gootloader | a3a0e7bea2365c2ab8349cdf68d1f7b21d039d1f4f9cb1e5da8da89ff2260511

General

Target
tmpwznx2js3.js
Size 483KB
Sample260609-sdzcpads5k
SHA256 a3a0e7bea2365c2ab8349cdf68d1f7b21d039d1f4f9cb1e5da8da89ff2260511
MD5 37cc5b3e3b1d41b517ed5d3afccde9f3
SHA1 a4122f73a1ac35bf37e5cf445deb623515129969
SHA512 9a015f4683aba4a4712f932083dcb777ae874eba82f2c91ceea4a3d02e37001b3516cfb9fd3fac4db60854ce62ba6867449d51bd2f75736826506ad68379d237
SSDEEP 6144:iQSfSzulaxl4khEfDLxAtWiagmd4iLAmW667SF:xBhEfDLxviagmd4iLAmW66Y
TLSH
T1EBB4A40EABEB3326C52371799F5F9004A535840B661AEC1D7D4C93880F5863D9ABBFE4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution gootloader loader spyware trojan

Malware Config

Signatures

Family: GootLoader
JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.
loader gootloader

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
68	1588	wscript.exe
70	1588	wscript.exe
72	1588	wscript.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\EC86C353D7ACB54DE76F11647914E8F384C5E6A3	wscript.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\EC86C353D7ACB54DE76F11647914E8F384C5E6A3\Blob = 030000000100000014000000ec86c353d7acb54de76f11647914e8f384c5e6a3140000000100000014000000050054ec10aa7ec0bcfae8e8faf4ca5a756a633b0400000001000000100000008f5ebf48e443f516cc9f670129e83a960f00000001000000300000004532f606268a8ed6a08f5c2201e6598ecf441c433237d7ac6922b59214fc298472b32ac5ca3b95cf08f1f388226295011900000001000000100000003c31749fc7e7b153defc2881857af4ac5c0000000100000004000000000c0000180000000100000010000000ea6089055218053dd01e37e1d806eedf2000000001000000650600003082066130820449a00302010202105d6cd94be7fe0ed6a546901329bde49c300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3233303830323030303030305a170d3333303830313233353935395a305c310b30090603550406130255533121301f060355040a13184e6574776f726b20536f6c7574696f6e73204c2e4c2e432e312a3028060355040313214e6574776f726b20536f6c7574696f6e73205253412044562053534c2043412033308201a2300d06092a864886f70d01010105000382018f003082018a0282018100840fa97c3a1355c41420649ccd2d2b9eae02dc764bc6064cc22b7f8d78e921d90e791c8cd08467c8ac6ce23195ceec6c769573d8265560bb819732006120335ca7a5fe53bcfc40435d7c772a116716c93c43c63d2dce87243f916e4b1f9fc7e67cdd2687f22351661b598f1c14b22fdb2a1d94cfde97f99980d03b6563660b4c0369c582319b3ae965eedb70f838f2b2973bcf60f065086ee3c1eee4304419794d82c52938fe1634d374d137595e1587570b1a3709133755aab3a72138cd9cab3f65228fd2eb192ecadb3c13c375bcd58e65ff9c2814cf90329059bf62d8fde555e2267d8df7f770d6fb36a93a8aacea8c351bb556fec051aecc2dc1034d35faa72b221d925df40be769c155e2478922afd27ae37abc0575cf279ceb3d453a0eeccb9f5e1f50b22d32980569ba5fb5a568323c6c5e8d99fd26e399ad037154f92c5869f45f5119125cde97ceb8d71ecb6445edb7b41ac776b8b28f15e5eb920223aedeb3367d6e630cb96745f02a822b1159d25b053a07b937a920fec27a09890203010001a38201703082016c301f0603551d230418301680145379bf5aaa2b4acf5480e1d89bc09df2b20366cb301d0603551d0e04160414050054ec10aa7ec0bcfae8e8faf4ca5a756a633b300e0603551d0f0101ff04040302018630120603551d130101ff040830060101ff020100301d0603551d250416301406082b0601050507030106082b0601050507030230220603551d20041b3019300d060b2b06010401b231010202043008060667810c01020130500603551d1f044930473045a043a041863f687474703a2f2f63726c2e7573657274727573742e636f6d2f55534552547275737452534143657274696669636174696f6e417574686f726974792e63726c307106082b0601050507010104653063303a06082b06010505073002862e687474703a2f2f6372742e7573657274727573742e636f6d2f55534552547275737452534141414143412e637274302506082b060105050730018619687474703a2f2f6f6373702e7573657274727573742e636f6d300d06092a864886f70d01010c0500038202010066b2aa695d6528074c4c1128b12de257f912d750822612214e900d341e32ea80b71c2b18d80dbd045850f85678caa88d5118d945937b5a97daf332f9f22226e7a65840639f65e1e8dab5e6b5063a323eca159801e238cdf039f3770de1cc399fdafb4e1a2e164877ddaef00148957b13707fdc31c22c12108591ede7cc4c87ca525589430ad7b620de191ab83a470eec35e9219de99fe23add56f0dac5dcf5af500b7b245962fc3f354a40ed1fd709c42f6599bd62f3a9421a176edc27c9da9c4577cfc528627975d2a36f3f8a869bf2285222e37d9fc14afd27ae2896730b1e1b3e4bd01affb55b603d5f365c7c9135d34472baa548c141042ff56010d9d5b7198a4449786af76856edb720de9b829ee67463b64171e59c28a1990d50da3bc50ad34388cd656e6b74bd1c5243df1eaf200436eed84631d9751b944087ee4d3bb2fb3ed47ab60d255a5584d1b8e18c645f5857f9ae999466289de9c670e31489eb9bf14e7ec0e61a2fed0c7c404aa305df775dcb4d408b1eeb643944389e678b76bc76278d043c4b4f14f6b7bee7882a2ad8a4932a7b92fa8b9d51c4c5889ed73dc9632df2f93870fb9d2df007fb505443c10dd70618e493205d0de0322779a110027e0f93d4cd2a4aa47ae8a69be4a0348b1b892ebf121929502be396714cf1d8b19b07b157f05b0f653244f5b028b6756f965a6be1cdd2144ce784a4f84846	wscript.exe

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	68	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	70	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\tmpwznx2js3.js
1⤵
- Badlisted process makes network request
- Modifies system certificate store
PID:1588