ReliaQuest’s Threat Hunting Team traced a May 2023 incident to Gootloader, a JavaScript-based initial-access malware that can seed second-stage remote access tools and enable ransomware deployments. The assessment details Gootloader’s infection chain, the SystemBC RAT as the second-stage payload, and credential access and exfiltration activities observed in the environment. #Gootloader #SystemBC #ReliaQuest
Keypoints
- Gootloader is a JavaScript-based initial access malware that commonly uses SEO poisoning to prompt malware downloads.
- The infection begins with a social-engineered, SEO-poisoned page prompting a download of a ZIP containing a malicious JS file.
- The initial payload drops a second JS file and changes its placement directory per execution to evade defenders.
- Persistence is established via a scheduled task named “Tribal Consultation” that runs the secondary script at user login.
- The second-stage payload is linked to SystemBC RAT for interactive remote access and uses multiple C2 domains and encoded data to communicate.
<liDiscovery and privilege escalation involve LDAP queries, SPN discovery, and Kerberoasting with RC4, enabling further access.
<liLateral movement uses RDP from the compromised host to other systems; LSASS credential dumping and SAM hive exports are attempted for credential theft and exfiltration via FTP.
MITRE Techniques
- [T1189] Drive-by Compromise – Delivery via an SEO-poisoned page that prompts malware downloads. “For delivery, it typically depends on SEO poisoning, a technique used by attackers to manipulate the ranking of web pages in search engine results to draw clicks and prompt malware downloads.”
- [T1053.005] Scheduled Task – Persistence by adding a secondary script as a scheduled task named “Tribal Consultation” that runs at login. “The initial JS script … added the secondary script in its shortened form as a scheduled task on the victim’s machine … the task name did not vary between executions.”
- [T1059.005] Windows Script Host – Execution of the initial JS file via WScript.exe. “executed via Windows Script Host (wscript.exe) using this command line…”
- [T1059.001] PowerShell – Execution path includes obfuscated PowerShell commands reaching out to C2. “reaching out to 10 C2 domains” and encoded data within PowerShell context.
- [T1071.001] Web Protocols – C2 communication through multiple domains. “obfuscated PowerShell command reaching out to 10 C2 domains.”
- [T1027] Obfuscated/Compressed Files and Information – Data collected in environmental variables is Base64 encoded and gzip compressed before exfiltration. “The script indicated that information collected within these variables … Base64 encoded, and Gzip compressed.”
- [T1021.001] Remote Services – Lateral movement via RDP from the compromised host to three other hosts, with interactive actions on one host (Stealthbits Server). “The attacker used the compromised service account to RDP to three unique hosts…”
- [T1003.001] LSASS Memory – Credential dumping via LSASS memory using MiniDump. “LSASS credentials on the host … MiniDump” and subsequent attempts with procdump. “procdump -accepteula -ma lsass.exe lsassdump”
- [T1003.005] Credential Dumping via Registry – Exfiltration of registry hive exports (SYSTEM and SAM) to external FTP. “saving the registry contents of the SYSTEM hive and the SAM hive via the registry modification tool reg.exe” and upload to FTP.
- [T1041] Exfiltration – Exfiltration of dumped credentials and registry data over FTP to external hosts. “exfiltration of their captured data” and “uploaded to FTP hosting site.”
- [T1087.001] Account Discovery – LDAP information discovery via PowerShell to enumerate accounts. “query Lightweight Directory Access Protocol (LDAP) information via PowerShell”
- [T1558.003] Kerberoasting – Privilege escalation via Kerberos ticket requests using RC4 encryption to crack offline. “Kerberos ticket for a stale service account … RC4 encryption”
Indicators of Compromise
- [IP] C2 / external communications – 94.156.189.36, 217.145.84.64, and 2 more IPs
- [Domain] Malicious and fraud-friendly domains used for hosting payloads and C2 – salamancaespectacular.com/what-is-the-difference-between-legal-ruled-and-wide-ruled-paper, demo.petsure.com/xmlrpc.php, and 14 more domains
- [File name] Malicious loaders and scripts – Lead-based Paint.js, What_is_the_difference_between_legal_ruled_and_wide_ruled_paper_7301.zip
- [File hash] Known hashes associated with the sample – f2afd46cfef3883fc858ca7b7730d4d6ee56a7aedbdb1b1f7bda7dba054f489e, 72ECFA3693CE5858332C9CEE21B608A8F0C2DC3462D56E8BC9955C550A09D55D, and 2 more hashes
Read more: https://www.reliaquest.com/blog/gootloader-infection-credential-access/