lgoogloader | fee1d36af03a162f70a627c7cd3efa55b0557530d7eefbe8c72026f48b904595

General

Target

fee1d36af03a162f70a627c7cd3efa55b0557530d7eefbe8c72026f48b904595.exe
Size

2.0MB
MD5

1184c28ad980d08f820085fa46018b9f
SHA1

4cfd74333320f9aa38d5a77eb16ce3da10729c9a
SHA256

fee1d36af03a162f70a627c7cd3efa55b0557530d7eefbe8c72026f48b904595
SHA512

8ebe95c7d32ceb7986617d4a069cc73540fd32049cd3c10cd9c1aac5a1993814ec43eece61195d7de1e4a2aad35cfab5959e75ad8551de22ad904eed3811e1b9
SSDEEP

49152:0KlYcfLLLIWpjLHUmACAkczzqcBrywk0dTTBj:0KWcfrXxH1AVDBmwfdT9

Score

10^/10

lgoogloader downloader

Malware Config

Signatures

Detects LgoogLoader payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/928-142-0x0000000000FA0000-0x0000000000FAD000-memory.dmp	family_lgoogloader

LgoogLoader
A downloader capable of dropping and executing other malware families.
downloader lgoogloader
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

fee1d36af03a162f70a627c7cd3efa55b0557530d7eefbe8c72026f48b904595.exe

description pid process target process

PID 4816 created 2656 4816 fee1d36af03a162f70a627c7cd3efa55b0557530d7eefbe8c72026f48b904595.exe taskhostw.exe
Loads dropped DLL 1 IoCs

Processes:

fee1d36af03a162f70a627c7cd3efa55b0557530d7eefbe8c72026f48b904595.exe

pid process

4816 fee1d36af03a162f70a627c7cd3efa55b0557530d7eefbe8c72026f48b904595.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

Processes:

fontview.exe

pid process

1436 fontview.exe
1436 fontview.exe
1436 fontview.exe

description	pid	process	target process
PID 4816 created 2656	4816	fee1d36af03a162f70a627c7cd3efa55b0557530d7eefbe8c72026f48b904595.exe	taskhostw.exe

pid	process
1436	fontview.exe
1436	fontview.exe
1436	fontview.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

fee1d36af03a162f70a627c7cd3efa55b0557530d7eefbe8c72026f48b904595.exe

description	pid	process	target process
PID 4816 set thread context of 928	4816	fee1d36af03a162f70a627c7cd3efa55b0557530d7eefbe8c72026f48b904595.exe	ngentask.exe

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
3376	4816	WerFault.exe	fee1d36af03a162f70a627c7cd3efa55b0557530d7eefbe8c72026f48b904595.exe
5020	4816	WerFault.exe	fee1d36af03a162f70a627c7cd3efa55b0557530d7eefbe8c72026f48b904595.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

fontview.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	fontview.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	fontview.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	fontview.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	fontview.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	fontview.exe

Suspicious behavior: EnumeratesProcesses 40 IoCs

Processes:

fee1d36af03a162f70a627c7cd3efa55b0557530d7eefbe8c72026f48b904595.exe

pid	process
4816	fee1d36af03a162f70a627c7cd3efa55b0557530d7eefbe8c72026f48b904595.exe
4816	fee1d36af03a162f70a627c7cd3efa55b0557530d7eefbe8c72026f48b904595.exe
4816	fee1d36af03a162f70a627c7cd3efa55b0557530d7eefbe8c72026f48b904595.exe
4816	fee1d36af03a162f70a627c7cd3efa55b0557530d7eefbe8c72026f48b904595.exe
4816	fee1d36af03a162f70a627c7cd3efa55b0557530d7eefbe8c72026f48b904595.exe
4816	fee1d36af03a162f70a627c7cd3efa55b0557530d7eefbe8c72026f48b904595.exe
4816	fee1d36af03a162f70a627c7cd3efa55b0557530d7eefbe8c72026f48b904595.exe
4816	fee1d36af03a162f70a627c7cd3efa55b0557530d7eefbe8c72026f48b904595.exe
4816	fee1d36af03a162f70a627c7cd3efa55b0557530d7eefbe8c72026f48b904595.exe
4816	fee1d36af03a162f70a627c7cd3efa55b0557530d7eefbe8c72026f48b904595.exe
4816	fee1d36af03a162f70a627c7cd3efa55b0557530d7eefbe8c72026f48b904595.exe
4816	fee1d36af03a162f70a627c7cd3efa55b0557530d7eefbe8c72026f48b904595.exe
4816	fee1d36af03a162f70a627c7cd3efa55b0557530d7eefbe8c72026f48b904595.exe
4816	fee1d36af03a162f70a627c7cd3efa55b0557530d7eefbe8c72026f48b904595.exe
4816	fee1d36af03a162f70a627c7cd3efa55b0557530d7eefbe8c72026f48b904595.exe
4816	fee1d36af03a162f70a627c7cd3efa55b0557530d7eefbe8c72026f48b904595.exe
4816	fee1d36af03a162f70a627c7cd3efa55b0557530d7eefbe8c72026f48b904595.exe
4816	fee1d36af03a162f70a627c7cd3efa55b0557530d7eefbe8c72026f48b904595.exe
4816	fee1d36af03a162f70a627c7cd3efa55b0557530d7eefbe8c72026f48b904595.exe
4816	fee1d36af03a162f70a627c7cd3efa55b0557530d7eefbe8c72026f48b904595.exe
4816	fee1d36af03a162f70a627c7cd3efa55b0557530d7eefbe8c72026f48b904595.exe
4816	fee1d36af03a162f70a627c7cd3efa55b0557530d7eefbe8c72026f48b904595.exe
4816	fee1d36af03a162f70a627c7cd3efa55b0557530d7eefbe8c72026f48b904595.exe
4816	fee1d36af03a162f70a627c7cd3efa55b0557530d7eefbe8c72026f48b904595.exe
4816	fee1d36af03a162f70a627c7cd3efa55b0557530d7eefbe8c72026f48b904595.exe
4816	fee1d36af03a162f70a627c7cd3efa55b0557530d7eefbe8c72026f48b904595.exe
4816	fee1d36af03a162f70a627c7cd3efa55b0557530d7eefbe8c72026f48b904595.exe
4816	fee1d36af03a162f70a627c7cd3efa55b0557530d7eefbe8c72026f48b904595.exe
4816	fee1d36af03a162f70a627c7cd3efa55b0557530d7eefbe8c72026f48b904595.exe
4816	fee1d36af03a162f70a627c7cd3efa55b0557530d7eefbe8c72026f48b904595.exe
4816	fee1d36af03a162f70a627c7cd3efa55b0557530d7eefbe8c72026f48b904595.exe
4816	fee1d36af03a162f70a627c7cd3efa55b0557530d7eefbe8c72026f48b904595.exe
4816	fee1d36af03a162f70a627c7cd3efa55b0557530d7eefbe8c72026f48b904595.exe
4816	fee1d36af03a162f70a627c7cd3efa55b0557530d7eefbe8c72026f48b904595.exe
4816	fee1d36af03a162f70a627c7cd3efa55b0557530d7eefbe8c72026f48b904595.exe
4816	fee1d36af03a162f70a627c7cd3efa55b0557530d7eefbe8c72026f48b904595.exe
4816	fee1d36af03a162f70a627c7cd3efa55b0557530d7eefbe8c72026f48b904595.exe
4816	fee1d36af03a162f70a627c7cd3efa55b0557530d7eefbe8c72026f48b904595.exe
4816	fee1d36af03a162f70a627c7cd3efa55b0557530d7eefbe8c72026f48b904595.exe
4816	fee1d36af03a162f70a627c7cd3efa55b0557530d7eefbe8c72026f48b904595.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

fontview.exe

description pid process

Token: SeShutdownPrivilege 1436 fontview.exe
Token: SeCreatePagefilePrivilege 1436 fontview.exe

description	pid	process
Token: SeShutdownPrivilege	1436	fontview.exe
Token: SeCreatePagefilePrivilege	1436	fontview.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

fee1d36af03a162f70a627c7cd3efa55b0557530d7eefbe8c72026f48b904595.exe

description	pid	process	target process
PID 4816 wrote to memory of 928	4816	fee1d36af03a162f70a627c7cd3efa55b0557530d7eefbe8c72026f48b904595.exe	ngentask.exe
PID 4816 wrote to memory of 928	4816	fee1d36af03a162f70a627c7cd3efa55b0557530d7eefbe8c72026f48b904595.exe	ngentask.exe
PID 4816 wrote to memory of 928	4816	fee1d36af03a162f70a627c7cd3efa55b0557530d7eefbe8c72026f48b904595.exe	ngentask.exe
PID 4816 wrote to memory of 928	4816	fee1d36af03a162f70a627c7cd3efa55b0557530d7eefbe8c72026f48b904595.exe	ngentask.exe
PID 4816 wrote to memory of 928	4816	fee1d36af03a162f70a627c7cd3efa55b0557530d7eefbe8c72026f48b904595.exe	ngentask.exe
PID 4816 wrote to memory of 1436	4816	fee1d36af03a162f70a627c7cd3efa55b0557530d7eefbe8c72026f48b904595.exe	fontview.exe
PID 4816 wrote to memory of 1436	4816	fee1d36af03a162f70a627c7cd3efa55b0557530d7eefbe8c72026f48b904595.exe	fontview.exe
PID 4816 wrote to memory of 1436	4816	fee1d36af03a162f70a627c7cd3efa55b0557530d7eefbe8c72026f48b904595.exe	fontview.exe
PID 4816 wrote to memory of 1436	4816	fee1d36af03a162f70a627c7cd3efa55b0557530d7eefbe8c72026f48b904595.exe	fontview.exe

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2656

C:\Windows\SysWOW64\fontview.exe
"C:\Windows\SYSWOW64\fontview.exe"
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1436

C:\Users\Admin\AppData\Local\Temp\fee1d36af03a162f70a627c7cd3efa55b0557530d7eefbe8c72026f48b904595.exe
"C:\Users\Admin\AppData\Local\Temp\fee1d36af03a162f70a627c7cd3efa55b0557530d7eefbe8c72026f48b904595.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4816

C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"
2⤵
PID:928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4816 -s 1176
2⤵
- Program crash
PID:3376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4816 -s 1284
2⤵
- Program crash
PID:5020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4816 -ip 4816
1⤵
PID:3892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4816 -ip 4816
1⤵
PID:3124

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\240549984.dll

Filesize
442KB

MD5
acf51213c2e0b564c28cf0db859c9e38

SHA1
0ec6d956dd0299a8d26bd4671af11c9c3fbe2ca0

SHA256
643044a62d07c6725a73bce3ee702ad0c15f0fe332165821c5e7f73937f898b7

SHA512
15f30f50afdc2838ebdc4f38199f9857c1b9bc43350588abed404dcaef039698a2533dd5c074d2bfc88448a578c2202c033073592a9c551f7a7e4d263e293eed

Download Submit
memory/928-138-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/928-141-0x0000000000F80000-0x0000000000F89000-memory.dmp

Filesize
36KB

Download
memory/928-135-0x0000000000000000-mapping.dmp

Download
memory/928-136-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/928-142-0x0000000000FA0000-0x0000000000FAD000-memory.dmp

Filesize
52KB

Download
memory/928-139-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/928-140-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1436-147-0x0000000001203000-0x0000000001206000-memory.dmp

Filesize
12KB

Download
memory/1436-144-0x0000000001050000-0x0000000001085000-memory.dmp

Filesize
212KB

Download
memory/1436-145-0x0000000000000000-mapping.dmp

Download
memory/1436-146-0x0000000001050000-0x0000000001085000-memory.dmp

Filesize
212KB

Download
memory/1436-148-0x0000000002BF0000-0x0000000002C0D000-memory.dmp

Filesize
116KB

Download
memory/1436-149-0x0000000003190000-0x0000000004190000-memory.dmp

Filesize
16.0MB

Download
memory/1436-152-0x0000000001050000-0x0000000001085000-memory.dmp

Filesize
212KB

Download
memory/4816-153-0x0000000002490000-0x000000000262F000-memory.dmp

Filesize
1.6MB

Download
memory/4816-151-0x000000000E840000-0x000000000EB1F000-memory.dmp

Filesize
2.9MB

Download
memory/4816-134-0x000000000E840000-0x000000000EB1F000-memory.dmp

Filesize
2.9MB

Download
memory/4816-150-0x0000000002490000-0x000000000262F000-memory.dmp

Filesize
1.6MB

Download
memory/4816-133-0x000000000E840000-0x000000000EB1F000-memory.dmp

Filesize
2.9MB

Download
memory/4816-132-0x0000000002490000-0x000000000262F000-memory.dmp

Filesize
1.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads