Malware Analysis Report

2025-01-02 09:23

Sample ID 230112-rap46sgb84
Target 022b13591392ab767062cd3b9250bc02dc9ec7e7852c613d84373b1d192beece.zip
SHA256 7f99e0f9c885b1ffc4a21cbcf02e4f3af09e3982397d560e95c9a79d1a75face
Tags
lgoogloader downloader evasion persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

7f99e0f9c885b1ffc4a21cbcf02e4f3af09e3982397d560e95c9a79d1a75face

Threat Level: Known bad

The file 022b13591392ab767062cd3b9250bc02dc9ec7e7852c613d84373b1d192beece.zip was found to be: Known bad.

Malicious Activity Summary

lgoogloader downloader evasion persistence trojan

Windows security bypass

UAC bypass

Detects LgoogLoader payload

LgoogLoader

Sets service image path in registry

Checks computer location settings

Windows security modification

Checks whether UAC is enabled

Suspicious use of SetThreadContext

Program crash

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

System policy modification

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: LoadsDriver

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-01-12 13:59

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-01-12 13:59

Reported

2023-01-12 14:02

Platform

win7-20221111-en

Max time kernel

31s

Max time network

33s

Command Line

"C:\Users\Admin\AppData\Local\Temp\022b13591392ab767062cd3b9250bc02dc9ec7e7852c613d84373b1d192beece.exe"

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\022b13591392ab767062cd3b9250bc02dc9ec7e7852c613d84373b1d192beece.exe

"C:\Users\Admin\AppData\Local\Temp\022b13591392ab767062cd3b9250bc02dc9ec7e7852c613d84373b1d192beece.exe"

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 624 -s 524

Network

N/A

Files

memory/624-54-0x0000000000F30000-0x0000000000FAC000-memory.dmp

memory/1348-55-0x0000000000000000-mapping.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-01-12 13:59

Reported

2023-01-12 14:02

Platform

win10v2004-20221111-en

Max time kernel

72s

Max time network

94s

Command Line

"C:\Users\Admin\AppData\Local\Temp\022b13591392ab767062cd3b9250bc02dc9ec7e7852c613d84373b1d192beece.exe"

Signatures

Detects LgoogLoader payload

Description Indicator Process Target
N/A N/A N/A N/A

LgoogLoader

downloader lgoogloader

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\022b13591392ab767062cd3b9250bc02dc9ec7e7852c613d84373b1d192beece.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths C:\Users\Admin\AppData\Local\Temp\022b13591392ab767062cd3b9250bc02dc9ec7e7852c613d84373b1d192beece.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\022b13591392ab767062cd3b9250bc02dc9ec7e7852c613d84373b1d192beece.exe = "0" C:\Users\Admin\AppData\Local\Temp\022b13591392ab767062cd3b9250bc02dc9ec7e7852c613d84373b1d192beece.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\TaskKill\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\Иисус.sys" C:\Users\Admin\AppData\Local\Temp\022b13591392ab767062cd3b9250bc02dc9ec7e7852c613d84373b1d192beece.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\022b13591392ab767062cd3b9250bc02dc9ec7e7852c613d84373b1d192beece.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions C:\Users\Admin\AppData\Local\Temp\022b13591392ab767062cd3b9250bc02dc9ec7e7852c613d84373b1d192beece.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\022b13591392ab767062cd3b9250bc02dc9ec7e7852c613d84373b1d192beece.exe = "0" C:\Users\Admin\AppData\Local\Temp\022b13591392ab767062cd3b9250bc02dc9ec7e7852c613d84373b1d192beece.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths C:\Users\Admin\AppData\Local\Temp\022b13591392ab767062cd3b9250bc02dc9ec7e7852c613d84373b1d192beece.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\022b13591392ab767062cd3b9250bc02dc9ec7e7852c613d84373b1d192beece.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\022b13591392ab767062cd3b9250bc02dc9ec7e7852c613d84373b1d192beece.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2664 set thread context of 876 N/A C:\Users\Admin\AppData\Local\Temp\022b13591392ab767062cd3b9250bc02dc9ec7e7852c613d84373b1d192beece.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Enumerates physical storage devices

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\022b13591392ab767062cd3b9250bc02dc9ec7e7852c613d84373b1d192beece.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2664 wrote to memory of 2300 N/A C:\Users\Admin\AppData\Local\Temp\022b13591392ab767062cd3b9250bc02dc9ec7e7852c613d84373b1d192beece.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2664 wrote to memory of 2300 N/A C:\Users\Admin\AppData\Local\Temp\022b13591392ab767062cd3b9250bc02dc9ec7e7852c613d84373b1d192beece.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2664 wrote to memory of 1272 N/A C:\Users\Admin\AppData\Local\Temp\022b13591392ab767062cd3b9250bc02dc9ec7e7852c613d84373b1d192beece.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
PID 2664 wrote to memory of 1272 N/A C:\Users\Admin\AppData\Local\Temp\022b13591392ab767062cd3b9250bc02dc9ec7e7852c613d84373b1d192beece.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
PID 2664 wrote to memory of 1272 N/A C:\Users\Admin\AppData\Local\Temp\022b13591392ab767062cd3b9250bc02dc9ec7e7852c613d84373b1d192beece.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
PID 2664 wrote to memory of 3704 N/A C:\Users\Admin\AppData\Local\Temp\022b13591392ab767062cd3b9250bc02dc9ec7e7852c613d84373b1d192beece.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
PID 2664 wrote to memory of 3704 N/A C:\Users\Admin\AppData\Local\Temp\022b13591392ab767062cd3b9250bc02dc9ec7e7852c613d84373b1d192beece.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
PID 2664 wrote to memory of 3704 N/A C:\Users\Admin\AppData\Local\Temp\022b13591392ab767062cd3b9250bc02dc9ec7e7852c613d84373b1d192beece.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
PID 2664 wrote to memory of 2420 N/A C:\Users\Admin\AppData\Local\Temp\022b13591392ab767062cd3b9250bc02dc9ec7e7852c613d84373b1d192beece.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
PID 2664 wrote to memory of 2420 N/A C:\Users\Admin\AppData\Local\Temp\022b13591392ab767062cd3b9250bc02dc9ec7e7852c613d84373b1d192beece.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
PID 2664 wrote to memory of 2420 N/A C:\Users\Admin\AppData\Local\Temp\022b13591392ab767062cd3b9250bc02dc9ec7e7852c613d84373b1d192beece.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
PID 2664 wrote to memory of 876 N/A C:\Users\Admin\AppData\Local\Temp\022b13591392ab767062cd3b9250bc02dc9ec7e7852c613d84373b1d192beece.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
PID 2664 wrote to memory of 876 N/A C:\Users\Admin\AppData\Local\Temp\022b13591392ab767062cd3b9250bc02dc9ec7e7852c613d84373b1d192beece.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
PID 2664 wrote to memory of 876 N/A C:\Users\Admin\AppData\Local\Temp\022b13591392ab767062cd3b9250bc02dc9ec7e7852c613d84373b1d192beece.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
PID 2664 wrote to memory of 876 N/A C:\Users\Admin\AppData\Local\Temp\022b13591392ab767062cd3b9250bc02dc9ec7e7852c613d84373b1d192beece.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
PID 2664 wrote to memory of 876 N/A C:\Users\Admin\AppData\Local\Temp\022b13591392ab767062cd3b9250bc02dc9ec7e7852c613d84373b1d192beece.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
PID 2664 wrote to memory of 876 N/A C:\Users\Admin\AppData\Local\Temp\022b13591392ab767062cd3b9250bc02dc9ec7e7852c613d84373b1d192beece.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
PID 2664 wrote to memory of 876 N/A C:\Users\Admin\AppData\Local\Temp\022b13591392ab767062cd3b9250bc02dc9ec7e7852c613d84373b1d192beece.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
PID 2664 wrote to memory of 876 N/A C:\Users\Admin\AppData\Local\Temp\022b13591392ab767062cd3b9250bc02dc9ec7e7852c613d84373b1d192beece.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
PID 2664 wrote to memory of 876 N/A C:\Users\Admin\AppData\Local\Temp\022b13591392ab767062cd3b9250bc02dc9ec7e7852c613d84373b1d192beece.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
PID 2664 wrote to memory of 876 N/A C:\Users\Admin\AppData\Local\Temp\022b13591392ab767062cd3b9250bc02dc9ec7e7852c613d84373b1d192beece.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
PID 2664 wrote to memory of 876 N/A C:\Users\Admin\AppData\Local\Temp\022b13591392ab767062cd3b9250bc02dc9ec7e7852c613d84373b1d192beece.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\022b13591392ab767062cd3b9250bc02dc9ec7e7852c613d84373b1d192beece.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\022b13591392ab767062cd3b9250bc02dc9ec7e7852c613d84373b1d192beece.exe

"C:\Users\Admin\AppData\Local\Temp\022b13591392ab767062cd3b9250bc02dc9ec7e7852c613d84373b1d192beece.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\022b13591392ab767062cd3b9250bc02dc9ec7e7852c613d84373b1d192beece.exe" -Force

C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"

Network

Country Destination Domain Proto
N/A 104.80.225.205:443 tcp
N/A 8.8.8.8:53 176.122.125.40.in-addr.arpa udp
N/A 87.248.202.1:80 tcp
N/A 87.248.202.1:80 tcp

Files

memory/2664-132-0x0000017F52250000-0x0000017F522CC000-memory.dmp

memory/2300-133-0x0000000000000000-mapping.dmp

memory/2300-134-0x000001F415250000-0x000001F415272000-memory.dmp

memory/2664-135-0x00007FFA97F70000-0x00007FFA98A31000-memory.dmp

memory/2300-136-0x00007FFA97F70000-0x00007FFA98A31000-memory.dmp

memory/876-137-0x0000000000400000-0x000000000043D000-memory.dmp

memory/876-138-0x00000000004046C6-mapping.dmp

memory/2664-139-0x00007FFA97F70000-0x00007FFA98A31000-memory.dmp

memory/876-140-0x0000000000400000-0x000000000043D000-memory.dmp

memory/876-141-0x0000000000400000-0x000000000043D000-memory.dmp

memory/876-142-0x0000000000FF0000-0x0000000000FF9000-memory.dmp

memory/876-143-0x0000000001120000-0x000000000112D000-memory.dmp