Analysis

  • max time kernel
    90s
  • max time network
    119s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-01-2023 07:20

General

  • Target

    file.exe

  • Size

    2.0MB

  • MD5

    1184c28ad980d08f820085fa46018b9f

  • SHA1

    4cfd74333320f9aa38d5a77eb16ce3da10729c9a

  • SHA256

    fee1d36af03a162f70a627c7cd3efa55b0557530d7eefbe8c72026f48b904595

  • SHA512

    8ebe95c7d32ceb7986617d4a069cc73540fd32049cd3c10cd9c1aac5a1993814ec43eece61195d7de1e4a2aad35cfab5959e75ad8551de22ad904eed3811e1b9

  • SSDEEP

    49152:0KlYcfLLLIWpjLHUmACAkczzqcBrywk0dTTBj:0KWcfrXxH1AVDBmwfdT9

Score
10/10

Malware Config

Signatures

  • Detects LgoogLoader payload 1 IoCs
  • LgoogLoader

    A downloader capable of dropping and executing other malware families.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 40 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Windows\system32\taskhostw.exe
    taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
    1⤵
      PID:2548
      • C:\Windows\SysWOW64\fontview.exe
        "C:\Windows\SYSWOW64\fontview.exe"
        2⤵
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Checks SCSI registry key(s)
        • Suspicious use of AdjustPrivilegeToken
        PID:60
    • C:\Users\Admin\AppData\Local\Temp\file.exe
      "C:\Users\Admin\AppData\Local\Temp\file.exe"
      1⤵
      • Suspicious use of NtCreateUserProcessOtherParentProcess
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3416
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"
        2⤵
          PID:2344
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3416 -s 1264
          2⤵
          • Program crash
          PID:1996
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3416 -s 1304
          2⤵
          • Program crash
          PID:3808
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3416 -ip 3416
        1⤵
          PID:3948
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3416 -ip 3416
          1⤵
            PID:3364

          Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\240550484.dll

            Filesize

            442KB

            MD5

            acf51213c2e0b564c28cf0db859c9e38

            SHA1

            0ec6d956dd0299a8d26bd4671af11c9c3fbe2ca0

            SHA256

            643044a62d07c6725a73bce3ee702ad0c15f0fe332165821c5e7f73937f898b7

            SHA512

            15f30f50afdc2838ebdc4f38199f9857c1b9bc43350588abed404dcaef039698a2533dd5c074d2bfc88448a578c2202c033073592a9c551f7a7e4d263e293eed

          • memory/60-148-0x0000000001055000-0x0000000001057000-memory.dmp

            Filesize

            8KB

          • memory/60-147-0x0000000001055000-0x0000000001057000-memory.dmp

            Filesize

            8KB

          • memory/60-144-0x0000000000910000-0x0000000000945000-memory.dmp

            Filesize

            212KB

          • memory/60-146-0x0000000000910000-0x0000000000945000-memory.dmp

            Filesize

            212KB

          • memory/60-153-0x0000000000910000-0x0000000000945000-memory.dmp

            Filesize

            212KB

          • memory/60-150-0x0000000002DB0000-0x0000000003DB0000-memory.dmp

            Filesize

            16.0MB

          • memory/60-149-0x0000000000E10000-0x0000000000E2D000-memory.dmp

            Filesize

            116KB

          • memory/2344-140-0x0000000000400000-0x000000000043B000-memory.dmp

            Filesize

            236KB

          • memory/2344-138-0x0000000000400000-0x000000000043B000-memory.dmp

            Filesize

            236KB

          • memory/2344-136-0x0000000000400000-0x000000000043B000-memory.dmp

            Filesize

            236KB

          • memory/2344-141-0x0000000001220000-0x0000000001229000-memory.dmp

            Filesize

            36KB

          • memory/2344-142-0x0000000002D20000-0x0000000002D2D000-memory.dmp

            Filesize

            52KB

          • memory/2344-139-0x0000000000400000-0x000000000043B000-memory.dmp

            Filesize

            236KB

          • memory/3416-133-0x000000000C500000-0x000000000C7DF000-memory.dmp

            Filesize

            2.9MB

          • memory/3416-132-0x00000000023B0000-0x000000000254F000-memory.dmp

            Filesize

            1.6MB

          • memory/3416-134-0x000000000C500000-0x000000000C7DF000-memory.dmp

            Filesize

            2.9MB

          • memory/3416-151-0x00000000023B0000-0x000000000254F000-memory.dmp

            Filesize

            1.6MB

          • memory/3416-152-0x000000000C500000-0x000000000C7DF000-memory.dmp

            Filesize

            2.9MB

          • memory/3416-154-0x00000000023B0000-0x000000000254F000-memory.dmp

            Filesize

            1.6MB