lgoogloader | 08d04ae40642e0e82bb05e71df5ca2df95af9144392d4b59e9f88bfc86dd2a92

General

Target

08d04ae40642e0e82bb05e71df5ca2df95af9144392d4b59e9f88bfc86dd2a92.exe
Size

2.2MB
MD5

2e03bba61c7afce2e5f70fda0fb997c0
SHA1

2e8d7835acd2eed0c9d9e77e7271469c3d95ce2c
SHA256

08d04ae40642e0e82bb05e71df5ca2df95af9144392d4b59e9f88bfc86dd2a92
SHA512

d8f9de32424432c55fe81b809c3558476d196fa2a8c649c2144daa82fdc4078c7aba925a061d87ee1368c0187b64f98841cc2d56daa0175d67faf3c033a553f0
SSDEEP

24576:bhZT4+g+xacuh9UHHxf+IgKuxjBSMQ0LGkjFH7lFmQ5pSaoV/6XpOo/P/UpKW1VB:bha30RPOSMQ0xx5rSaNP/w9/PXCE5X

Score

10^/10

lgoogloader downloader

Malware Config

Signatures

Detects LgoogLoader payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4880-144-0x00000000014D0000-0x00000000014DD000-memory.dmp	family_lgoogloader

LgoogLoader
A downloader capable of dropping and executing other malware families.
downloader lgoogloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

08d04ae40642e0e82bb05e71df5ca2df95af9144392d4b59e9f88bfc86dd2a92.exe

description	pid	process	target process
PID 4536 set thread context of 4880	4536	08d04ae40642e0e82bb05e71df5ca2df95af9144392d4b59e9f88bfc86dd2a92.exe	ngentask.exe

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
4432	4536	WerFault.exe	08d04ae40642e0e82bb05e71df5ca2df95af9144392d4b59e9f88bfc86dd2a92.exe
2188	4536	WerFault.exe	08d04ae40642e0e82bb05e71df5ca2df95af9144392d4b59e9f88bfc86dd2a92.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

Processes:

08d04ae40642e0e82bb05e71df5ca2df95af9144392d4b59e9f88bfc86dd2a92.exe

pid	process
4536	08d04ae40642e0e82bb05e71df5ca2df95af9144392d4b59e9f88bfc86dd2a92.exe
4536	08d04ae40642e0e82bb05e71df5ca2df95af9144392d4b59e9f88bfc86dd2a92.exe
4536	08d04ae40642e0e82bb05e71df5ca2df95af9144392d4b59e9f88bfc86dd2a92.exe
4536	08d04ae40642e0e82bb05e71df5ca2df95af9144392d4b59e9f88bfc86dd2a92.exe
4536	08d04ae40642e0e82bb05e71df5ca2df95af9144392d4b59e9f88bfc86dd2a92.exe
4536	08d04ae40642e0e82bb05e71df5ca2df95af9144392d4b59e9f88bfc86dd2a92.exe
4536	08d04ae40642e0e82bb05e71df5ca2df95af9144392d4b59e9f88bfc86dd2a92.exe
4536	08d04ae40642e0e82bb05e71df5ca2df95af9144392d4b59e9f88bfc86dd2a92.exe
4536	08d04ae40642e0e82bb05e71df5ca2df95af9144392d4b59e9f88bfc86dd2a92.exe
4536	08d04ae40642e0e82bb05e71df5ca2df95af9144392d4b59e9f88bfc86dd2a92.exe
4536	08d04ae40642e0e82bb05e71df5ca2df95af9144392d4b59e9f88bfc86dd2a92.exe
4536	08d04ae40642e0e82bb05e71df5ca2df95af9144392d4b59e9f88bfc86dd2a92.exe
4536	08d04ae40642e0e82bb05e71df5ca2df95af9144392d4b59e9f88bfc86dd2a92.exe
4536	08d04ae40642e0e82bb05e71df5ca2df95af9144392d4b59e9f88bfc86dd2a92.exe
4536	08d04ae40642e0e82bb05e71df5ca2df95af9144392d4b59e9f88bfc86dd2a92.exe
4536	08d04ae40642e0e82bb05e71df5ca2df95af9144392d4b59e9f88bfc86dd2a92.exe
4536	08d04ae40642e0e82bb05e71df5ca2df95af9144392d4b59e9f88bfc86dd2a92.exe
4536	08d04ae40642e0e82bb05e71df5ca2df95af9144392d4b59e9f88bfc86dd2a92.exe
4536	08d04ae40642e0e82bb05e71df5ca2df95af9144392d4b59e9f88bfc86dd2a92.exe
4536	08d04ae40642e0e82bb05e71df5ca2df95af9144392d4b59e9f88bfc86dd2a92.exe
4536	08d04ae40642e0e82bb05e71df5ca2df95af9144392d4b59e9f88bfc86dd2a92.exe
4536	08d04ae40642e0e82bb05e71df5ca2df95af9144392d4b59e9f88bfc86dd2a92.exe
4536	08d04ae40642e0e82bb05e71df5ca2df95af9144392d4b59e9f88bfc86dd2a92.exe
4536	08d04ae40642e0e82bb05e71df5ca2df95af9144392d4b59e9f88bfc86dd2a92.exe
4536	08d04ae40642e0e82bb05e71df5ca2df95af9144392d4b59e9f88bfc86dd2a92.exe
4536	08d04ae40642e0e82bb05e71df5ca2df95af9144392d4b59e9f88bfc86dd2a92.exe
4536	08d04ae40642e0e82bb05e71df5ca2df95af9144392d4b59e9f88bfc86dd2a92.exe
4536	08d04ae40642e0e82bb05e71df5ca2df95af9144392d4b59e9f88bfc86dd2a92.exe
4536	08d04ae40642e0e82bb05e71df5ca2df95af9144392d4b59e9f88bfc86dd2a92.exe
4536	08d04ae40642e0e82bb05e71df5ca2df95af9144392d4b59e9f88bfc86dd2a92.exe
4536	08d04ae40642e0e82bb05e71df5ca2df95af9144392d4b59e9f88bfc86dd2a92.exe
4536	08d04ae40642e0e82bb05e71df5ca2df95af9144392d4b59e9f88bfc86dd2a92.exe
4536	08d04ae40642e0e82bb05e71df5ca2df95af9144392d4b59e9f88bfc86dd2a92.exe
4536	08d04ae40642e0e82bb05e71df5ca2df95af9144392d4b59e9f88bfc86dd2a92.exe
4536	08d04ae40642e0e82bb05e71df5ca2df95af9144392d4b59e9f88bfc86dd2a92.exe
4536	08d04ae40642e0e82bb05e71df5ca2df95af9144392d4b59e9f88bfc86dd2a92.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

08d04ae40642e0e82bb05e71df5ca2df95af9144392d4b59e9f88bfc86dd2a92.exe

description	pid	process	target process
PID 4536 wrote to memory of 4732	4536	08d04ae40642e0e82bb05e71df5ca2df95af9144392d4b59e9f88bfc86dd2a92.exe	ngentask.exe
PID 4536 wrote to memory of 4732	4536	08d04ae40642e0e82bb05e71df5ca2df95af9144392d4b59e9f88bfc86dd2a92.exe	ngentask.exe
PID 4536 wrote to memory of 4732	4536	08d04ae40642e0e82bb05e71df5ca2df95af9144392d4b59e9f88bfc86dd2a92.exe	ngentask.exe
PID 4536 wrote to memory of 1328	4536	08d04ae40642e0e82bb05e71df5ca2df95af9144392d4b59e9f88bfc86dd2a92.exe	ngentask.exe
PID 4536 wrote to memory of 1328	4536	08d04ae40642e0e82bb05e71df5ca2df95af9144392d4b59e9f88bfc86dd2a92.exe	ngentask.exe
PID 4536 wrote to memory of 1328	4536	08d04ae40642e0e82bb05e71df5ca2df95af9144392d4b59e9f88bfc86dd2a92.exe	ngentask.exe
PID 4536 wrote to memory of 4880	4536	08d04ae40642e0e82bb05e71df5ca2df95af9144392d4b59e9f88bfc86dd2a92.exe	ngentask.exe
PID 4536 wrote to memory of 4880	4536	08d04ae40642e0e82bb05e71df5ca2df95af9144392d4b59e9f88bfc86dd2a92.exe	ngentask.exe
PID 4536 wrote to memory of 4880	4536	08d04ae40642e0e82bb05e71df5ca2df95af9144392d4b59e9f88bfc86dd2a92.exe	ngentask.exe
PID 4536 wrote to memory of 4880	4536	08d04ae40642e0e82bb05e71df5ca2df95af9144392d4b59e9f88bfc86dd2a92.exe	ngentask.exe
PID 4536 wrote to memory of 4880	4536	08d04ae40642e0e82bb05e71df5ca2df95af9144392d4b59e9f88bfc86dd2a92.exe	ngentask.exe

C:\Users\Admin\AppData\Local\Temp\08d04ae40642e0e82bb05e71df5ca2df95af9144392d4b59e9f88bfc86dd2a92.exe
"C:\Users\Admin\AppData\Local\Temp\08d04ae40642e0e82bb05e71df5ca2df95af9144392d4b59e9f88bfc86dd2a92.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4536

C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"
2⤵
PID:4732

C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"
2⤵
PID:1328

C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"
2⤵
PID:4880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4536 -s 1192
2⤵
- Program crash
PID:4432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4536 -s 1096
2⤵
- Program crash
PID:2188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4536 -ip 4536
1⤵
PID:4528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4536 -ip 4536
1⤵
PID:1968

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1328-136-0x0000000000000000-mapping.dmp

Download
memory/4536-132-0x0000000003270000-0x000000000343B000-memory.dmp

Filesize
1.8MB

Download
memory/4536-133-0x000000000C4C0000-0x000000000C798000-memory.dmp

Filesize
2.8MB

Download
memory/4536-134-0x000000000C4C0000-0x000000000C798000-memory.dmp

Filesize
2.8MB

Download
memory/4536-145-0x0000000003270000-0x000000000343B000-memory.dmp

Filesize
1.8MB

Download
memory/4732-135-0x0000000000000000-mapping.dmp

Download
memory/4880-138-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4880-140-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4880-141-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4880-142-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4880-143-0x00000000010B0000-0x00000000010B9000-memory.dmp

Filesize
36KB

Download
memory/4880-144-0x00000000014D0000-0x00000000014DD000-memory.dmp

Filesize
52KB

Download
memory/4880-137-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads