lgoogloader | 717957544dcfbf0a92f33a1ab039d4197fd7c4b21615ec2fa9a730ef74e24c85

Analysis

max time kernel
90s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
02/11/2022, 10:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 916KB
Sample221102-l2r5ysbfep
SHA256 717957544dcfbf0a92f33a1ab039d4197fd7c4b21615ec2fa9a730ef74e24c85
MD5 2e36945065bb532454b099ec662f5f80
SHA1 741c94ced46dcd446e67f6f29405e13352149d6b
SHA512 9d1a0fb1263ffd266ae6fed6e6d94e52a0b703fa7fde3dfe3e1796113568c8955d5f66d6cd50d6f8ecaa217bab9413811ba1f69d3607d3166eedf8cb1d37f649
SSDEEP 12288:szU4Mb2rvXAgU8JtxdGfMVlO4TsYukJyA/D6vg+XvyNBy8ov2v0f7b:sfZrvQgU8Jt7Gf8lVTMkwA0j6NBVov2W
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lgoogloader downloader persistence

Malware Config

Signatures

Detects LgoogLoader payload 1 IoCs

resource	yara_rule
behavioral2/memory/3224-161-0x0000000003070000-0x000000000307D000-memory.dmp	family_lgoogloader

LgoogLoader
A downloader capable of dropping and executing other malware families.
downloader lgoogloader

Executes dropped EXE 2 IoCs

pid	Process
2472	Continuity.exe.pif
3224	Continuity.exe.pif

Loads dropped DLL 6 IoCs

pid	Process
2472	Continuity.exe.pif
2472	Continuity.exe.pif
2472	Continuity.exe.pif
2472	Continuity.exe.pif
2472	Continuity.exe.pif
2472	Continuity.exe.pif

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	file.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	file.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2472 set thread context of 3224	2472	Continuity.exe.pif	99

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery

T1057

pid	Process
2240	tasklist.exe
3264	tasklist.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
3948	PING.EXE
2040	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2472	Continuity.exe.pif
2472	Continuity.exe.pif
2472	Continuity.exe.pif
2472	Continuity.exe.pif
2472	Continuity.exe.pif
2472	Continuity.exe.pif

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2240	tasklist.exe
Token: SeDebugPrivilege	3264	tasklist.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2472	Continuity.exe.pif
2472	Continuity.exe.pif
2472	Continuity.exe.pif

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2472	Continuity.exe.pif
2472	Continuity.exe.pif
2472	Continuity.exe.pif

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 384 wrote to memory of 5076	384	file.exe	80
PID 384 wrote to memory of 5076	384	file.exe	80
PID 384 wrote to memory of 5076	384	file.exe	80
PID 384 wrote to memory of 4968	384	file.exe	82
PID 384 wrote to memory of 4968	384	file.exe	82
PID 384 wrote to memory of 4968	384	file.exe	82
PID 4968 wrote to memory of 1820	4968	cmd.exe	84
PID 4968 wrote to memory of 1820	4968	cmd.exe	84
PID 4968 wrote to memory of 1820	4968	cmd.exe	84
PID 1820 wrote to memory of 2240	1820	cmd.exe	85
PID 1820 wrote to memory of 2240	1820	cmd.exe	85
PID 1820 wrote to memory of 2240	1820	cmd.exe	85
PID 1820 wrote to memory of 684	1820	cmd.exe	86
PID 1820 wrote to memory of 684	1820	cmd.exe	86
PID 1820 wrote to memory of 684	1820	cmd.exe	86
PID 1820 wrote to memory of 3264	1820	cmd.exe	89
PID 1820 wrote to memory of 3264	1820	cmd.exe	89
PID 1820 wrote to memory of 3264	1820	cmd.exe	89
PID 1820 wrote to memory of 2044	1820	cmd.exe	90
PID 1820 wrote to memory of 2044	1820	cmd.exe	90
PID 1820 wrote to memory of 2044	1820	cmd.exe	90
PID 1820 wrote to memory of 1008	1820	cmd.exe	91
PID 1820 wrote to memory of 1008	1820	cmd.exe	91
PID 1820 wrote to memory of 1008	1820	cmd.exe	91
PID 1820 wrote to memory of 2472	1820	cmd.exe	92
PID 1820 wrote to memory of 2472	1820	cmd.exe	92
PID 1820 wrote to memory of 2472	1820	cmd.exe	92
PID 1820 wrote to memory of 2040	1820	cmd.exe	93
PID 1820 wrote to memory of 2040	1820	cmd.exe	93
PID 1820 wrote to memory of 2040	1820	cmd.exe	93
PID 4968 wrote to memory of 3948	4968	cmd.exe	96
PID 4968 wrote to memory of 3948	4968	cmd.exe	96
PID 4968 wrote to memory of 3948	4968	cmd.exe	96
PID 2472 wrote to memory of 3224	2472	Continuity.exe.pif	99
PID 2472 wrote to memory of 3224	2472	Continuity.exe.pif	99
PID 2472 wrote to memory of 3224	2472	Continuity.exe.pif	99
PID 2472 wrote to memory of 3224	2472	Continuity.exe.pif	99
PID 2472 wrote to memory of 3224	2472	Continuity.exe.pif	99

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:384
- C:\Windows\SysWOW64\bitsadmin.exe
  bitsadmin bitsadmin bitsadmin bitsadmin bitsadmin bitsadmin bitsadmin
  2⤵
  PID:5076
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cmd < Conservation.tiff & ping -n 5 localhost
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4968
- - C:\Windows\SysWOW64\cmd.exe
    cmd
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1820
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist /FI "imagename eq AvastUI.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2240
  - - C:\Windows\SysWOW64\find.exe
      find /I /N "avastui.exe"
      4⤵
      PID:684
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist /FI "imagename eq AVGUI.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3264
  - - C:\Windows\SysWOW64\find.exe
      find /I /N "avgui.exe"
      4⤵
      PID:2044
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /V /R "^CqOPeMZKw$" Latex.tiff
      4⤵
      PID:1008
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Continuity.exe.pif
      Continuity.exe.pif Q
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:2472
    - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Continuity.exe.pif
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Continuity.exe.pif
        5⤵
        Executes dropped EXE
        
        PID:3224
  - - C:\Windows\SysWOW64\PING.EXE
      ping localhost -n 5
      4⤵
      Runs ping.exe
      PID:2040
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 5 localhost
    3⤵
    - Runs ping.exe
    PID:3948

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Conservation.tiff

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Conservation.tiff
Size 11KB
SHA256 fdbc3e5e731bc6e8b084d91c3d9439bc747572cdd3e7d50a791e3ec68dae465d
MD5 34184c89edf3ea4e8695abac5ba6e6ff
SHA1 a742581e6dea4cfac98eaa728975e2500e09c371
SHA512 f114b5d52d7582b892689305e745bda393de9dc652986c7ade434b242336d84534c4ac0ee8538bbe9599c2eacf0a812f6014192997a64de8f9b0d2ffeae73251
SSDEEP 192:Il9I/uoAPwgZLcPLEmdsrJEC/Ld6UaVWTD06Ud4DnQBt:HkgnV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Continuity.exe.pif

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Continuity.exe.pif
Size 924KB
SHA256 3e26723394ade92f8163b5643960189cb07358b0f96529a477d37176d68aa0a0
MD5 6987e4cd3f256462f422326a7ef115b9
SHA1 71672a495b4603ecfec40a65254cb3ba8766bbe0
SHA512 4b1d7f7ffee39a2d65504767beeddd4c3374807a93889b14e7e73db11e478492dec349aedca03ce828f21a66bb666a68d3735443f4249556e10825a4cd7dfeb4
SSDEEP 24576:LErOxpVnqgt5ExLh27RQlf7Yfq2WZz2a1BB69:L86pqeE74aB0Sdia1W9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Continuity.exe.pif

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Continuity.exe.pif
Size 924KB
SHA256 3e26723394ade92f8163b5643960189cb07358b0f96529a477d37176d68aa0a0
MD5 6987e4cd3f256462f422326a7ef115b9
SHA1 71672a495b4603ecfec40a65254cb3ba8766bbe0
SHA512 4b1d7f7ffee39a2d65504767beeddd4c3374807a93889b14e7e73db11e478492dec349aedca03ce828f21a66bb666a68d3735443f4249556e10825a4cd7dfeb4
SSDEEP 24576:LErOxpVnqgt5ExLh27RQlf7Yfq2WZz2a1BB69:L86pqeE74aB0Sdia1W9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Continuity.exe.pif

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Continuity.exe.pif
Size 924KB
SHA256 3e26723394ade92f8163b5643960189cb07358b0f96529a477d37176d68aa0a0
MD5 6987e4cd3f256462f422326a7ef115b9
SHA1 71672a495b4603ecfec40a65254cb3ba8766bbe0
SHA512 4b1d7f7ffee39a2d65504767beeddd4c3374807a93889b14e7e73db11e478492dec349aedca03ce828f21a66bb666a68d3735443f4249556e10825a4cd7dfeb4
SSDEEP 24576:LErOxpVnqgt5ExLh27RQlf7Yfq2WZz2a1BB69:L86pqeE74aB0Sdia1W9
MD5 SHA1 SHA512 SSDEEP

Submit Download

FSokWYkDZj.dll

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\FSokWYkDZj.dll
Size 1.6MB
SHA256 767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
MD5 4f3387277ccbd6d1f21ac5c07fe4ca68
SHA1 e16506f662dc92023bf82def1d621497c8ab5890
SHA512 9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219
SSDEEP 24576:qhYK3o0FvOh/e8AuDq8TJqbEPVVdqi90gvuPGO12HoIGTufqN8:2XFvO5egq8TMbEL59JCKSN
MD5 SHA1 SHA512 SSDEEP

Submit Download

FSokWYkDZj.dll

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\FSokWYkDZj.dll
Size 1.6MB
SHA256 767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
MD5 4f3387277ccbd6d1f21ac5c07fe4ca68
SHA1 e16506f662dc92023bf82def1d621497c8ab5890
SHA512 9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219
SSDEEP 24576:qhYK3o0FvOh/e8AuDq8TJqbEPVVdqi90gvuPGO12HoIGTufqN8:2XFvO5egq8TMbEL59JCKSN
MD5 SHA1 SHA512 SSDEEP

Submit Download

FSokWYkDZj.dll

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\FSokWYkDZj.dll
Size 1.6MB
SHA256 767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
MD5 4f3387277ccbd6d1f21ac5c07fe4ca68
SHA1 e16506f662dc92023bf82def1d621497c8ab5890
SHA512 9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219
SSDEEP 24576:qhYK3o0FvOh/e8AuDq8TJqbEPVVdqi90gvuPGO12HoIGTufqN8:2XFvO5egq8TMbEL59JCKSN
MD5 SHA1 SHA512 SSDEEP

Submit Download

FSokWYkDZj.dll

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\FSokWYkDZj.dll
Size 1.6MB
SHA256 767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
MD5 4f3387277ccbd6d1f21ac5c07fe4ca68
SHA1 e16506f662dc92023bf82def1d621497c8ab5890
SHA512 9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219
SSDEEP 24576:qhYK3o0FvOh/e8AuDq8TJqbEPVVdqi90gvuPGO12HoIGTufqN8:2XFvO5egq8TMbEL59JCKSN
MD5 SHA1 SHA512 SSDEEP

Submit Download

FSokWYkDZj.dll

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\FSokWYkDZj.dll
Size 1.6MB
SHA256 767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
MD5 4f3387277ccbd6d1f21ac5c07fe4ca68
SHA1 e16506f662dc92023bf82def1d621497c8ab5890
SHA512 9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219
SSDEEP 24576:qhYK3o0FvOh/e8AuDq8TJqbEPVVdqi90gvuPGO12HoIGTufqN8:2XFvO5egq8TMbEL59JCKSN
MD5 SHA1 SHA512 SSDEEP

Submit Download

FSokWYkDZj.dll

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\FSokWYkDZj.dll
Size 1.6MB
SHA256 767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
MD5 4f3387277ccbd6d1f21ac5c07fe4ca68
SHA1 e16506f662dc92023bf82def1d621497c8ab5890
SHA512 9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219
SSDEEP 24576:qhYK3o0FvOh/e8AuDq8TJqbEPVVdqi90gvuPGO12HoIGTufqN8:2XFvO5egq8TMbEL59JCKSN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Latex.tiff

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Latex.tiff
Size 924KB
SHA256 14e245cc156442e5f0f55717266bc0f3fb2847f77713ce690aa66f8311c8de46
MD5 1aaf3da622b8d9501ce2b8a79805b0f3
SHA1 ff183019934cfd0fe3a5f7954482242e02908a15
SHA512 da0fbe4220ba5ab3274e8d21fd761f3ca9dc7c0b36bea0809cf58ed4447d5b4840861b6b6cded27fe6afa60b5e13f3a9b87b1f133b46be9384ac1c3c3411f793
SSDEEP 24576:wErOxpVnqgt5ExLh27RQlf7Yfq2WZz2a1BB69:w86pqeE74aB0Sdia1W9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Recover.tiff

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Recover.tiff
Size 902KB
SHA256 9d228aadb90ede8c3c083b730bf7226ca3538a70f40b09b42bbf8f17e4c1f174
MD5 f6f8616b38953ad2b201f11a9dff6f13
SHA1 d2d00bcc0f37f11e7725ec8dfdc715285dcde005
SHA512 f3f3237981fcc24af4762da28a3f528c04cd99512d3b9d2803fafb7dbb3f19419d59fd8147ee1c8073a095d841afe5b126311d7ce007f0b9f2280d9ef68b9d67
SSDEEP 12288:w0klla60fAb3+vans/5juNQbu15UHZ3Zi9p:Lkls60Ib3qChnUHZ3Zif
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3224-153-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/3224-159-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/3224-158-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/3224-160-0x0000000003040000-0x0000000003049000-memory.dmp

Download

memory/3224-161-0x0000000003070000-0x000000000307D000-memory.dmp

Download