lgoogloader | 08d04ae40642e0e82bb05e71df5ca2df95af9144392d4b59e9f88bfc86dd2a92

Analysis

max time kernel
137s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06-01-2023 07:16

Target

file.exe
Size

2.2MB
MD5

2e03bba61c7afce2e5f70fda0fb997c0
SHA1

2e8d7835acd2eed0c9d9e77e7271469c3d95ce2c
SHA256

08d04ae40642e0e82bb05e71df5ca2df95af9144392d4b59e9f88bfc86dd2a92
SHA512

d8f9de32424432c55fe81b809c3558476d196fa2a8c649c2144daa82fdc4078c7aba925a061d87ee1368c0187b64f98841cc2d56daa0175d67faf3c033a553f0
SSDEEP

24576:bhZT4+g+xacuh9UHHxf+IgKuxjBSMQ0LGkjFH7lFmQ5pSaoV/6XpOo/P/UpKW1VB:bha30RPOSMQ0xx5rSaNP/w9/PXCE5X

Score

10^/10

Detects LgoogLoader payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4068-142-0x0000000003120000-0x000000000312D000-memory.dmp	family_lgoogloader

LgoogLoader
A downloader capable of dropping and executing other malware families.
downloader lgoogloader
Suspicious use of SetThreadContext 1 IoCs

Processes:

file.exe

description pid process target process

PID 3044 set thread context of 4068 3044 file.exe ngentask.exe
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

2824 3044 WerFault.exe file.exe
4764 3044 WerFault.exe file.exe

description	pid	process	target process
PID 3044 set thread context of 4068	3044	file.exe	ngentask.exe

pid	pid_target	process	target process
2824	3044	WerFault.exe	file.exe
4764	3044	WerFault.exe	file.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

Processes:

file.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

file.exe

description	pid	process	target process
PID 3044 wrote to memory of 4068	3044	file.exe	ngentask.exe
PID 3044 wrote to memory of 4068	3044	file.exe	ngentask.exe
PID 3044 wrote to memory of 4068	3044	file.exe	ngentask.exe
PID 3044 wrote to memory of 4068	3044	file.exe	ngentask.exe
PID 3044 wrote to memory of 4068	3044	file.exe	ngentask.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"
2⤵
PID:4068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3044 -s 1224
2⤵
- Program crash
PID:2824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3044 -s 1180
2⤵
- Program crash
PID:4764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3044 -ip 3044
1⤵
PID:2724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3044 -ip 3044
1⤵
PID:4844

memory/3044-132-0x0000000002BC0000-0x0000000002D8B000-memory.dmp

Filesize
1.8MB

Download
memory/3044-133-0x000000000E3C0000-0x000000000E698000-memory.dmp

Filesize
2.8MB

Download
memory/3044-134-0x000000000E3C0000-0x000000000E698000-memory.dmp

Filesize
2.8MB

Download
memory/3044-143-0x0000000002BC0000-0x0000000002D8B000-memory.dmp

Filesize
1.8MB

Download
memory/4068-135-0x0000000000000000-mapping.dmp

Download
memory/4068-136-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4068-138-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4068-139-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4068-140-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4068-141-0x0000000001AE0000-0x0000000001AE9000-memory.dmp

Filesize
36KB

Download
memory/4068-142-0x0000000003120000-0x000000000312D000-memory.dmp

Filesize
52KB

Download