lgoogloader | bf9cbad13935f939f44add9a131188c73e3dda014e039debc553ebacab228d83 | Triage

Analysis

max time kernel
90s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
05-01-2023 19:51

Sharing

Report Analysis Logs

General

Target

bf9cbad13935f939f44add9a131188c73e3dda014e039debc553ebacab228d83.exe
Size

1.3MB
MD5

35d19a9ba44fa423cb90f734f53de2aa
SHA1

104f7b53b01d3b6a7ff871b51057c3193b431a23
SHA256

bf9cbad13935f939f44add9a131188c73e3dda014e039debc553ebacab228d83
SHA512

e85c53d709977ff9f17abcbb48f02d72b8792be4393b10146f983c325c8d023d439372fb448c27ca60eb58f70c6e7139581b059d06edcb25dbfe8abcf63f5a25
SSDEEP

12288:yy7iK8b0X+aOAQhWL+Yr0+Et5iV4mSKj7+QHa+ZGJ8/83tPAjb5nZK0cfCoA8rKD:wXKhC8sPsbnaAmsVkonYyd3h

Score

10^/10

lgoogloader downloader persistence

Malware Config

Signatures

Detects LgoogLoader payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4200-140-0x0000000001340000-0x000000000134D000-memory.dmp	family_lgoogloader

LgoogLoader
A downloader capable of dropping and executing other malware families.
downloader lgoogloader

Sets service image path in registry 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

Processes:

bf9cbad13935f939f44add9a131188c73e3dda014e039debc553ebacab228d83.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\TaskKill\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\Иисус.sys"	bf9cbad13935f939f44add9a131188c73e3dda014e039debc553ebacab228d83.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

bf9cbad13935f939f44add9a131188c73e3dda014e039debc553ebacab228d83.exe

description	pid	process	target process
PID 2276 set thread context of 4200	2276	bf9cbad13935f939f44add9a131188c73e3dda014e039debc553ebacab228d83.exe	AddInProcess32.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

bf9cbad13935f939f44add9a131188c73e3dda014e039debc553ebacab228d83.exe

pid	process
2276	bf9cbad13935f939f44add9a131188c73e3dda014e039debc553ebacab228d83.exe
2276	bf9cbad13935f939f44add9a131188c73e3dda014e039debc553ebacab228d83.exe
2276	bf9cbad13935f939f44add9a131188c73e3dda014e039debc553ebacab228d83.exe
2276	bf9cbad13935f939f44add9a131188c73e3dda014e039debc553ebacab228d83.exe
2276	bf9cbad13935f939f44add9a131188c73e3dda014e039debc553ebacab228d83.exe
2276	bf9cbad13935f939f44add9a131188c73e3dda014e039debc553ebacab228d83.exe
2276	bf9cbad13935f939f44add9a131188c73e3dda014e039debc553ebacab228d83.exe
2276	bf9cbad13935f939f44add9a131188c73e3dda014e039debc553ebacab228d83.exe
2276	bf9cbad13935f939f44add9a131188c73e3dda014e039debc553ebacab228d83.exe
2276	bf9cbad13935f939f44add9a131188c73e3dda014e039debc553ebacab228d83.exe
2276	bf9cbad13935f939f44add9a131188c73e3dda014e039debc553ebacab228d83.exe
2276	bf9cbad13935f939f44add9a131188c73e3dda014e039debc553ebacab228d83.exe
2276	bf9cbad13935f939f44add9a131188c73e3dda014e039debc553ebacab228d83.exe
2276	bf9cbad13935f939f44add9a131188c73e3dda014e039debc553ebacab228d83.exe
2276	bf9cbad13935f939f44add9a131188c73e3dda014e039debc553ebacab228d83.exe
2276	bf9cbad13935f939f44add9a131188c73e3dda014e039debc553ebacab228d83.exe
2276	bf9cbad13935f939f44add9a131188c73e3dda014e039debc553ebacab228d83.exe
2276	bf9cbad13935f939f44add9a131188c73e3dda014e039debc553ebacab228d83.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

bf9cbad13935f939f44add9a131188c73e3dda014e039debc553ebacab228d83.exe

pid process

2276 bf9cbad13935f939f44add9a131188c73e3dda014e039debc553ebacab228d83.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

bf9cbad13935f939f44add9a131188c73e3dda014e039debc553ebacab228d83.exe

description	pid	process
Token: SeDebugPrivilege	2276	bf9cbad13935f939f44add9a131188c73e3dda014e039debc553ebacab228d83.exe
Token: SeLoadDriverPrivilege	2276	bf9cbad13935f939f44add9a131188c73e3dda014e039debc553ebacab228d83.exe
Token: SeDebugPrivilege	2276	bf9cbad13935f939f44add9a131188c73e3dda014e039debc553ebacab228d83.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

bf9cbad13935f939f44add9a131188c73e3dda014e039debc553ebacab228d83.exe

description	pid	process	target process
PID 2276 wrote to memory of 4912	2276	bf9cbad13935f939f44add9a131188c73e3dda014e039debc553ebacab228d83.exe	cvtres.exe
PID 2276 wrote to memory of 4912	2276	bf9cbad13935f939f44add9a131188c73e3dda014e039debc553ebacab228d83.exe	cvtres.exe
PID 2276 wrote to memory of 4804	2276	bf9cbad13935f939f44add9a131188c73e3dda014e039debc553ebacab228d83.exe	ngentask.exe
PID 2276 wrote to memory of 4804	2276	bf9cbad13935f939f44add9a131188c73e3dda014e039debc553ebacab228d83.exe	ngentask.exe
PID 2276 wrote to memory of 4920	2276	bf9cbad13935f939f44add9a131188c73e3dda014e039debc553ebacab228d83.exe	aspnet_regiis.exe
PID 2276 wrote to memory of 4920	2276	bf9cbad13935f939f44add9a131188c73e3dda014e039debc553ebacab228d83.exe	aspnet_regiis.exe
PID 2276 wrote to memory of 4844	2276	bf9cbad13935f939f44add9a131188c73e3dda014e039debc553ebacab228d83.exe	aspnet_wp.exe
PID 2276 wrote to memory of 4844	2276	bf9cbad13935f939f44add9a131188c73e3dda014e039debc553ebacab228d83.exe	aspnet_wp.exe
PID 2276 wrote to memory of 4928	2276	bf9cbad13935f939f44add9a131188c73e3dda014e039debc553ebacab228d83.exe	AddInUtil.exe
PID 2276 wrote to memory of 4928	2276	bf9cbad13935f939f44add9a131188c73e3dda014e039debc553ebacab228d83.exe	AddInUtil.exe
PID 2276 wrote to memory of 2860	2276	bf9cbad13935f939f44add9a131188c73e3dda014e039debc553ebacab228d83.exe	InstallUtil.exe
PID 2276 wrote to memory of 2860	2276	bf9cbad13935f939f44add9a131188c73e3dda014e039debc553ebacab228d83.exe	InstallUtil.exe
PID 2276 wrote to memory of 900	2276	bf9cbad13935f939f44add9a131188c73e3dda014e039debc553ebacab228d83.exe	WsatConfig.exe
PID 2276 wrote to memory of 900	2276	bf9cbad13935f939f44add9a131188c73e3dda014e039debc553ebacab228d83.exe	WsatConfig.exe
PID 2276 wrote to memory of 1288	2276	bf9cbad13935f939f44add9a131188c73e3dda014e039debc553ebacab228d83.exe	SMSvcHost.exe
PID 2276 wrote to memory of 1288	2276	bf9cbad13935f939f44add9a131188c73e3dda014e039debc553ebacab228d83.exe	SMSvcHost.exe
PID 2276 wrote to memory of 2832	2276	bf9cbad13935f939f44add9a131188c73e3dda014e039debc553ebacab228d83.exe	EdmGen.exe
PID 2276 wrote to memory of 2832	2276	bf9cbad13935f939f44add9a131188c73e3dda014e039debc553ebacab228d83.exe	EdmGen.exe
PID 2276 wrote to memory of 4200	2276	bf9cbad13935f939f44add9a131188c73e3dda014e039debc553ebacab228d83.exe	AddInProcess32.exe
PID 2276 wrote to memory of 4200	2276	bf9cbad13935f939f44add9a131188c73e3dda014e039debc553ebacab228d83.exe	AddInProcess32.exe
PID 2276 wrote to memory of 4200	2276	bf9cbad13935f939f44add9a131188c73e3dda014e039debc553ebacab228d83.exe	AddInProcess32.exe
PID 2276 wrote to memory of 4200	2276	bf9cbad13935f939f44add9a131188c73e3dda014e039debc553ebacab228d83.exe	AddInProcess32.exe
PID 2276 wrote to memory of 4200	2276	bf9cbad13935f939f44add9a131188c73e3dda014e039debc553ebacab228d83.exe	AddInProcess32.exe
PID 2276 wrote to memory of 4200	2276	bf9cbad13935f939f44add9a131188c73e3dda014e039debc553ebacab228d83.exe	AddInProcess32.exe
PID 2276 wrote to memory of 4200	2276	bf9cbad13935f939f44add9a131188c73e3dda014e039debc553ebacab228d83.exe	AddInProcess32.exe
PID 2276 wrote to memory of 4200	2276	bf9cbad13935f939f44add9a131188c73e3dda014e039debc553ebacab228d83.exe	AddInProcess32.exe
PID 2276 wrote to memory of 4200	2276	bf9cbad13935f939f44add9a131188c73e3dda014e039debc553ebacab228d83.exe	AddInProcess32.exe
PID 2276 wrote to memory of 4200	2276	bf9cbad13935f939f44add9a131188c73e3dda014e039debc553ebacab228d83.exe	AddInProcess32.exe

C:\Users\Admin\AppData\Local\Temp\bf9cbad13935f939f44add9a131188c73e3dda014e039debc553ebacab228d83.exe
"C:\Users\Admin\AppData\Local\Temp\bf9cbad13935f939f44add9a131188c73e3dda014e039debc553ebacab228d83.exe"
1⤵
- Sets service image path in registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2276

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe"
2⤵
PID:4912

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe"
2⤵
PID:4804

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe"
2⤵
PID:4920

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe"
2⤵
PID:4844

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe"
2⤵
PID:4928

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
2⤵
PID:2860

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe"
2⤵
PID:900

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe"
2⤵
PID:1288

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe"
2⤵
PID:2832

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe"
2⤵
PID:4200

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2276-132-0x000001C3602A0000-0x000001C3603EA000-memory.dmp

Filesize
1.3MB

Download
memory/2276-133-0x00007FF852980000-0x00007FF853441000-memory.dmp

Filesize
10.8MB

Download
memory/2276-137-0x00007FF852980000-0x00007FF853441000-memory.dmp

Filesize
10.8MB

Download
memory/4200-134-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4200-135-0x0000000000403BA0-mapping.dmp

Download
memory/4200-136-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4200-138-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4200-139-0x0000000001320000-0x0000000001329000-memory.dmp

Filesize
36KB

Download
memory/4200-140-0x0000000001340000-0x000000000134D000-memory.dmp

Filesize
52KB

Download
memory/4200-141-0x0000000001340000-0x000000000134D000-memory.dmp

Filesize
52KB

Download