Analysis
-
max time kernel
91s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
15-01-2023 14:32
Static task
static1
Behavioral task
behavioral1
Sample
5a2b7e55e12b6be111413e81cbc829d8.exe
Resource
win7-20221111-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
5a2b7e55e12b6be111413e81cbc829d8.exe
Resource
win10v2004-20220812-en
8 signatures
150 seconds
General
-
Target
5a2b7e55e12b6be111413e81cbc829d8.exe
-
Size
614KB
-
MD5
5a2b7e55e12b6be111413e81cbc829d8
-
SHA1
feee5eea1ba33a666fb61f876c80230d97ba8b47
-
SHA256
357454521efaa0849a2ee13d2f3531082ac56d110a10b137654d5777cf724d51
-
SHA512
9e1c78e83a0c4342cf4f560eb4c81c3a7ca52f360adf594ddc654f9a1f56837b6339da3c2d74a4b525865832d937d181b8f13137c1870b05b87dcf4cfce8fc20
-
SSDEEP
12288:6rxXmSBr7wHt5c/yq1HcmZCqsyKEJgnzAS6n2jj:6JYvcRd1ZC1XE4MSHf
Score
10/10
Malware Config
Signatures
-
Detects LgoogLoader payload 1 IoCs
resource yara_rule behavioral2/memory/4304-142-0x0000000001250000-0x000000000125D000-memory.dmp family_lgoogloader -
LgoogLoader
A downloader capable of dropping and executing other malware families.
-
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\TaskKill\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\Иисус.sys" 5a2b7e55e12b6be111413e81cbc829d8.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4740 set thread context of 4304 4740 5a2b7e55e12b6be111413e81cbc829d8.exe 92 -
Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 4740 5a2b7e55e12b6be111413e81cbc829d8.exe 4740 5a2b7e55e12b6be111413e81cbc829d8.exe 4740 5a2b7e55e12b6be111413e81cbc829d8.exe 4740 5a2b7e55e12b6be111413e81cbc829d8.exe 4740 5a2b7e55e12b6be111413e81cbc829d8.exe 4740 5a2b7e55e12b6be111413e81cbc829d8.exe 4740 5a2b7e55e12b6be111413e81cbc829d8.exe 4740 5a2b7e55e12b6be111413e81cbc829d8.exe 4740 5a2b7e55e12b6be111413e81cbc829d8.exe 4740 5a2b7e55e12b6be111413e81cbc829d8.exe 4740 5a2b7e55e12b6be111413e81cbc829d8.exe 4740 5a2b7e55e12b6be111413e81cbc829d8.exe 4740 5a2b7e55e12b6be111413e81cbc829d8.exe 4740 5a2b7e55e12b6be111413e81cbc829d8.exe 4740 5a2b7e55e12b6be111413e81cbc829d8.exe 4740 5a2b7e55e12b6be111413e81cbc829d8.exe 4740 5a2b7e55e12b6be111413e81cbc829d8.exe 4740 5a2b7e55e12b6be111413e81cbc829d8.exe 4740 5a2b7e55e12b6be111413e81cbc829d8.exe 4740 5a2b7e55e12b6be111413e81cbc829d8.exe 4740 5a2b7e55e12b6be111413e81cbc829d8.exe 4740 5a2b7e55e12b6be111413e81cbc829d8.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 4740 5a2b7e55e12b6be111413e81cbc829d8.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4740 5a2b7e55e12b6be111413e81cbc829d8.exe Token: SeLoadDriverPrivilege 4740 5a2b7e55e12b6be111413e81cbc829d8.exe Token: SeDebugPrivilege 4740 5a2b7e55e12b6be111413e81cbc829d8.exe -
Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 4740 wrote to memory of 1236 4740 5a2b7e55e12b6be111413e81cbc829d8.exe 81 PID 4740 wrote to memory of 1236 4740 5a2b7e55e12b6be111413e81cbc829d8.exe 81 PID 4740 wrote to memory of 4092 4740 5a2b7e55e12b6be111413e81cbc829d8.exe 82 PID 4740 wrote to memory of 4092 4740 5a2b7e55e12b6be111413e81cbc829d8.exe 82 PID 4740 wrote to memory of 4352 4740 5a2b7e55e12b6be111413e81cbc829d8.exe 83 PID 4740 wrote to memory of 4352 4740 5a2b7e55e12b6be111413e81cbc829d8.exe 83 PID 4740 wrote to memory of 4364 4740 5a2b7e55e12b6be111413e81cbc829d8.exe 84 PID 4740 wrote to memory of 4364 4740 5a2b7e55e12b6be111413e81cbc829d8.exe 84 PID 4740 wrote to memory of 4336 4740 5a2b7e55e12b6be111413e81cbc829d8.exe 85 PID 4740 wrote to memory of 4336 4740 5a2b7e55e12b6be111413e81cbc829d8.exe 85 PID 4740 wrote to memory of 5076 4740 5a2b7e55e12b6be111413e81cbc829d8.exe 86 PID 4740 wrote to memory of 5076 4740 5a2b7e55e12b6be111413e81cbc829d8.exe 86 PID 4740 wrote to memory of 5096 4740 5a2b7e55e12b6be111413e81cbc829d8.exe 87 PID 4740 wrote to memory of 5096 4740 5a2b7e55e12b6be111413e81cbc829d8.exe 87 PID 4740 wrote to memory of 5112 4740 5a2b7e55e12b6be111413e81cbc829d8.exe 88 PID 4740 wrote to memory of 5112 4740 5a2b7e55e12b6be111413e81cbc829d8.exe 88 PID 4740 wrote to memory of 440 4740 5a2b7e55e12b6be111413e81cbc829d8.exe 89 PID 4740 wrote to memory of 440 4740 5a2b7e55e12b6be111413e81cbc829d8.exe 89 PID 4740 wrote to memory of 5056 4740 5a2b7e55e12b6be111413e81cbc829d8.exe 90 PID 4740 wrote to memory of 5056 4740 5a2b7e55e12b6be111413e81cbc829d8.exe 90 PID 4740 wrote to memory of 4108 4740 5a2b7e55e12b6be111413e81cbc829d8.exe 91 PID 4740 wrote to memory of 4108 4740 5a2b7e55e12b6be111413e81cbc829d8.exe 91 PID 4740 wrote to memory of 4304 4740 5a2b7e55e12b6be111413e81cbc829d8.exe 92 PID 4740 wrote to memory of 4304 4740 5a2b7e55e12b6be111413e81cbc829d8.exe 92 PID 4740 wrote to memory of 4304 4740 5a2b7e55e12b6be111413e81cbc829d8.exe 92 PID 4740 wrote to memory of 4304 4740 5a2b7e55e12b6be111413e81cbc829d8.exe 92 PID 4740 wrote to memory of 4304 4740 5a2b7e55e12b6be111413e81cbc829d8.exe 92 PID 4740 wrote to memory of 4304 4740 5a2b7e55e12b6be111413e81cbc829d8.exe 92 PID 4740 wrote to memory of 4304 4740 5a2b7e55e12b6be111413e81cbc829d8.exe 92 PID 4740 wrote to memory of 4304 4740 5a2b7e55e12b6be111413e81cbc829d8.exe 92 PID 4740 wrote to memory of 4304 4740 5a2b7e55e12b6be111413e81cbc829d8.exe 92 PID 4740 wrote to memory of 4304 4740 5a2b7e55e12b6be111413e81cbc829d8.exe 92 PID 4740 wrote to memory of 4304 4740 5a2b7e55e12b6be111413e81cbc829d8.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\5a2b7e55e12b6be111413e81cbc829d8.exe"C:\Users\Admin\AppData\Local\Temp\5a2b7e55e12b6be111413e81cbc829d8.exe"1⤵
- Sets service image path in registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe"2⤵PID:1236
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe"2⤵PID:4092
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe"2⤵PID:4352
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe"2⤵PID:4364
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe"2⤵PID:4336
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe"2⤵PID:5076
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe"2⤵PID:5096
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe"2⤵PID:5112
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"2⤵PID:440
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe"2⤵PID:5056
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe"2⤵PID:4108
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe"2⤵PID:4304
-