lgoogloader | 1dcf6de74577426e2c2e87f085bd1a2f32c00d76e78006a1548c11b934f9d06e

General

Target
file.exe
Size 489KB
Sample221208-lnrx2ace6v
SHA256 1dcf6de74577426e2c2e87f085bd1a2f32c00d76e78006a1548c11b934f9d06e
MD5 f626fcedbeb6a9fe77f547e986caab26
SHA1 6ed8708ea90ad3d964466607b2b082ba94d0db9e
SHA512 c876b48af17c8c200f8ddd5a613757da5b71cbde9fb3c7b27fd24655ab5aab5d145acb6bd4fd7ebc27203bd17d3c40ee1f8113024996d3e0dd13f06fc95b8e2f
SSDEEP 12288:MF4qqYUurH11iG4kMHMAttRKPFNOQ5l8iqnoJtioXUs:440V1iG5MswwX8iq2
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lgoogloader downloader evasion persistence trojan

Malware Config

Signatures

Detects LgoogLoader payload 1 IoCs

resource	yara_rule
behavioral2/memory/3644-144-0x0000000003040000-0x000000000304D000-memory.dmp	family_lgoogloader

LgoogLoader
A downloader capable of dropping and executing other malware families.
downloader lgoogloader

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	file.exe

Windows security bypass 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	file.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\file.exe = "0"	file.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\TaskKill\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\Иисус.sys"	file.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	file.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	file.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions	file.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\file.exe = "0"	file.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	file.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	file.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5080 set thread context of 3644	5080	file.exe	84

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3996	powershell.exe
3996	powershell.exe
5080	file.exe
5080	file.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
5080	file.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	5080	file.exe
Token: SeLoadDriverPrivilege	5080	file.exe
Token: SeDebugPrivilege	3996	powershell.exe
Token: SeDebugPrivilege	5080	file.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 5080 wrote to memory of 3996	5080	file.exe	82
PID 5080 wrote to memory of 3996	5080	file.exe	82
PID 5080 wrote to memory of 3648	5080	file.exe	83
PID 5080 wrote to memory of 3648	5080	file.exe	83
PID 5080 wrote to memory of 3648	5080	file.exe	83
PID 5080 wrote to memory of 3644	5080	file.exe	84
PID 5080 wrote to memory of 3644	5080	file.exe	84
PID 5080 wrote to memory of 3644	5080	file.exe	84
PID 5080 wrote to memory of 3644	5080	file.exe	84
PID 5080 wrote to memory of 3644	5080	file.exe	84
PID 5080 wrote to memory of 3644	5080	file.exe	84
PID 5080 wrote to memory of 3644	5080	file.exe	84
PID 5080 wrote to memory of 3644	5080	file.exe	84
PID 5080 wrote to memory of 3644	5080	file.exe	84
PID 5080 wrote to memory of 3644	5080	file.exe	84
PID 5080 wrote to memory of 3644	5080	file.exe	84

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	file.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- UAC bypass
- Windows security bypass
- Sets service image path in registry
- Checks computer location settings
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5080
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\file.exe" -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3996
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
  2⤵
  PID:3648
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
  2⤵
  PID:3644