lgoogloader | 5dcf48fef44cefbf3f972e1ac477539776bfe41cbd29801bae6e254dbe12dc13

General

Target
8ec2bf6765868e6db776e74a5458a627.exe
Size 481KB
Sample221214-ll3azshf82
SHA256 5dcf48fef44cefbf3f972e1ac477539776bfe41cbd29801bae6e254dbe12dc13
MD5 8ec2bf6765868e6db776e74a5458a627
SHA1 7766853455c0cc4b20f60f6e4e5f6454d854b3ae
SHA512 07c69af194115542bdfb71c4a6c59bbd74fc92c4ff13fec64360ff73918102eacfd606a1d4d42a337bd28fb1715bb40689fee5c3fdf1f83e19f5e08456637cdd
SSDEEP 12288:yCJl9Q8xPj8gfgVnNcRFvyxLPqQsZ5r6a5:yCBoagVNKcxLqoa
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lgoogloader downloader evasion persistence trojan

Malware Config

Signatures

Detects LgoogLoader payload 1 IoCs

resource	yara_rule
behavioral2/memory/4300-144-0x00000000029E0000-0x00000000029ED000-memory.dmp	family_lgoogloader

LgoogLoader
A downloader capable of dropping and executing other malware families.
downloader lgoogloader

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	8ec2bf6765868e6db776e74a5458a627.exe

Windows security bypass 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	8ec2bf6765868e6db776e74a5458a627.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\8ec2bf6765868e6db776e74a5458a627.exe = "0"	8ec2bf6765868e6db776e74a5458a627.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\TaskKill\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\Иисус.sys"	8ec2bf6765868e6db776e74a5458a627.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	8ec2bf6765868e6db776e74a5458a627.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions	8ec2bf6765868e6db776e74a5458a627.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\8ec2bf6765868e6db776e74a5458a627.exe = "0"	8ec2bf6765868e6db776e74a5458a627.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	8ec2bf6765868e6db776e74a5458a627.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	8ec2bf6765868e6db776e74a5458a627.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	8ec2bf6765868e6db776e74a5458a627.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2148 set thread context of 4300	2148	8ec2bf6765868e6db776e74a5458a627.exe	83

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4720	powershell.exe
4720	powershell.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
2148	8ec2bf6765868e6db776e74a5458a627.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2148	8ec2bf6765868e6db776e74a5458a627.exe
Token: SeLoadDriverPrivilege	2148	8ec2bf6765868e6db776e74a5458a627.exe
Token: SeDebugPrivilege	4720	powershell.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 4720	2148	8ec2bf6765868e6db776e74a5458a627.exe	81
PID 2148 wrote to memory of 4720	2148	8ec2bf6765868e6db776e74a5458a627.exe	81
PID 2148 wrote to memory of 4300	2148	8ec2bf6765868e6db776e74a5458a627.exe	83
PID 2148 wrote to memory of 4300	2148	8ec2bf6765868e6db776e74a5458a627.exe	83
PID 2148 wrote to memory of 4300	2148	8ec2bf6765868e6db776e74a5458a627.exe	83
PID 2148 wrote to memory of 4300	2148	8ec2bf6765868e6db776e74a5458a627.exe	83
PID 2148 wrote to memory of 4300	2148	8ec2bf6765868e6db776e74a5458a627.exe	83
PID 2148 wrote to memory of 4300	2148	8ec2bf6765868e6db776e74a5458a627.exe	83
PID 2148 wrote to memory of 4300	2148	8ec2bf6765868e6db776e74a5458a627.exe	83
PID 2148 wrote to memory of 4300	2148	8ec2bf6765868e6db776e74a5458a627.exe	83
PID 2148 wrote to memory of 4300	2148	8ec2bf6765868e6db776e74a5458a627.exe	83
PID 2148 wrote to memory of 4300	2148	8ec2bf6765868e6db776e74a5458a627.exe	83
PID 2148 wrote to memory of 4300	2148	8ec2bf6765868e6db776e74a5458a627.exe	83

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	8ec2bf6765868e6db776e74a5458a627.exe

C:\Users\Admin\AppData\Local\Temp\8ec2bf6765868e6db776e74a5458a627.exe
"C:\Users\Admin\AppData\Local\Temp\8ec2bf6765868e6db776e74a5458a627.exe"
1⤵
- UAC bypass
- Windows security bypass
- Sets service image path in registry
- Checks computer location settings
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2148
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\8ec2bf6765868e6db776e74a5458a627.exe" -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4720
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
  2⤵
  PID:4300