lgoogloader | c36d14b75ffe5d5bb431d0fba2764928e60508cfe528c1ed6ce16d1490334500

Analysis

max time kernel
26s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 15:44

Target

stage1_fixed.exe
Size

1.6MB
MD5

2594a33f4e48ca4d50d29d83ead899c3
SHA1

03ac2c8c2e78c448db29b70ccedaa7d4778e016c
SHA256

c36d14b75ffe5d5bb431d0fba2764928e60508cfe528c1ed6ce16d1490334500
SHA512

9d414c553265d5b3effedebd4f827f35c798f1ed52afa790d1a549317a9d30a53f624954b405352aea70c87a803b36d2472024fe11586d41f053df4dfdf97bc7
SSDEEP

24576:dKZJiJFAQI42nl4BHBRUDj0hFCBJTruCF2vQkZb3uFJVEUj+K+qSP3O2:62FNI44loHvUDqCBJtQU0Uyi8O2

Score

10^/10

Detects LgoogLoader payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1368-63-0x0000000000130000-0x000000000013D000-memory.dmp	family_lgoogloader

LgoogLoader
A downloader capable of dropping and executing other malware families.
downloader lgoogloader
Suspicious use of SetThreadContext 1 IoCs

Processes:

stage1_fixed.exe

description pid process target process

PID 1980 set thread context of 1368 1980 stage1_fixed.exe InstallUtil.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

stage1_fixed.exe

pid process

1980 stage1_fixed.exe
1980 stage1_fixed.exe
1980 stage1_fixed.exe
1980 stage1_fixed.exe
1980 stage1_fixed.exe

description	pid	process	target process
PID 1980 set thread context of 1368	1980	stage1_fixed.exe	InstallUtil.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

stage1_fixed.exe

description	pid	process	target process
PID 1980 wrote to memory of 1368	1980	stage1_fixed.exe	InstallUtil.exe
PID 1980 wrote to memory of 1368	1980	stage1_fixed.exe	InstallUtil.exe
PID 1980 wrote to memory of 1368	1980	stage1_fixed.exe	InstallUtil.exe
PID 1980 wrote to memory of 1368	1980	stage1_fixed.exe	InstallUtil.exe
PID 1980 wrote to memory of 1368	1980	stage1_fixed.exe	InstallUtil.exe
PID 1980 wrote to memory of 1368	1980	stage1_fixed.exe	InstallUtil.exe
PID 1980 wrote to memory of 1368	1980	stage1_fixed.exe	InstallUtil.exe
PID 1980 wrote to memory of 1368	1980	stage1_fixed.exe	InstallUtil.exe
PID 1980 wrote to memory of 1368	1980	stage1_fixed.exe	InstallUtil.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
2⤵
PID:1368

memory/1368-56-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1368-58-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1368-61-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1368-62-0x0000000000100000-0x0000000000109000-memory.dmp

Filesize
36KB

Download
memory/1368-63-0x0000000000130000-0x000000000013D000-memory.dmp

Filesize
52KB

Download
memory/1980-54-0x0000000075521000-0x0000000075523000-memory.dmp

Filesize
8KB

Download
memory/1980-55-0x000000000F220000-0x000000000F516000-memory.dmp

Filesize
3.0MB

Download