gootloader | 0c71b32d1c629ae6e7a05b8919436c09f46aa7195af3efccc8f4863637b5450f

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 15:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmp1iy8afcl.js
Size 23.2MB
Sample260602-sxt73sas9r
SHA256 0c71b32d1c629ae6e7a05b8919436c09f46aa7195af3efccc8f4863637b5450f
MD5 e394576835ce6bdaa8f58d2f0b8162bd
SHA1 b96db5850314d7e347d524d1fb1fbea6d280986e
SHA512 328ee5cc9fa174f344f8a908a8df3f4da35a94347c34fe6a998030d6232ec5d497d8807df782c0f3a35e350f5f17bc80e8f28102385b681a5803647f54e2df59
SSDEEP 49152:wY+08dPXWR4ba/JOtdF5pHE2lsfiaahM3o43ORV59VDKtDbY+08dPXWR4ba/JOtE:zc43mNc43mNc43mNc43mNc43ml
TLSH
T1AB37A2E9FFD52062B622726E5F5FB14AB33880175A49DC907C0CD4647B54B2883F9BE8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution gootloader loader persistence

Malware Config

Signatures

Family: GootLoader
JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.
loader gootloader
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2152	powershell.exe
2152	powershell.exe
2152	powershell.exe
2152	powershell.exe
2152	powershell.exe
2152	powershell.exe
2152	powershell.exe
2152	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2152	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3164 wrote to memory of 4820	3164	wscript.EXE	83
PID 4820 wrote to memory of 2152	4820	cscript.exe	85

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\tmp1iy8afcl.js
1⤵
PID:3196

C:\Windows\system32\wscript.exe
wscript
1⤵
PID:788

C:\Windows\system32\wscript.EXE
C:\Windows\system32\wscript.EXE PERFOR~1.JS
1⤵
- Suspicious use of WriteProcessMemory
PID:3164
- C:\Windows\System32\cscript.exe
  "C:\Windows\System32\cscript.exe" "PERFOR~1.JS"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4820
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_ogq245qf.e2z.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ogq245qf.e2z.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

PERFOR~1.JS

Path C:\Users\Admin\AppData\Roaming\Mozilla\PERFOR~1.JS
Size 45.4MB
SHA256 aaf906d37843848f16aa23b77baefc4c27c22bcb5c9fbec7c281299a2ca429e3
MD5 72e815fdf4b3ea4e982f15130c780f96
SHA1 6d7eec97fdfcda757fb128c0c24eb5892e73fb7a
SHA512 6821b04f47b9fba35f21e0da63b06e9f4c6f2ebb869b072de6c2d8efb98744cd557d097be2e4b452388b5e9a7ded60064041f247a80c99551e2f87e9a019951c
SSDEEP 196608:Vwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwd:7
TLSH
T187A76CFCB1DEE1375AC2F6A807590C66D71954F093EA22585B50EB7038CEB1D062BDAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2152-9-0x00000245B1EB0000-0x00000245B1ED2000-memory.dmp

Download

memory/2152-10-0x00000245B4DB0000-0x00000245B4DF6000-memory.dmp

Download