lgoogloader | 6be56dd56ec252564c301fef4f5358ec3be73204292e12ec3dc9bf1cf82da0f8 | Triage

Analysis

max time kernel
65s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05-01-2023 23:44

Sharing

Report Analysis Logs

General

Target

2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe
Size

1.3MB
MD5

085d7d21c6ff8b6f77780c4f26625c11
SHA1

0a8d4223d443bfa522d5e6d7b3da24a06cd6dcf8
SHA256

2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168
SHA512

f04adc279b1a89639cdd133b0da2392228c574dacb03a8c632a74f58086748ead01491d2b6566d2a51c458af02354db6e9e7a361014dc502d55fb416d24421c4
SSDEEP

12288:fFv7opISOM5xl4RAkDf5rN1uhleQI/LiLXjnUf8T6sIAFXCssNtk2o+Ah2RDDt+b:9LArlx3YF1ScCy1gOfLcJda5u3D5

Score

10^/10

lgoogloader downloader persistence

Malware Config

Signatures

Detects LgoogLoader payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2132-140-0x0000000002B80000-0x0000000002B8D000-memory.dmp	family_lgoogloader

LgoogLoader
A downloader capable of dropping and executing other malware families.
downloader lgoogloader

Sets service image path in registry 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

Processes:

2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\TaskKill\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\Иисус.sys"	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe

description	pid	process	target process
PID 4656 set thread context of 2132	4656	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	AddInProcess32.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

Processes:

2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe

pid	process
4656	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe
4656	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe
4656	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe
4656	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe
4656	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe
4656	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe
4656	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe
4656	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe
4656	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe
4656	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe
4656	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe
4656	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe
4656	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe
4656	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe
4656	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe
4656	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe
4656	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe
4656	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe
4656	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe
4656	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe
4656	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe
4656	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe

pid process

4656 2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe

description	pid	process
Token: SeDebugPrivilege	4656	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe
Token: SeLoadDriverPrivilege	4656	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe
Token: SeDebugPrivilege	4656	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe

Suspicious use of WriteProcessMemory 33 IoCs

Processes:

2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe

description	pid	process	target process
PID 4656 wrote to memory of 2140	4656	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	aspnet_regiis.exe
PID 4656 wrote to memory of 2140	4656	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	aspnet_regiis.exe
PID 4656 wrote to memory of 2556	4656	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	csc.exe
PID 4656 wrote to memory of 2556	4656	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	csc.exe
PID 4656 wrote to memory of 1132	4656	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	aspnet_regsql.exe
PID 4656 wrote to memory of 1132	4656	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	aspnet_regsql.exe
PID 4656 wrote to memory of 1428	4656	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	SMSvcHost.exe
PID 4656 wrote to memory of 1428	4656	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	SMSvcHost.exe
PID 4656 wrote to memory of 1468	4656	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	aspnet_compiler.exe
PID 4656 wrote to memory of 1468	4656	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	aspnet_compiler.exe
PID 4656 wrote to memory of 4696	4656	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	mscorsvw.exe
PID 4656 wrote to memory of 4696	4656	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	mscorsvw.exe
PID 4656 wrote to memory of 2976	4656	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	InstallUtil.exe
PID 4656 wrote to memory of 2976	4656	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	InstallUtil.exe
PID 4656 wrote to memory of 5056	4656	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	ComSvcConfig.exe
PID 4656 wrote to memory of 5056	4656	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	ComSvcConfig.exe
PID 4656 wrote to memory of 2816	4656	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	aspnet_wp.exe
PID 4656 wrote to memory of 2816	4656	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	aspnet_wp.exe
PID 4656 wrote to memory of 3264	4656	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	ServiceModelReg.exe
PID 4656 wrote to memory of 3264	4656	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	ServiceModelReg.exe
PID 4656 wrote to memory of 1904	4656	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	CasPol.exe
PID 4656 wrote to memory of 1904	4656	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	CasPol.exe
PID 4656 wrote to memory of 2132	4656	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	AddInProcess32.exe
PID 4656 wrote to memory of 2132	4656	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	AddInProcess32.exe
PID 4656 wrote to memory of 2132	4656	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	AddInProcess32.exe
PID 4656 wrote to memory of 2132	4656	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	AddInProcess32.exe
PID 4656 wrote to memory of 2132	4656	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	AddInProcess32.exe
PID 4656 wrote to memory of 2132	4656	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	AddInProcess32.exe
PID 4656 wrote to memory of 2132	4656	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	AddInProcess32.exe
PID 4656 wrote to memory of 2132	4656	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	AddInProcess32.exe
PID 4656 wrote to memory of 2132	4656	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	AddInProcess32.exe
PID 4656 wrote to memory of 2132	4656	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	AddInProcess32.exe
PID 4656 wrote to memory of 2132	4656	2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe	AddInProcess32.exe

C:\Users\Admin\AppData\Local\Temp\2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe
"C:\Users\Admin\AppData\Local\Temp\2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168.exe"
1⤵
- Sets service image path in registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4656

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe"
2⤵
PID:2140

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"
2⤵
PID:2556

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe"
2⤵
PID:1132

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe"
2⤵
PID:1428

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe"
2⤵
PID:4696

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"
2⤵
PID:1468

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
2⤵
PID:2976

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe"
2⤵
PID:5056

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe"
2⤵
PID:2816

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"
2⤵
PID:3264

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe"
2⤵
PID:1904

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe"
2⤵
PID:2132

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2132-135-0x0000000000403980-mapping.dmp

Download
memory/2132-134-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2132-136-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2132-138-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2132-139-0x0000000002B60000-0x0000000002B69000-memory.dmp

Filesize
36KB

Download
memory/2132-140-0x0000000002B80000-0x0000000002B8D000-memory.dmp

Filesize
52KB

Download
memory/4656-132-0x00000115BF200000-0x00000115BF35A000-memory.dmp

Filesize
1.4MB

Download
memory/4656-133-0x00007FFE1C5A0000-0x00007FFE1D061000-memory.dmp

Filesize
10.8MB

Download
memory/4656-137-0x00007FFE1C5A0000-0x00007FFE1D061000-memory.dmp

Filesize
10.8MB

Download