lgoogloader | 2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168 | Triage

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04-01-2023 19:16

Sharing

Report Analysis Logs

General

Target

2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe
Size

1.3MB
MD5

085d7d21c6ff8b6f77780c4f26625c11
SHA1

0a8d4223d443bfa522d5e6d7b3da24a06cd6dcf8
SHA256

2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168
SHA512

f04adc279b1a89639cdd133b0da2392228c574dacb03a8c632a74f58086748ead01491d2b6566d2a51c458af02354db6e9e7a361014dc502d55fb416d24421c4
SSDEEP

12288:fFv7opISOM5xl4RAkDf5rN1uhleQI/LiLXjnUf8T6sIAFXCssNtk2o+Ah2RDDt+b:9LArlx3YF1ScCy1gOfLcJda5u3D5

Score

10^/10

lgoogloader downloader persistence

Malware Config

Signatures

Detects LgoogLoader payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4904-140-0x0000000002670000-0x000000000267D000-memory.dmp	family_lgoogloader

LgoogLoader
A downloader capable of dropping and executing other malware families.
downloader lgoogloader

Sets service image path in registry 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

Processes:

2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\TaskKill\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\Иисус.sys"	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of SetThreadContext 1 IoCs

Processes:

2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe

description	pid	process	target process
PID 1932 set thread context of 4904	1932	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	jsc.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe

pid	process
1932	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe
1932	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe
1932	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe
1932	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe
1932	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe
1932	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe
1932	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe
1932	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe
1932	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe
1932	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe
1932	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe
1932	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe
1932	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe
1932	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe

pid process

1932 2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe

description	pid	process
Token: SeDebugPrivilege	1932	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe
Token: SeLoadDriverPrivilege	1932	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe
Token: SeDebugPrivilege	1932	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe

description	pid	process	target process
PID 1932 wrote to memory of 4848	1932	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	aspnet_state.exe
PID 1932 wrote to memory of 4848	1932	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	aspnet_state.exe
PID 1932 wrote to memory of 3732	1932	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	csc.exe
PID 1932 wrote to memory of 3732	1932	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	csc.exe
PID 1932 wrote to memory of 4880	1932	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	vbc.exe
PID 1932 wrote to memory of 4880	1932	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	vbc.exe
PID 1932 wrote to memory of 4832	1932	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	Microsoft.Workflow.Compiler.exe
PID 1932 wrote to memory of 4832	1932	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	Microsoft.Workflow.Compiler.exe
PID 1932 wrote to memory of 4892	1932	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	WsatConfig.exe
PID 1932 wrote to memory of 4892	1932	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	WsatConfig.exe
PID 1932 wrote to memory of 4896	1932	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	dfsvc.exe
PID 1932 wrote to memory of 4896	1932	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	dfsvc.exe
PID 1932 wrote to memory of 4800	1932	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	RegAsm.exe
PID 1932 wrote to memory of 4800	1932	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	RegAsm.exe
PID 1932 wrote to memory of 4904	1932	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	jsc.exe
PID 1932 wrote to memory of 4904	1932	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	jsc.exe
PID 1932 wrote to memory of 4904	1932	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	jsc.exe
PID 1932 wrote to memory of 4904	1932	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	jsc.exe
PID 1932 wrote to memory of 4904	1932	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	jsc.exe
PID 1932 wrote to memory of 4904	1932	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	jsc.exe
PID 1932 wrote to memory of 4904	1932	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	jsc.exe
PID 1932 wrote to memory of 4904	1932	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	jsc.exe
PID 1932 wrote to memory of 4904	1932	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	jsc.exe
PID 1932 wrote to memory of 4904	1932	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	jsc.exe
PID 1932 wrote to memory of 4904	1932	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	jsc.exe

C:\Users\Admin\AppData\Local\Temp\2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe
"C:\Users\Admin\AppData\Local\Temp\2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe"
1⤵
- Sets service image path in registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1932

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe"
2⤵
PID:4848

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"
2⤵
PID:3732

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe"
2⤵
PID:4880

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe"
2⤵
PID:4832

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe"
2⤵
PID:4892

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
2⤵
PID:4896

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe"
2⤵
PID:4800

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe"
2⤵
PID:4904

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Scripting

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1932-132-0x000001F0C6740000-0x000001F0C689A000-memory.dmp

Filesize
1.4MB

Download
memory/1932-133-0x00007FFCC3CB0000-0x00007FFCC4771000-memory.dmp

Filesize
10.8MB

Download
memory/1932-136-0x00007FFCC3CB0000-0x00007FFCC4771000-memory.dmp

Filesize
10.8MB

Download
memory/4904-134-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4904-135-0x0000000000403980-mapping.dmp

Download
memory/4904-137-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4904-138-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4904-139-0x00000000009A0000-0x00000000009A9000-memory.dmp

Filesize
36KB

Download
memory/4904-140-0x0000000002670000-0x000000000267D000-memory.dmp

Filesize
52KB

Download