lgoogloader | 2e128ec938bbb7fc4c2c9444ad21ffe9e2dee5fdc74ec9bf91d9663df77c49d4

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29/12/2022, 12:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 404KB
Sample221229-pf3aksda36
SHA256 2e128ec938bbb7fc4c2c9444ad21ffe9e2dee5fdc74ec9bf91d9663df77c49d4
MD5 9c6060a57dcb1d94a69b638424279a8b
SHA1 65f1728196f6f06822303e5bda411e81f187300c
SHA512 471488f5b7399bf9d8b9d47379cd507426733f1d8d7f6d663575ab59fd0f7e16810a4dff9b4f9258cdd525c36aa989144b6cdc749bc34cf2a7c8c38ce907db1a
SSDEEP 12288:NtNr2UjL5S7XJZqx+6FunjCTR6Hyk2JnkBJ:nN6IG6xbFu2F6SkSn0
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lgoogloader downloader

Malware Config

Signatures

Detects LgoogLoader payload 1 IoCs

resource	yara_rule
behavioral1/memory/992-69-0x00000000000A0000-0x00000000000AD000-memory.dmp	family_lgoogloader

LgoogLoader
A downloader capable of dropping and executing other malware families.
downloader lgoogloader
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1096 set thread context of 992	1096	file.exe	30

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1452	1096	WerFault.exe	27

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 1656	1096	file.exe	29
PID 1096 wrote to memory of 1656	1096	file.exe	29
PID 1096 wrote to memory of 1656	1096	file.exe	29
PID 1096 wrote to memory of 1656	1096	file.exe	29
PID 1096 wrote to memory of 992	1096	file.exe	30
PID 1096 wrote to memory of 992	1096	file.exe	30
PID 1096 wrote to memory of 992	1096	file.exe	30
PID 1096 wrote to memory of 992	1096	file.exe	30
PID 1096 wrote to memory of 992	1096	file.exe	30
PID 1096 wrote to memory of 992	1096	file.exe	30
PID 1096 wrote to memory of 1452	1096	file.exe	31
PID 1096 wrote to memory of 1452	1096	file.exe	31
PID 1096 wrote to memory of 1452	1096	file.exe	31
PID 1096 wrote to memory of 1452	1096	file.exe	31

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:1656
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:992
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1096 -s 48
  2⤵
  - Program crash
  PID:1452

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/992-54-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/992-56-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/992-65-0x00000000767D1000-0x00000000767D3000-memory.dmp

Download

memory/992-66-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/992-69-0x00000000000A0000-0x00000000000AD000-memory.dmp

Download

memory/992-67-0x0000000000080000-0x0000000000089000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads