Analysis

  • max time kernel
    91s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-01-2023 18:59

General

  • Target

    eb5ec9cf758bd526db090f9290d323201911b4181c3bfeb3ebd1f1af8be19285.exe

  • Size

    510KB

  • MD5

    ff0ac8d6c0a5990dd442f677315e6c4b

  • SHA1

    4358324f102afd639d6b1ec92521b37f31ca5d1c

  • SHA256

    eb5ec9cf758bd526db090f9290d323201911b4181c3bfeb3ebd1f1af8be19285

  • SHA512

    47b93db0d6f90bd4805508663353472709fe53d5397834eadd5ee2feb4a2c2d59f57cf929ac8039f4ea07a2303d880f98806f4d7aade7cee700ff48f3ecf91ae

  • SSDEEP

    12288:ytFk7iHlOP8nFr/AuvlNn7N9Opxb6VelFxgcdM:EHlTn5Bv2begS

Malware Config

Signatures

  • Detects LgoogLoader payload 1 IoCs
  • LgoogLoader

    A downloader capable of dropping and executing other malware families.

  • Sets service image path in registry 2 TTPs 1 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 52 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 63 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\eb5ec9cf758bd526db090f9290d323201911b4181c3bfeb3ebd1f1af8be19285.exe
    "C:\Users\Admin\AppData\Local\Temp\eb5ec9cf758bd526db090f9290d323201911b4181c3bfeb3ebd1f1af8be19285.exe"
    1⤵
    • Sets service image path in registry
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: LoadsDriver
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4084
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe"
      2⤵
        PID:3976
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe"
        2⤵
          PID:2624
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
          "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe"
          2⤵
            PID:3316
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe"
            2⤵
              PID:3132
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe"
              2⤵
                PID:4620
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
                "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"
                2⤵
                  PID:4652
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
                  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
                  2⤵
                    PID:5000
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
                    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"
                    2⤵
                      PID:4964
                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"
                      2⤵
                        PID:4948
                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe
                        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe"
                        2⤵
                          PID:628
                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe
                          "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe"
                          2⤵
                            PID:4884
                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe
                            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe"
                            2⤵
                              PID:4844
                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe
                              "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"
                              2⤵
                                PID:4860
                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
                                "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"
                                2⤵
                                  PID:4828
                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe
                                  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe"
                                  2⤵
                                    PID:4928
                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
                                    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe"
                                    2⤵
                                      PID:4908
                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe"
                                      2⤵
                                        PID:4936
                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe
                                        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe"
                                        2⤵
                                          PID:4824
                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
                                          "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
                                          2⤵
                                            PID:1412
                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
                                            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe"
                                            2⤵
                                              PID:4564
                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe
                                              "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe"
                                              2⤵
                                                PID:3352
                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe
                                                "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe"
                                                2⤵
                                                  PID:4808
                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe
                                                  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe"
                                                  2⤵
                                                    PID:960
                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe
                                                    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe"
                                                    2⤵
                                                      PID:4296
                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe
                                                      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe"
                                                      2⤵
                                                        PID:4236
                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe
                                                        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe"
                                                        2⤵
                                                          PID:5020
                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe
                                                          "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe"
                                                          2⤵
                                                            PID:5116

                                                        Network

                                                        MITRE ATT&CK Enterprise v6

                                                        Replay Monitor

                                                        Loading Replay Monitor...

                                                        Downloads

                                                        • memory/4084-132-0x0000024942480000-0x0000024942502000-memory.dmp

                                                          Filesize

                                                          520KB

                                                        • memory/4084-133-0x00007FFBC8BD0000-0x00007FFBC9691000-memory.dmp

                                                          Filesize

                                                          10.8MB

                                                        • memory/4084-137-0x00007FFBC8BD0000-0x00007FFBC9691000-memory.dmp

                                                          Filesize

                                                          10.8MB

                                                        • memory/5116-134-0x0000000000400000-0x000000000043E000-memory.dmp

                                                          Filesize

                                                          248KB

                                                        • memory/5116-136-0x0000000000400000-0x000000000043E000-memory.dmp

                                                          Filesize

                                                          248KB

                                                        • memory/5116-138-0x0000000000400000-0x000000000043E000-memory.dmp

                                                          Filesize

                                                          248KB

                                                        • memory/5116-139-0x0000000002A70000-0x0000000002A79000-memory.dmp

                                                          Filesize

                                                          36KB

                                                        • memory/5116-140-0x0000000002A90000-0x0000000002A9D000-memory.dmp

                                                          Filesize

                                                          52KB