lgoogloader | d0f5a3be9ab80e06600ffcb13d897f325b7c8737b895223b3b7e03ecc79abbca

General

Target

197cc0b311afc440dd150387e68bf49f.exe
Size

485KB
MD5

197cc0b311afc440dd150387e68bf49f
SHA1

78434666b854de78dfbfb253e66644865d324586
SHA256

d0f5a3be9ab80e06600ffcb13d897f325b7c8737b895223b3b7e03ecc79abbca
SHA512

93e805b0956a69a2f9bcabd059bafef689a82aa8654a71bf56d9834db9a5d1904aca34178e02b47f85b6bbac3b4430209dc989071e50c1d63c152daeb5052fed
SSDEEP

6144:up65pkrxfUvq1uWsCbIG3p2NtIzCuAsTF5nCLggt6wVsp03cPqfXETRaLP5bhxJ:vs+DNCMG5WIzCETqLgm6RyPETYRfq

Score

10^/10

lgoogloader downloader evasion persistence trojan

Malware Config

Signatures

Detects LgoogLoader payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1776-70-0x0000000000150000-0x000000000015D000-memory.dmp	family_lgoogloader

LgoogLoader
A downloader capable of dropping and executing other malware families.
downloader lgoogloader

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

197cc0b311afc440dd150387e68bf49f.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	197cc0b311afc440dd150387e68bf49f.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

197cc0b311afc440dd150387e68bf49f.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\TaskKill\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\Иисус.sys"	197cc0b311afc440dd150387e68bf49f.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

197cc0b311afc440dd150387e68bf49f.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	197cc0b311afc440dd150387e68bf49f.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	197cc0b311afc440dd150387e68bf49f.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

197cc0b311afc440dd150387e68bf49f.exe

description pid process target process

PID 1476 set thread context of 1776 1476 197cc0b311afc440dd150387e68bf49f.exe CasPol.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

1932 powershell.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

197cc0b311afc440dd150387e68bf49f.exe

pid process

1476 197cc0b311afc440dd150387e68bf49f.exe

description	pid	process	target process
PID 1476 set thread context of 1776	1476	197cc0b311afc440dd150387e68bf49f.exe	CasPol.exe

pid	process
1932	powershell.exe

pid	process
1476	197cc0b311afc440dd150387e68bf49f.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

197cc0b311afc440dd150387e68bf49f.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	1476	197cc0b311afc440dd150387e68bf49f.exe
Token: SeLoadDriverPrivilege	1476	197cc0b311afc440dd150387e68bf49f.exe
Token: SeDebugPrivilege	1932	powershell.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

197cc0b311afc440dd150387e68bf49f.exe

description	pid	process	target process
PID 1476 wrote to memory of 1932	1476	197cc0b311afc440dd150387e68bf49f.exe	powershell.exe
PID 1476 wrote to memory of 1932	1476	197cc0b311afc440dd150387e68bf49f.exe	powershell.exe
PID 1476 wrote to memory of 1932	1476	197cc0b311afc440dd150387e68bf49f.exe	powershell.exe
PID 1476 wrote to memory of 1776	1476	197cc0b311afc440dd150387e68bf49f.exe	CasPol.exe
PID 1476 wrote to memory of 1776	1476	197cc0b311afc440dd150387e68bf49f.exe	CasPol.exe
PID 1476 wrote to memory of 1776	1476	197cc0b311afc440dd150387e68bf49f.exe	CasPol.exe
PID 1476 wrote to memory of 1776	1476	197cc0b311afc440dd150387e68bf49f.exe	CasPol.exe
PID 1476 wrote to memory of 1776	1476	197cc0b311afc440dd150387e68bf49f.exe	CasPol.exe
PID 1476 wrote to memory of 1776	1476	197cc0b311afc440dd150387e68bf49f.exe	CasPol.exe
PID 1476 wrote to memory of 1776	1476	197cc0b311afc440dd150387e68bf49f.exe	CasPol.exe
PID 1476 wrote to memory of 1776	1476	197cc0b311afc440dd150387e68bf49f.exe	CasPol.exe
PID 1476 wrote to memory of 1776	1476	197cc0b311afc440dd150387e68bf49f.exe	CasPol.exe
PID 1476 wrote to memory of 1776	1476	197cc0b311afc440dd150387e68bf49f.exe	CasPol.exe
PID 1476 wrote to memory of 1776	1476	197cc0b311afc440dd150387e68bf49f.exe	CasPol.exe

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

Processes:

197cc0b311afc440dd150387e68bf49f.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	197cc0b311afc440dd150387e68bf49f.exe

C:\Users\Admin\AppData\Local\Temp\197cc0b311afc440dd150387e68bf49f.exe
"C:\Users\Admin\AppData\Local\Temp\197cc0b311afc440dd150387e68bf49f.exe"
1⤵
- UAC bypass
- Sets service image path in registry
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1476

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\197cc0b311afc440dd150387e68bf49f.exe" -Force
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1932

C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
2⤵
PID:1776

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Bypass User Account Control

1

T1088

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1476-55-0x0000000001FF0000-0x000000000206A000-memory.dmp

Filesize
488KB

Download
memory/1476-54-0x00000000002C0000-0x000000000033E000-memory.dmp

Filesize
504KB

Download
memory/1776-64-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1776-70-0x0000000000150000-0x000000000015D000-memory.dmp

Filesize
52KB

Download
memory/1776-69-0x0000000000120000-0x0000000000129000-memory.dmp

Filesize
36KB

Download
memory/1776-68-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1776-67-0x0000000075E51000-0x0000000075E53000-memory.dmp

Filesize
8KB

Download
memory/1776-65-0x0000000000403BA0-mapping.dmp

Download
memory/1932-58-0x000007FEEC380000-0x000007FEECDA3000-memory.dmp

Filesize
10.1MB

Download
memory/1932-63-0x000000000274B000-0x000000000276A000-memory.dmp

Filesize
124KB

Download
memory/1932-62-0x0000000002744000-0x0000000002747000-memory.dmp

Filesize
12KB

Download
memory/1932-61-0x000000000274B000-0x000000000276A000-memory.dmp

Filesize
124KB

Download
memory/1932-60-0x0000000002744000-0x0000000002747000-memory.dmp

Filesize
12KB

Download
memory/1932-59-0x000007FEEB820000-0x000007FEEC37D000-memory.dmp

Filesize
11.4MB

Download
memory/1932-57-0x000007FEFC311000-0x000007FEFC313000-memory.dmp

Filesize
8KB

Download
memory/1932-56-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads