# Gootloader Malware Leads to Cobalt Strike and… **[esentire.com/blog/gootloader-leads-to-cobalt-strike-and-hand-on-keyboard-activity](https://www.esentire.com/blog/gootloader-leads-to-cobalt-strike-and-hand-on-keyboard-activity)** Resources TRU INTELLIGENCE CENTER Our Threat Response Unit (TRU) publishes security advisories, blogs, reports, industry publications and webinars based on its original research and the insights driven through proactive threat hunts. [View Threat Intelligence Resources →](https://www.esentire.com/resources/tru-intelligence-center) Company ABOUT ESENTIRE About Us eSentire is The Authority in Managed Detection and Response Services, protecting the critical data and applications of 1500+ organizations in 80+ countries from known and unknown cyber threats. Founded in 2001, the company’s mission is to hunt, investigate and stop cyber threats before they become business disrupting events. [Read about how we got here](https://www.esentire.com/company/about-us) ----- [Leadership](https://www.esentire.com/company/leadership) [Work at eSentire](https://www.esentire.com/company/careers) EVENT CALENDAR Feb 20 NetDeligence Cyber Risk Summit eSentire will be a Sponsor at the NetDeligence Cyber Risk Summit in Fort… Mar 28 NetDeligence Cyber Risk Summit eSentire will be a Sponsor at the NetDeligence Cyber Risk Summit in… Apr 24 RSA Conference eSentire is an exhibitor at RSAC 2023. Visit us at Booth 0535. [View Event Calendar →](https://www.esentire.com/company/event-calendar) Partners PARTNER PROGRAM e3 Ecosystem We provide sophisticated cybersecurity solutions for Managed Security Service Providers (MSSPs), Managed Service Providers (MSPs), and Value-Added Resellers (VARs). Find out why you should partner with eSentire, the Authority in Managed Detection and Response, today. [Learn more](https://www.esentire.com/partners) Search Resources [Speak With A Security Expert Now](https://www.esentire.com/get-started) ----- [Adversaries don t work 9-5 and neither do we. At eSentire, our 24/7 SOCs are staffed with](https://www.esentire.com/what-we-do/security-operations-center) Elite Threat Hunters and Cyber Analysts who hunt, investigate, contain and respond to threats within minutes. We have discovered some of the most dangerous threats and nation state attacks in our space – including the Kaseya MSP breach and the more_eggs malware. Our Security Operations Centers are supported with Threat Intelligence, Tactical Threat Response and Advanced Threat Analytics driven by our Threat Response Unit – the TRU team. In TRU Positives, eSentire’s Threat Response Unit (TRU) provides a summary of a recent threat investigation. We outline how we responded to the confirmed threat and what recommendations we have going forward. **Here’s the latest from our TRU Team…** ## What did we find? [We uncovered Gootloader malware using a new infection technique, which helped](https://www.esentire.com/blog/gootloader-striking-with-a-new-infection-technique) further insights into the threat actor(s) tools and next infection phase. Gootloader’s initial JavaScript payload was delivered using the same technique via a compromised WordPress website. _Figure 1: Compromised WordPress site serving the initial payload_ Based on the sample retrieved from the infected webpage, the initial payload creates several files under a legitimate folder inAppData\Roaming: Parliamentary Procedure.log (Engineering Geology.log on the infected machine) TIBCO Rendezvous.js (Custom Built-ins.js on the infected machine) ----- It is worth mentioning that the filenames and scheduled task name can be different even if the initial payload was downloaded from the same infected webpage. The scheduled task “Foreign Languages” is also created to run the “TIBCO Rendezvous.js” file with TIBCOR~1.JS argument at the log on from the sample we retrieved. Approximately 2 hours after the initial infection, we observed hands-on activity on the system. The threat actor(s) deployed a Cobalt Strike payload via the existing PowerShell process that beaconed out to several domains with /GET /xmlrpc.php requests (e.g. hxxps[://]thetripgoeson[.]com/xmlrpc[.]php). ### The next stage of Gootloader (threat actor(s)’ hands-on activity) The threat actor(s) retrieved and ran the Cobalt Strike payload zieu.ps1 from path appdata\roaming\btbh\. _Figure 2: Retrieved zieu.ps1 Cobalt Strike payload_ After establishing the connection with the Cobalt Strike server (91.215.85[.]176), the threat actor(s) proceeded with retrieving and extracting BloodHound, a tool used for graphically analyzing Active Directory and other identity systems to identify attack pathways (20230103151757_bloodhound.zip) that contained pshound.ps1 under C:\Users\ . After further analyzing the Windows Event Logs, we concluded that the script is similar to the [one mentioned by GuidePoint Security that appears to be a BloodHound executable.](https://www.guidepointsecurity.com/blog/how-to-peel-a-powershell-onion-a-bloodhound-case-study/) ----- Besides the Cobalt Strike payload, the threat actor(s) retrieved the following files/tools: PsExec (C:\Users\) – a command-line tool used to execute processes on remote computers, enabling administrators to remotely control other systems on a network. nwu2ndiyotmtmdvmnc00zja1lwi3yjmtyzllztrlngixm2vk.bin (C:\Users\). Unfortunately, we could not retrieve the file for analysis. s5.ps1, son.ps1 (AppData\Local) - PowerShell SOCKS proxy script that connects to the C2 server 91.92.136[.]20 over port 4001. _Figure 3: Snippet of s5.ps1 script_ The persistence via Registry Run Keys was created to run the PowerShell SOCKS proxy script with the following values: Registry Run Key name: socks_powershell Data (command to run): Powershell.exe -windowstyle hidden -ExecutionPolicy Bypass -File "C:\Users\\AppData\Local\s5.ps1" The threat actor(s) removed most of the files they dropped on the host including the results produced by BloodHound as well as an unidentified krb.txt file dropped under C:\Users\. After running BloodHound, the threat actor(s) attempted to move laterally by using PsExec to execute file rz.ps1 on a second host. This was not successful due to the PowerShell execution policy preventing execution of untrusted scripts. We were unable to retrieve the rz.ps1 script, but we assess it was likely a Cobalt Strike payload. ## How did we find it? ----- BlueSteel, our machine-learning powered PowerShell classifier identified postcompromise activity on the system. ## What did we do? Our team of [24/7 SOC Cyber Analysts isolated the host and alerted the customer.](https://www.esentire.com/what-we-do/security-operations-center) The SOC updated the customer with detailed findings and recommendations to remediate this threat. We added C2 addresses to our global blocklist and performed proactive threat hunts for similar activity across all customers. We also updated our Gootloader detection and runbook for this new infection technique. ## What can you learn from this TRU positive? Gootloader is a prevalent drive-by threat distributed through poisoned search results. Infected devices present a valuable foothold for adversaries to conduct follow-on attacks across the network. In the above case, the infected device transitioned to a hands-on-keyboard attack in approximately 2 hours. The drive-by distribution method presents an alternative to email as a vector for delivering malicious code. [Gootloader uses blackhat SEO techniques to manipulate search results and](https://www.esentire.com/blog/black-hat-seo-techniques-employed-by-gootloader) deliver malware disguised as documents. Other drive-by threats utilize malicious search engine advertisements to push lookalike software containing malware. Gootloader follows a general trend observed across several threats where widely distributed, opportunistic infections are weaponized for network intrusions including ransomware deployment. In this case, we assess the goal was likely data theft or ransomware deployment. Gootloader has been previously used as a precursor to the REvil ransomware group in 2021. ## Recommendations from our Threat Response Unit (TRU) Team: ----- Using [Phishing and Security Awareness Training (PSAT), educate your employees](https://www.esentire.com/what-we-do/managed-vulnerability-and-risk/technical-testing/security-awareness-training-managed-phishing-training) regarding the risk of Gootloader and, more broadly, the cybersecurity risks associated with using search engines to find free document templates. Make sure you trust document sources. Even legitimate Word and Excel documents from the Internet can lead to malware infections. Ensure your downloaded content is what you intended. If you intended to download a document (.docx) but you are served a JavaScript (.js) file, do not open it. Escalate it to your internal IT security team. Ensure standard procedures are in place for employees to submit potentially malicious content for review. Use [Windows Attack Surface Reduction rules to block JScript and VBScript from](https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/attack-surface-reduction?view=o365-worldwide#block-javascript-or-vbscript-from-launching-downloaded-executable-content) launching downloaded content. Employ an [Endpoint Detection and Response (EDR) product to help detect, isolate,](https://www.esentire.com/how-we-do-it/signals/endpoint) and remediate cyber threats impacting your company’s endpoint devices. ## Indicators of Compromise |Indicator|Note| |---|---| |23d3d8cd3a5b8e4703a9b91970d790d1|zieu.ps1 (Cobalt Strike payload)| |785fcb9380b4c2310c2200790641bc73|s5.ps1 (PowerShell SOCKS proxy)| |cadb91ac90f52e27c0acae43b79aa202|son.ps1 (PowerShell SOCKS proxy)| |bbbfab2763b717178141f0561584d087|contract salary calculator ontario 34123.js| |hxxps[://]skymedia360[.]com/xmlrpc[.]php|Contacted domain| |hxxps[://]filorga[.]com/xmlrpc[.]php|Contacted domain| |hxxp[://]breadoflifetabernacle[.]com/xmlrpc[.]php|Contacted domain| |hxxps[://]lyngsfjord[.]com/xmlrpc[.]php|Contacted domain| |hxxps[://]galonivan[.]com[.]br/xmlrpc[.]php|Contacted domain| |hxxps[://]assistironline[.]net/xmlrpc[.]php|Contacted domain| |hxxps[://]dexacoin[.]net/xmlrpc[.]php|Contacted domain| |hxxps[://]thetripgoeson[.]com/xmlrpc[.]php|Contacted domain| |hxxps[://]hcss[.]nl/xmlrpc[.]php|Contacted domain| |hxxp[://]beechdesigngroup[.]com/xmlrpc[.]php|Contacted domain| ----- |hxxp[://]dentalofficeathens[.]gr/xmlrpc[.]php|Contacted domain| |---|---| |hxxp[://]aracelicolin[.]org[.]mx/xmlrpc[.]php|Contacted domain| |hxxps[://]shareddata[.]org/xmlrpc[.]php|Contacted domain| |hxxps[://]dunkandjump[.]com/xmlrpc[.]php|Contacted domain| |hxxps[://]nickthomm[.]com/xmlrpc[.]php|Contacted domain| |hxxps[://]1worldsync[.]com/xmlrpc[.]php|Contacted domain| |hxxps[://]hozoboz[.]com/xmlrpc[.]php|Contacted domain| |hxxps[://]burmancoffee[.]com/xmlrpc[.]php|Contacted domain| |hxxps[://]tonyevers[.]com/xmlrpc[.]php|Contacted domain| |hxxps[://]serialowy[.]pl/xmlrpc[.]php|Contacted domain| eSentire’s Threat Response Unit (TRU) is a world-class team of threat researchers who develop new detections enriched by original threat intelligence and leverage new machine learning models that correlate multi-signal data and automate rapid response to advanced threats. If you are not currently engaged with an MDR provider, eSentire MDR can help you reclaim the advantage and put your business ahead of disruption. Learn what it means to have an elite team of Threat Hunters and Researchers that works for you. [Connect with an eSentire Security Specialist.](https://www.esentire.com/get-started) [View Most Recent Blogs](https://www.esentire.com/resources/blog) ----- eSentire Threat Response Unit (TRU) Our industry-renowned Threat Response Unit (TRU) is an elite team of threat hunters and researchers, that supports our 24/7 Security Operations Centers (SOCs), builds detection models across our Atlas XDR Cloud Platform, and works as an extension of your security team to continuously improve our Managed Detection and Response service. TRU has been recognized for its threat hunting, original research and content development capabilities. TRU is strategically organized into cross-functional groups to protect you against advanced and emerging threats, allowing your organization to gain leading threat intelligence and incredible cybersecurity acumen. ----- Cookies allow us to deliver the best possible experience for you on our website - by continuing to use our website or by closing this box, you are consenting to our use of [cookies. Visit our Privacy Policy to learn more.](https://www.esentire.com/legal/privacy-policy) Accept **The Authority in Managed Detection and Response.** 2023 eSentire, Inc. All Rights Reserved. -----