Analysis
-
max time kernel
86s -
max time network
148s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
08-01-2023 19:21
Static task
static1
Behavioral task
behavioral1
Sample
75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe
Resource
win10-20220812-en
General
-
Target
75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe
-
Size
2.1MB
-
MD5
e52f5370a68e1ee7b5f24b708924025b
-
SHA1
bf920f1fe420f1c8dc8dba7112f1b57bf0d6dfb7
-
SHA256
75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a
-
SHA512
7a2245652656888ec46a4a081aaa52ca86723b6d251059882b756fd0b7c8b0a576ad29c0b46fe3706a40d680c3940f3cadbd3716de98066b64b0b904fb624286
-
SSDEEP
49152:B61lu6RZizQwhPuMaWFVCInTda0xW7hl8A:gG6KQwh2Mao9w+W7DZ
Malware Config
Extracted
vidar
1.8
641
https://t.me/year2023start
https://steamcommunity.com/profiles/76561199467421923
-
profile_id
641
Signatures
-
Detects LgoogLoader payload 1 IoCs
resource yara_rule behavioral1/memory/4824-207-0x0000000000F60000-0x0000000000F6D000-memory.dmp family_lgoogloader -
LgoogLoader
A downloader capable of dropping and executing other malware families.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 2728 created 2720 2728 75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe 33 -
Loads dropped DLL 3 IoCs
pid Process 2728 75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe 3752 fontview.exe 3752 fontview.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2728 set thread context of 4824 2728 75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe 68 -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 fontview.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString fontview.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 4536 timeout.exe -
Suspicious behavior: EnumeratesProcesses 42 IoCs
pid Process 2728 75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe 2728 75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe 2728 75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe 2728 75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe 2728 75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe 2728 75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe 2728 75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe 2728 75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe 2728 75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe 2728 75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe 2728 75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe 2728 75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe 2728 75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe 2728 75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe 2728 75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe 2728 75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe 2728 75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe 2728 75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe 2728 75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe 2728 75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe 2728 75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe 2728 75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe 2728 75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe 2728 75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe 2728 75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe 2728 75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe 2728 75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe 2728 75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe 2728 75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe 2728 75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe 2728 75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe 2728 75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe 2728 75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe 2728 75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe 2728 75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe 2728 75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe 2728 75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe 2728 75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe 2728 75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe 2728 75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe 3752 fontview.exe 3752 fontview.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 2728 wrote to memory of 4772 2728 75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe 66 PID 2728 wrote to memory of 4772 2728 75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe 66 PID 2728 wrote to memory of 4772 2728 75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe 66 PID 2728 wrote to memory of 4816 2728 75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe 67 PID 2728 wrote to memory of 4816 2728 75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe 67 PID 2728 wrote to memory of 4816 2728 75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe 67 PID 2728 wrote to memory of 4824 2728 75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe 68 PID 2728 wrote to memory of 4824 2728 75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe 68 PID 2728 wrote to memory of 4824 2728 75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe 68 PID 2728 wrote to memory of 4824 2728 75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe 68 PID 2728 wrote to memory of 4824 2728 75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe 68 PID 2728 wrote to memory of 3752 2728 75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe 69 PID 2728 wrote to memory of 3752 2728 75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe 69 PID 2728 wrote to memory of 3752 2728 75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe 69 PID 2728 wrote to memory of 3752 2728 75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe 69 PID 3752 wrote to memory of 4900 3752 fontview.exe 71 PID 3752 wrote to memory of 4900 3752 fontview.exe 71 PID 3752 wrote to memory of 4900 3752 fontview.exe 71 PID 4900 wrote to memory of 4536 4900 cmd.exe 73 PID 4900 wrote to memory of 4536 4900 cmd.exe 73 PID 4900 wrote to memory of 4536 4900 cmd.exe 73
Processes
-
c:\windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2720
-
C:\Windows\SYSWOW64\fontview.exe"C:\Windows\SYSWOW64\fontview.exe"2⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3752 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Windows\SysWOW64\fontview.exe" & exit3⤵
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Windows\SysWOW64\timeout.exetimeout /t 64⤵
- Delays execution with timeout.exe
PID:4536
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe"C:\Users\Admin\AppData\Local\Temp\75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe"1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"2⤵PID:4772
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"2⤵PID:4816
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"2⤵PID:4824
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
133KB
MD58f73c08a9660691143661bf7332c3c27
SHA137fa65dd737c50fda710fdbde89e51374d0c204a
SHA2563fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd
SHA5120042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89
-
Filesize
1.2MB
MD5bfac4e3c5908856ba17d41edcd455a51
SHA18eec7e888767aa9e4cca8ff246eb2aacb9170428
SHA256e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78
SHA5122565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66
-
Filesize
617KB
MD544b25d6ac0bccdccb9e9412e0fe85c1e
SHA1175cf3733360d01184d033c18cefdc5a1e626409
SHA256581739ae51a7ed197d380b14a29d75d29370241d8ee900a25bb5d04183315c81
SHA512421ec70f308bb6a1dd716eb181f295d84662e7115543b1ec0142d82765e79e3b5f0040d8bd970d475c891090cf97d155110e05e2729f61a4ed9afd787fd25da2