lgoogloader | 6be56dd56ec252564c301fef4f5358ec3be73204292e12ec3dc9bf1cf82da0f8 | Triage

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05-01-2023 23:44

Sharing

Report Analysis Logs

General

Target

2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe
Size

1.3MB
MD5

085d7d21c6ff8b6f77780c4f26625c11
SHA1

0a8d4223d443bfa522d5e6d7b3da24a06cd6dcf8
SHA256

2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168
SHA512

f04adc279b1a89639cdd133b0da2392228c574dacb03a8c632a74f58086748ead01491d2b6566d2a51c458af02354db6e9e7a361014dc502d55fb416d24421c4
SSDEEP

12288:fFv7opISOM5xl4RAkDf5rN1uhleQI/LiLXjnUf8T6sIAFXCssNtk2o+Ah2RDDt+b:9LArlx3YF1ScCy1gOfLcJda5u3D5

Score

10^/10

lgoogloader downloader persistence

Malware Config

Signatures

Detects LgoogLoader payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1740-62-0x00000000000B0000-0x00000000000BD000-memory.dmp	family_lgoogloader

LgoogLoader
A downloader capable of dropping and executing other malware families.
downloader lgoogloader

Sets service image path in registry 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

Processes:

2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\TaskKill\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\Иисус.sys"	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe

description	pid	process	target process
PID 1800 set thread context of 1740	1800	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	jsc.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

Processes:

2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe

pid	process
1800	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe
1800	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe
1800	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe
1800	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe
1800	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe
1800	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe
1800	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe
1800	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe
1800	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe
1800	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe
1800	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe
1800	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe
1800	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe
1800	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe
1800	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe
1800	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe
1800	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe
1800	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe
1800	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe
1800	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe
1800	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe
1800	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe
1800	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe
1800	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe

pid process

1800 2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe

description	pid	process
Token: SeDebugPrivilege	1800	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe
Token: SeLoadDriverPrivilege	1800	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe
Token: SeDebugPrivilege	1800	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe

Suspicious use of WriteProcessMemory 52 IoCs

Processes:

2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe

description	pid	process	target process
PID 1800 wrote to memory of 564	1800	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	ilasm.exe
PID 1800 wrote to memory of 564	1800	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	ilasm.exe
PID 1800 wrote to memory of 564	1800	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	ilasm.exe
PID 1800 wrote to memory of 880	1800	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	SetupUtility.exe
PID 1800 wrote to memory of 880	1800	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	SetupUtility.exe
PID 1800 wrote to memory of 880	1800	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	SetupUtility.exe
PID 1800 wrote to memory of 880	1800	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	SetupUtility.exe
PID 1800 wrote to memory of 880	1800	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	SetupUtility.exe
PID 1800 wrote to memory of 880	1800	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	SetupUtility.exe
PID 1800 wrote to memory of 880	1800	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	SetupUtility.exe
PID 1800 wrote to memory of 1040	1800	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	ComSvcConfig.exe
PID 1800 wrote to memory of 1040	1800	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	ComSvcConfig.exe
PID 1800 wrote to memory of 1040	1800	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	ComSvcConfig.exe
PID 1800 wrote to memory of 516	1800	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	aspnet_wp.exe
PID 1800 wrote to memory of 516	1800	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	aspnet_wp.exe
PID 1800 wrote to memory of 516	1800	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	aspnet_wp.exe
PID 1800 wrote to memory of 580	1800	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	csc.exe
PID 1800 wrote to memory of 580	1800	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	csc.exe
PID 1800 wrote to memory of 580	1800	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	csc.exe
PID 1800 wrote to memory of 460	1800	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	CasPol.exe
PID 1800 wrote to memory of 460	1800	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	CasPol.exe
PID 1800 wrote to memory of 460	1800	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	CasPol.exe
PID 1800 wrote to memory of 1488	1800	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	WsatConfig.exe
PID 1800 wrote to memory of 1488	1800	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	WsatConfig.exe
PID 1800 wrote to memory of 1488	1800	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	WsatConfig.exe
PID 1800 wrote to memory of 656	1800	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	RegSvcs.exe
PID 1800 wrote to memory of 656	1800	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	RegSvcs.exe
PID 1800 wrote to memory of 656	1800	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	RegSvcs.exe
PID 1800 wrote to memory of 1160	1800	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	aspnet_regbrowsers.exe
PID 1800 wrote to memory of 1160	1800	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	aspnet_regbrowsers.exe
PID 1800 wrote to memory of 1160	1800	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	aspnet_regbrowsers.exe
PID 1800 wrote to memory of 1444	1800	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	EdmGen.exe
PID 1800 wrote to memory of 1444	1800	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	EdmGen.exe
PID 1800 wrote to memory of 1444	1800	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	EdmGen.exe
PID 1800 wrote to memory of 1172	1800	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	InstallUtil.exe
PID 1800 wrote to memory of 1172	1800	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	InstallUtil.exe
PID 1800 wrote to memory of 1172	1800	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	InstallUtil.exe
PID 1800 wrote to memory of 336	1800	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	aspnet_compiler.exe
PID 1800 wrote to memory of 336	1800	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	aspnet_compiler.exe
PID 1800 wrote to memory of 336	1800	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	aspnet_compiler.exe
PID 1800 wrote to memory of 1740	1800	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	jsc.exe
PID 1800 wrote to memory of 1740	1800	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	jsc.exe
PID 1800 wrote to memory of 1740	1800	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	jsc.exe
PID 1800 wrote to memory of 1740	1800	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	jsc.exe
PID 1800 wrote to memory of 1740	1800	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	jsc.exe
PID 1800 wrote to memory of 1740	1800	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	jsc.exe
PID 1800 wrote to memory of 1740	1800	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	jsc.exe
PID 1800 wrote to memory of 1740	1800	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	jsc.exe
PID 1800 wrote to memory of 1740	1800	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	jsc.exe
PID 1800 wrote to memory of 1740	1800	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	jsc.exe
PID 1800 wrote to memory of 1740	1800	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	jsc.exe
PID 1800 wrote to memory of 1740	1800	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	jsc.exe

C:\Users\Admin\AppData\Local\Temp\2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe
"C:\Users\Admin\AppData\Local\Temp\2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe"
1⤵
- Sets service image path in registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1800

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe"
2⤵
PID:564

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\SetupUtility.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\SetupUtility.exe"
2⤵
PID:880

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe"
2⤵
PID:1040

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe"
2⤵
PID:516

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"
2⤵
PID:580

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe"
2⤵
PID:460

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe"
2⤵
PID:1488

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe"
2⤵
PID:656

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe"
2⤵
PID:1160

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe"
2⤵
PID:1444

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
2⤵
PID:1172

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"
2⤵
PID:336

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe"
2⤵
PID:1740

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1740-56-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1740-57-0x0000000000403980-mapping.dmp

Download
memory/1740-60-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1740-59-0x00000000760D1000-0x00000000760D3000-memory.dmp

Filesize
8KB

Download
memory/1740-61-0x0000000000090000-0x0000000000099000-memory.dmp

Filesize
36KB

Download
memory/1740-62-0x00000000000B0000-0x00000000000BD000-memory.dmp

Filesize
52KB

Download
memory/1800-54-0x0000000000110000-0x000000000026A000-memory.dmp

Filesize
1.4MB

Download
memory/1800-55-0x00000000003E0000-0x0000000000462000-memory.dmp

Filesize
520KB

Download