Analysis

  • max time kernel
    91s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-01-2023 02:09

General

  • Target

    9146cee3d387cb3d665885b95d885734541f281cbb2a4726b6a59df922a83ee7.exe

  • Size

    1.9MB

  • MD5

    b859b990ea2adae467e0080aacdfabe5

  • SHA1

    7e206519519d72bf49efbc272d70a4785e282808

  • SHA256

    9146cee3d387cb3d665885b95d885734541f281cbb2a4726b6a59df922a83ee7

  • SHA512

    f61c6e20793461f1a2dac2bd77561518a42010537011026ff406fe03fba0c0148244eb6f5f6ffe55d1f07cd5c21f1f8a898c9302720d9513cb5f606d6022a262

  • SSDEEP

    24576:MOYvJhKAX4PP/6E4OZO/1fURAGVaugrgvuy5KR4LzkKGAWO1ObUKdkES/ip:MJuAoPngIO/efaJ0LKAkYg8ES/ip

Score
10/10

Malware Config

Signatures

  • Detects LgoogLoader payload 1 IoCs
  • LgoogLoader

    A downloader capable of dropping and executing other malware families.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 40 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Windows\system32\taskhostw.exe
    taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
    1⤵
      PID:2532
      • C:\Windows\SysWOW64\fontview.exe
        "C:\Windows\SYSWOW64\fontview.exe"
        2⤵
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Checks SCSI registry key(s)
        • Suspicious use of AdjustPrivilegeToken
        PID:4324
    • C:\Users\Admin\AppData\Local\Temp\9146cee3d387cb3d665885b95d885734541f281cbb2a4726b6a59df922a83ee7.exe
      "C:\Users\Admin\AppData\Local\Temp\9146cee3d387cb3d665885b95d885734541f281cbb2a4726b6a59df922a83ee7.exe"
      1⤵
      • Suspicious use of NtCreateUserProcessOtherParentProcess
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4296
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"
        2⤵
          PID:1196
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4296 -s 1268
          2⤵
          • Program crash
          PID:4476
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4296 -s 1288
          2⤵
          • Program crash
          PID:3560
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 4296 -ip 4296
        1⤵
          PID:2780
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4296 -ip 4296
          1⤵
            PID:4424

          Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\240549718.dll

            Filesize

            442KB

            MD5

            acf51213c2e0b564c28cf0db859c9e38

            SHA1

            0ec6d956dd0299a8d26bd4671af11c9c3fbe2ca0

            SHA256

            643044a62d07c6725a73bce3ee702ad0c15f0fe332165821c5e7f73937f898b7

            SHA512

            15f30f50afdc2838ebdc4f38199f9857c1b9bc43350588abed404dcaef039698a2533dd5c074d2bfc88448a578c2202c033073592a9c551f7a7e4d263e293eed

          • memory/1196-138-0x0000000000400000-0x0000000000440000-memory.dmp

            Filesize

            256KB

          • memory/1196-141-0x00000000010D0000-0x00000000010D9000-memory.dmp

            Filesize

            36KB

          • memory/1196-136-0x0000000000400000-0x0000000000440000-memory.dmp

            Filesize

            256KB

          • memory/1196-142-0x0000000001240000-0x000000000124D000-memory.dmp

            Filesize

            52KB

          • memory/1196-139-0x0000000000400000-0x0000000000440000-memory.dmp

            Filesize

            256KB

          • memory/1196-140-0x0000000000400000-0x0000000000440000-memory.dmp

            Filesize

            256KB

          • memory/4296-132-0x0000000002BF0000-0x0000000002D97000-memory.dmp

            Filesize

            1.7MB

          • memory/4296-151-0x0000000002BF0000-0x0000000002D97000-memory.dmp

            Filesize

            1.7MB

          • memory/4296-133-0x000000000D5A0000-0x000000000D8A5000-memory.dmp

            Filesize

            3.0MB

          • memory/4296-154-0x0000000002BF0000-0x0000000002D97000-memory.dmp

            Filesize

            1.7MB

          • memory/4296-134-0x000000000D5A0000-0x000000000D8A5000-memory.dmp

            Filesize

            3.0MB

          • memory/4296-152-0x000000000D5A0000-0x000000000D8A5000-memory.dmp

            Filesize

            3.0MB

          • memory/4324-147-0x00000000014C4000-0x00000000014C7000-memory.dmp

            Filesize

            12KB

          • memory/4324-148-0x00000000014C5000-0x00000000014C7000-memory.dmp

            Filesize

            8KB

          • memory/4324-149-0x00000000013C0000-0x00000000013DD000-memory.dmp

            Filesize

            116KB

          • memory/4324-150-0x00000000031A0000-0x00000000041A0000-memory.dmp

            Filesize

            16.0MB

          • memory/4324-144-0x00000000010B0000-0x00000000010E5000-memory.dmp

            Filesize

            212KB

          • memory/4324-153-0x00000000010B0000-0x00000000010E5000-memory.dmp

            Filesize

            212KB

          • memory/4324-146-0x00000000010B0000-0x00000000010E5000-memory.dmp

            Filesize

            212KB