Analysis
-
max time kernel
31s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
16-01-2023 17:17
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20221111-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20220901-en
9 signatures
150 seconds
General
-
Target
file.exe
-
Size
510KB
-
MD5
ff0ac8d6c0a5990dd442f677315e6c4b
-
SHA1
4358324f102afd639d6b1ec92521b37f31ca5d1c
-
SHA256
eb5ec9cf758bd526db090f9290d323201911b4181c3bfeb3ebd1f1af8be19285
-
SHA512
47b93db0d6f90bd4805508663353472709fe53d5397834eadd5ee2feb4a2c2d59f57cf929ac8039f4ea07a2303d880f98806f4d7aade7cee700ff48f3ecf91ae
-
SSDEEP
12288:ytFk7iHlOP8nFr/AuvlNn7N9Opxb6VelFxgcdM:EHlTn5Bv2begS
Score
10/10
Malware Config
Signatures
-
Detects LgoogLoader payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1232-62-0x0000000000250000-0x000000000025D000-memory.dmp family_lgoogloader -
LgoogLoader
A downloader capable of dropping and executing other malware families.
-
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
file.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\TaskKill\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\Иисус.sys" file.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
file.exedescription pid process target process PID 1320 set thread context of 1232 1320 file.exe AddInProcess32.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
file.exepid process 1320 file.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
file.exepid process 1320 file.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
file.exedescription pid process Token: SeDebugPrivilege 1320 file.exe Token: SeLoadDriverPrivilege 1320 file.exe Token: SeDebugPrivilege 1320 file.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
file.exedescription pid process target process PID 1320 wrote to memory of 316 1320 file.exe AppLaunch.exe PID 1320 wrote to memory of 316 1320 file.exe AppLaunch.exe PID 1320 wrote to memory of 316 1320 file.exe AppLaunch.exe PID 1320 wrote to memory of 1232 1320 file.exe AddInProcess32.exe PID 1320 wrote to memory of 1232 1320 file.exe AddInProcess32.exe PID 1320 wrote to memory of 1232 1320 file.exe AddInProcess32.exe PID 1320 wrote to memory of 1232 1320 file.exe AddInProcess32.exe PID 1320 wrote to memory of 1232 1320 file.exe AddInProcess32.exe PID 1320 wrote to memory of 1232 1320 file.exe AddInProcess32.exe PID 1320 wrote to memory of 1232 1320 file.exe AddInProcess32.exe PID 1320 wrote to memory of 1232 1320 file.exe AddInProcess32.exe PID 1320 wrote to memory of 1232 1320 file.exe AddInProcess32.exe PID 1320 wrote to memory of 1232 1320 file.exe AddInProcess32.exe PID 1320 wrote to memory of 1232 1320 file.exe AddInProcess32.exe PID 1320 wrote to memory of 1232 1320 file.exe AddInProcess32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Sets service image path in registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1232-56-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1232-57-0x0000000000403980-mapping.dmp
-
memory/1232-60-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1232-59-0x0000000075D01000-0x0000000075D03000-memory.dmpFilesize
8KB
-
memory/1232-61-0x0000000000180000-0x0000000000189000-memory.dmpFilesize
36KB
-
memory/1232-62-0x0000000000250000-0x000000000025D000-memory.dmpFilesize
52KB
-
memory/1320-54-0x0000000001110000-0x0000000001192000-memory.dmpFilesize
520KB
-
memory/1320-55-0x0000000000360000-0x00000000003DC000-memory.dmpFilesize
496KB