID 2700 wrote to memory of 3672	2700	cscript.exe	86

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\tmpjzdrmwed.js
1⤵
PID:1680

C:\Windows\system32\wscript.exe
wscript
1⤵
PID:3568

C:\Windows\system32\wscript.EXE
C:\Windows\system32\wscript.EXE NEWSTO~1.JS
1⤵
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Windows\System32\cscript.exe
  "C:\Windows\System32\cscript.exe" "NEWSTO~1.JS"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2700
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_kypeky31.0dz.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kypeky31.0dz.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

NEWSTO~1.JS

Path C:\Users\Admin\AppData\Roaming\Adobe\NEWSTO~1.JS
Size 39.6MB
SHA256 1136f945ec682c1ab5c2766ee039d8c654c8dd4d021c9a982a905152be48ecda
MD5 c38b4c5868c475bb9f11cf1801215747
SHA1 3caecaae339eb419251396f1a3623943b7f0fb6e
SHA512 bfba1288198492a5fca435426f2defe9822bdf9473bdf9a149ddd4876d6e0171e6e92667f8453d005239eb936e28ce4d997e2a9e6e24ac715e4b890d932430d6
SSDEEP 6144:vSU1SU1SU1SU1SU1SU1SU1SU1SU1SU1SU1SU1SU1SU1SU1SU1SU1SU1SU1SU1SUV:J
TLSH
T195975BEDA6EAC07219C33260A2214D6AE625D4C4CED71220DC96FF497DDDD5C8A235F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3672-9-0x0000026856D30000-0x0000026856D52000-memory.dmp

Download

memory/3672-10-0x0000026870870000-0x00000268708B6000-memory.dmp

Download