lgoogloader | 5c19fb2da50d67ae379047a6a30c01a418aefc98956d0d1662404742e9d84878

Analysis

max time kernel
61s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/11/2022, 00:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
eff3cb4ab664eabe2dc44b5d648f25ff.exe
Size 915KB
Sample221103-a6b4radbf6
SHA256 5c19fb2da50d67ae379047a6a30c01a418aefc98956d0d1662404742e9d84878
MD5 eff3cb4ab664eabe2dc44b5d648f25ff
SHA1 4a1d9f5ccf9d39e565f09978e32133ee3b3cdac4
SHA512 8508843ebcbf6cce819a97b7272f516c3d4f0dc671a1ab11e030fedac57d85183a310ea30dbd97bf3456c8e14296e9cbefc558afc958b77691caf94049e91ba0
SSDEEP 24576:qayJZ+vSawFgbDFLV9DUPKEdvXI31E1R8h3oaK/Ubp:vVaXKDFoPfdKE1RWYaK/+p
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lgoogloader downloader persistence

Malware Config

Signatures

Detects LgoogLoader payload 1 IoCs

resource	yara_rule
behavioral2/memory/3400-164-0x0000000002B40000-0x0000000002B4D000-memory.dmp	family_lgoogloader

LgoogLoader
A downloader capable of dropping and executing other malware families.
downloader lgoogloader

Executes dropped EXE 3 IoCs

pid	Process
1624	Colored.exe.pif
3472	Colored.exe.pif
3400	Colored.exe.pif

Loads dropped DLL 7 IoCs

pid	Process
1624	Colored.exe.pif
1624	Colored.exe.pif
1624	Colored.exe.pif
1624	Colored.exe.pif
1624	Colored.exe.pif
1624	Colored.exe.pif
1624	Colored.exe.pif

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	eff3cb4ab664eabe2dc44b5d648f25ff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	eff3cb4ab664eabe2dc44b5d648f25ff.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1624 set thread context of 3400	1624	Colored.exe.pif	100

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery

T1057

pid	Process
3428	tasklist.exe
1060	tasklist.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
220	PING.EXE
5036	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1624	Colored.exe.pif
1624	Colored.exe.pif
1624	Colored.exe.pif
1624	Colored.exe.pif
1624	Colored.exe.pif
1624	Colored.exe.pif

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1060	tasklist.exe
Token: SeDebugPrivilege	3428	tasklist.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1624	Colored.exe.pif
1624	Colored.exe.pif
1624	Colored.exe.pif

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1624	Colored.exe.pif
1624	Colored.exe.pif
1624	Colored.exe.pif

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 1168	4656	eff3cb4ab664eabe2dc44b5d648f25ff.exe	80
PID 4656 wrote to memory of 1168	4656	eff3cb4ab664eabe2dc44b5d648f25ff.exe	80
PID 4656 wrote to memory of 1168	4656	eff3cb4ab664eabe2dc44b5d648f25ff.exe	80
PID 4656 wrote to memory of 2440	4656	eff3cb4ab664eabe2dc44b5d648f25ff.exe	82
PID 4656 wrote to memory of 2440	4656	eff3cb4ab664eabe2dc44b5d648f25ff.exe	82
PID 4656 wrote to memory of 2440	4656	eff3cb4ab664eabe2dc44b5d648f25ff.exe	82
PID 2440 wrote to memory of 1696	2440	cmd.exe	84
PID 2440 wrote to memory of 1696	2440	cmd.exe	84
PID 2440 wrote to memory of 1696	2440	cmd.exe	84
PID 1696 wrote to memory of 1060	1696	cmd.exe	85
PID 1696 wrote to memory of 1060	1696	cmd.exe	85
PID 1696 wrote to memory of 1060	1696	cmd.exe	85
PID 1696 wrote to memory of 1780	1696	cmd.exe	86
PID 1696 wrote to memory of 1780	1696	cmd.exe	86
PID 1696 wrote to memory of 1780	1696	cmd.exe	86
PID 1696 wrote to memory of 3428	1696	cmd.exe	87
PID 1696 wrote to memory of 3428	1696	cmd.exe	87
PID 1696 wrote to memory of 3428	1696	cmd.exe	87
PID 1696 wrote to memory of 5116	1696	cmd.exe	88
PID 1696 wrote to memory of 5116	1696	cmd.exe	88
PID 1696 wrote to memory of 5116	1696	cmd.exe	88
PID 1696 wrote to memory of 1620	1696	cmd.exe	89
PID 1696 wrote to memory of 1620	1696	cmd.exe	89
PID 1696 wrote to memory of 1620	1696	cmd.exe	89
PID 1696 wrote to memory of 1624	1696	cmd.exe	90
PID 1696 wrote to memory of 1624	1696	cmd.exe	90
PID 1696 wrote to memory of 1624	1696	cmd.exe	90
PID 1696 wrote to memory of 220	1696	cmd.exe	91
PID 1696 wrote to memory of 220	1696	cmd.exe	91
PID 1696 wrote to memory of 220	1696	cmd.exe	91
PID 2440 wrote to memory of 5036	2440	cmd.exe	95
PID 2440 wrote to memory of 5036	2440	cmd.exe	95
PID 2440 wrote to memory of 5036	2440	cmd.exe	95
PID 1624 wrote to memory of 3472	1624	Colored.exe.pif	99
PID 1624 wrote to memory of 3472	1624	Colored.exe.pif	99
PID 1624 wrote to memory of 3472	1624	Colored.exe.pif	99
PID 1624 wrote to memory of 3400	1624	Colored.exe.pif	100
PID 1624 wrote to memory of 3400	1624	Colored.exe.pif	100
PID 1624 wrote to memory of 3400	1624	Colored.exe.pif	100
PID 1624 wrote to memory of 3400	1624	Colored.exe.pif	100
PID 1624 wrote to memory of 3400	1624	Colored.exe.pif	100

C:\Users\Admin\AppData\Local\Temp\eff3cb4ab664eabe2dc44b5d648f25ff.exe
"C:\Users\Admin\AppData\Local\Temp\eff3cb4ab664eabe2dc44b5d648f25ff.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Windows\SysWOW64\bitsadmin.exe
  bitsadmin bitsadmin bitsadmin bitsadmin bitsadmin bitsadmin bitsadmin
  2⤵
  PID:1168
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cmd < Beast.xlam & ping -n 5 localhost
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2440
- - C:\Windows\SysWOW64\cmd.exe
    cmd
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1696
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist /FI "imagename eq AvastUI.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1060
  - - C:\Windows\SysWOW64\find.exe
      find /I /N "avastui.exe"
      4⤵
      PID:1780
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist /FI "imagename eq AVGUI.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3428
  - - C:\Windows\SysWOW64\find.exe
      find /I /N "avgui.exe"
      4⤵
      PID:5116
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /V /R "^pcWtOZs$" Paintball.xlam
      4⤵
      PID:1620
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Colored.exe.pif
      Colored.exe.pif s
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:1624
    - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Colored.exe.pif
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Colored.exe.pif
        5⤵
        Executes dropped EXE
        
        PID:3472
    - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Colored.exe.pif
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Colored.exe.pif
        5⤵
        Executes dropped EXE
        
        PID:3400
  - - C:\Windows\SysWOW64\PING.EXE
      ping localhost -n 5
      4⤵
      Runs ping.exe
      PID:220
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 5 localhost
    3⤵
    - Runs ping.exe
    PID:5036

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Beast.xlam

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Beast.xlam
Size 12KB
SHA256 8afd85700032ab1ccc8bc04b5d2ee624ab6b4f01f529c3c8e46e6266d0c914a0
MD5 d0e0aee49a3bb3531666af2fa7a9c3af
SHA1 541b3b0c8fd0898e3b7bd7dc2f1efc1dfb8c387a
SHA512 b56734aa050e883c32f260fae53f3f055baf03b66e5154181713f166f47ff2d12f559d62c178eff7891732edae545c53ff07169fcaba45ba987b135203c17e09
SSDEEP 192:83AdjQEXDJspb2UPxecqrRULMZbuh98nOneWf1k22cME643jTbuQKneWfOk2SMEF:NQEXNsZXZQr6LVyB2Yt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Colored.exe.pif

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Colored.exe.pif
Size 924KB
SHA256 3e26723394ade92f8163b5643960189cb07358b0f96529a477d37176d68aa0a0
MD5 6987e4cd3f256462f422326a7ef115b9
SHA1 71672a495b4603ecfec40a65254cb3ba8766bbe0
SHA512 4b1d7f7ffee39a2d65504767beeddd4c3374807a93889b14e7e73db11e478492dec349aedca03ce828f21a66bb666a68d3735443f4249556e10825a4cd7dfeb4
SSDEEP 24576:LErOxpVnqgt5ExLh27RQlf7Yfq2WZz2a1BB69:L86pqeE74aB0Sdia1W9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Colored.exe.pif

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Colored.exe.pif
Size 924KB
SHA256 3e26723394ade92f8163b5643960189cb07358b0f96529a477d37176d68aa0a0
MD5 6987e4cd3f256462f422326a7ef115b9
SHA1 71672a495b4603ecfec40a65254cb3ba8766bbe0
SHA512 4b1d7f7ffee39a2d65504767beeddd4c3374807a93889b14e7e73db11e478492dec349aedca03ce828f21a66bb666a68d3735443f4249556e10825a4cd7dfeb4
SSDEEP 24576:LErOxpVnqgt5ExLh27RQlf7Yfq2WZz2a1BB69:L86pqeE74aB0Sdia1W9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Colored.exe.pif

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Colored.exe.pif
Size 924KB
SHA256 3e26723394ade92f8163b5643960189cb07358b0f96529a477d37176d68aa0a0
MD5 6987e4cd3f256462f422326a7ef115b9
SHA1 71672a495b4603ecfec40a65254cb3ba8766bbe0
SHA512 4b1d7f7ffee39a2d65504767beeddd4c3374807a93889b14e7e73db11e478492dec349aedca03ce828f21a66bb666a68d3735443f4249556e10825a4cd7dfeb4
SSDEEP 24576:LErOxpVnqgt5ExLh27RQlf7Yfq2WZz2a1BB69:L86pqeE74aB0Sdia1W9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Colored.exe.pif

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Colored.exe.pif
Size 924KB
SHA256 3e26723394ade92f8163b5643960189cb07358b0f96529a477d37176d68aa0a0
MD5 6987e4cd3f256462f422326a7ef115b9
SHA1 71672a495b4603ecfec40a65254cb3ba8766bbe0
SHA512 4b1d7f7ffee39a2d65504767beeddd4c3374807a93889b14e7e73db11e478492dec349aedca03ce828f21a66bb666a68d3735443f4249556e10825a4cd7dfeb4
SSDEEP 24576:LErOxpVnqgt5ExLh27RQlf7Yfq2WZz2a1BB69:L86pqeE74aB0Sdia1W9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Paintball.xlam

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Paintball.xlam
Size 924KB
SHA256 a7fa661d5f622f0170158f307a174167582d1a6ca04fa7271c03450c9e2e0538
MD5 81bb5b3f7ae96517b44cf5b90f23d749
SHA1 edb9a244a33332b72a048a9a98de128350cbb1fc
SHA512 1332a81fad6139c44960e297929f85a4026b050657a02fa0ff3dd68b5aeaf2136398e05520c6ab502597e369b0e683e1467bcb81076fb27d84cf3a8a10a1ea51
SSDEEP 24576:JErOxpVnqgt5ExLh27RQlf7Yfq2WZz2a1BB69:J86pqeE74aB0Sdia1W9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Saw.xlam

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Saw.xlam
Size 932KB
SHA256 494a4ce217a6d1272023bf1fbc7a7bdbae238851f2d13fc615c8b6821f33a464
MD5 180739b4486bff81275bb00627bbebb6
SHA1 e929892557f7ff6136547abe1989c2dbb21866c4
SHA512 49e93462713470d3fdc8c3f2131265a4f5d81ba6a70d2271912887541805ce73c7555163bff0f4e48158744152f62ff1f0834285640a2f023229da593a22fb9f
SSDEEP 6144:PilalbFrkRwNl3h9dVs/tMp0XF2at+aRBeTpEL9ek5ZHcn1KxEjqKhW7UeCOBEP2:a/WNZbItYMF2aQareTGL9ZjK1KtyNAX7
MD5 SHA1 SHA512 SSDEEP

Submit Download

tkrgjuDFV.dll

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tkrgjuDFV.dll
Size 1.6MB
SHA256 767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
MD5 4f3387277ccbd6d1f21ac5c07fe4ca68
SHA1 e16506f662dc92023bf82def1d621497c8ab5890
SHA512 9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219
SSDEEP 24576:qhYK3o0FvOh/e8AuDq8TJqbEPVVdqi90gvuPGO12HoIGTufqN8:2XFvO5egq8TMbEL59JCKSN
MD5 SHA1 SHA512 SSDEEP

Submit Download

tkrgjuDFV.dll

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tkrgjuDFV.dll
Size 1.6MB
SHA256 767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
MD5 4f3387277ccbd6d1f21ac5c07fe4ca68
SHA1 e16506f662dc92023bf82def1d621497c8ab5890
SHA512 9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219
SSDEEP 24576:qhYK3o0FvOh/e8AuDq8TJqbEPVVdqi90gvuPGO12HoIGTufqN8:2XFvO5egq8TMbEL59JCKSN
MD5 SHA1 SHA512 SSDEEP

Submit Download

tkrgjuDFV.dll

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tkrgjuDFV.dll
Size 1.6MB
SHA256 767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
MD5 4f3387277ccbd6d1f21ac5c07fe4ca68
SHA1 e16506f662dc92023bf82def1d621497c8ab5890
SHA512 9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219
SSDEEP 24576:qhYK3o0FvOh/e8AuDq8TJqbEPVVdqi90gvuPGO12HoIGTufqN8:2XFvO5egq8TMbEL59JCKSN
MD5 SHA1 SHA512 SSDEEP

Submit Download

tkrgjuDFV.dll

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tkrgjuDFV.dll
Size 1.6MB
SHA256 767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
MD5 4f3387277ccbd6d1f21ac5c07fe4ca68
SHA1 e16506f662dc92023bf82def1d621497c8ab5890
SHA512 9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219
SSDEEP 24576:qhYK3o0FvOh/e8AuDq8TJqbEPVVdqi90gvuPGO12HoIGTufqN8:2XFvO5egq8TMbEL59JCKSN
MD5 SHA1 SHA512 SSDEEP

Submit Download

tkrgjuDFV.dll

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tkrgjuDFV.dll
Size 1.6MB
SHA256 767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
MD5 4f3387277ccbd6d1f21ac5c07fe4ca68
SHA1 e16506f662dc92023bf82def1d621497c8ab5890
SHA512 9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219
SSDEEP 24576:qhYK3o0FvOh/e8AuDq8TJqbEPVVdqi90gvuPGO12HoIGTufqN8:2XFvO5egq8TMbEL59JCKSN
MD5 SHA1 SHA512 SSDEEP

Submit Download

tkrgjuDFV.dll

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tkrgjuDFV.dll
Size 1.6MB
SHA256 767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
MD5 4f3387277ccbd6d1f21ac5c07fe4ca68
SHA1 e16506f662dc92023bf82def1d621497c8ab5890
SHA512 9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219
SSDEEP 24576:qhYK3o0FvOh/e8AuDq8TJqbEPVVdqi90gvuPGO12HoIGTufqN8:2XFvO5egq8TMbEL59JCKSN
MD5 SHA1 SHA512 SSDEEP

Submit Download

tkrgjuDFV.dll

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tkrgjuDFV.dll
Size 1.6MB
SHA256 767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
MD5 4f3387277ccbd6d1f21ac5c07fe4ca68
SHA1 e16506f662dc92023bf82def1d621497c8ab5890
SHA512 9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219
SSDEEP 24576:qhYK3o0FvOh/e8AuDq8TJqbEPVVdqi90gvuPGO12HoIGTufqN8:2XFvO5egq8TMbEL59JCKSN
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3400-156-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3400-161-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3400-162-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3400-163-0x0000000002B10000-0x0000000002B19000-memory.dmp

Download

memory/3400-164-0x0000000002B40000-0x0000000002B4D000-memory.dmp

Download