Analysis
-
max time kernel
28s -
max time network
31s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
15-01-2023 14:32
Static task
static1
Behavioral task
behavioral1
Sample
5a2b7e55e12b6be111413e81cbc829d8.exe
Resource
win7-20221111-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
5a2b7e55e12b6be111413e81cbc829d8.exe
Resource
win10v2004-20220812-en
8 signatures
150 seconds
General
-
Target
5a2b7e55e12b6be111413e81cbc829d8.exe
-
Size
614KB
-
MD5
5a2b7e55e12b6be111413e81cbc829d8
-
SHA1
feee5eea1ba33a666fb61f876c80230d97ba8b47
-
SHA256
357454521efaa0849a2ee13d2f3531082ac56d110a10b137654d5777cf724d51
-
SHA512
9e1c78e83a0c4342cf4f560eb4c81c3a7ca52f360adf594ddc654f9a1f56837b6339da3c2d74a4b525865832d937d181b8f13137c1870b05b87dcf4cfce8fc20
-
SSDEEP
12288:6rxXmSBr7wHt5c/yq1HcmZCqsyKEJgnzAS6n2jj:6JYvcRd1ZC1XE4MSHf
Score
10/10
Malware Config
Signatures
-
Detects LgoogLoader payload 1 IoCs
resource yara_rule behavioral1/memory/1376-62-0x00000000001A0000-0x00000000001AD000-memory.dmp family_lgoogloader -
LgoogLoader
A downloader capable of dropping and executing other malware families.
-
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\TaskKill\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\Иисус.sys" 5a2b7e55e12b6be111413e81cbc829d8.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1192 set thread context of 1376 1192 5a2b7e55e12b6be111413e81cbc829d8.exe 30 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1192 5a2b7e55e12b6be111413e81cbc829d8.exe 1192 5a2b7e55e12b6be111413e81cbc829d8.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 1192 5a2b7e55e12b6be111413e81cbc829d8.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1192 5a2b7e55e12b6be111413e81cbc829d8.exe Token: SeLoadDriverPrivilege 1192 5a2b7e55e12b6be111413e81cbc829d8.exe Token: SeDebugPrivilege 1192 5a2b7e55e12b6be111413e81cbc829d8.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1192 wrote to memory of 1216 1192 5a2b7e55e12b6be111413e81cbc829d8.exe 28 PID 1192 wrote to memory of 1216 1192 5a2b7e55e12b6be111413e81cbc829d8.exe 28 PID 1192 wrote to memory of 1216 1192 5a2b7e55e12b6be111413e81cbc829d8.exe 28 PID 1192 wrote to memory of 972 1192 5a2b7e55e12b6be111413e81cbc829d8.exe 29 PID 1192 wrote to memory of 972 1192 5a2b7e55e12b6be111413e81cbc829d8.exe 29 PID 1192 wrote to memory of 972 1192 5a2b7e55e12b6be111413e81cbc829d8.exe 29 PID 1192 wrote to memory of 1376 1192 5a2b7e55e12b6be111413e81cbc829d8.exe 30 PID 1192 wrote to memory of 1376 1192 5a2b7e55e12b6be111413e81cbc829d8.exe 30 PID 1192 wrote to memory of 1376 1192 5a2b7e55e12b6be111413e81cbc829d8.exe 30 PID 1192 wrote to memory of 1376 1192 5a2b7e55e12b6be111413e81cbc829d8.exe 30 PID 1192 wrote to memory of 1376 1192 5a2b7e55e12b6be111413e81cbc829d8.exe 30 PID 1192 wrote to memory of 1376 1192 5a2b7e55e12b6be111413e81cbc829d8.exe 30 PID 1192 wrote to memory of 1376 1192 5a2b7e55e12b6be111413e81cbc829d8.exe 30 PID 1192 wrote to memory of 1376 1192 5a2b7e55e12b6be111413e81cbc829d8.exe 30 PID 1192 wrote to memory of 1376 1192 5a2b7e55e12b6be111413e81cbc829d8.exe 30 PID 1192 wrote to memory of 1376 1192 5a2b7e55e12b6be111413e81cbc829d8.exe 30 PID 1192 wrote to memory of 1376 1192 5a2b7e55e12b6be111413e81cbc829d8.exe 30 PID 1192 wrote to memory of 1376 1192 5a2b7e55e12b6be111413e81cbc829d8.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\5a2b7e55e12b6be111413e81cbc829d8.exe"C:\Users\Admin\AppData\Local\Temp\5a2b7e55e12b6be111413e81cbc829d8.exe"1⤵
- Sets service image path in registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"2⤵PID:1216
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe"2⤵PID:972
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe"2⤵PID:1376
-