lgoogloader | 6326bea9cec6e2baec63ed96cd31a97770c6a63b96d1169a8b5586ec071c8778 | Triage

Analysis

max time kernel
90s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
17-01-2023 17:18

Sharing

Report Analysis Logs

General

Target

6326bea9cec6e2baec63ed96cd31a97770c6a63b96d1169a8b5586ec071c8778.exe
Size

711KB
MD5

d964e6ad2ec6ca6d7ecdfe964a5b10b7
SHA1

d2bbf0f78f51d7e912bf8321afe3100c4be73d95
SHA256

6326bea9cec6e2baec63ed96cd31a97770c6a63b96d1169a8b5586ec071c8778
SHA512

3598b73b9341103696c0ba083d4fdd61336c5e718683b29ce41d4b8df88051c6647b9981071e327ab37fe4da460053541990254c3636e60eee78efaf38c96a2b
SSDEEP

12288:cYrR/Fs0ZsPoFaDD1FawIk7c7JcvzxytoeM:cYVNR6eallT7X4to

Score

10^/10

lgoogloader downloader persistence

Malware Config

Signatures

Detects LgoogLoader payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4156-140-0x0000000001470000-0x000000000147D000-memory.dmp	family_lgoogloader

LgoogLoader
A downloader capable of dropping and executing other malware families.
downloader lgoogloader

Sets service image path in registry 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

Processes:

6326bea9cec6e2baec63ed96cd31a97770c6a63b96d1169a8b5586ec071c8778.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\TaskKill\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\Иисус.sys"	6326bea9cec6e2baec63ed96cd31a97770c6a63b96d1169a8b5586ec071c8778.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

6326bea9cec6e2baec63ed96cd31a97770c6a63b96d1169a8b5586ec071c8778.exe

description	pid	process	target process
PID 4984 set thread context of 4156	4984	6326bea9cec6e2baec63ed96cd31a97770c6a63b96d1169a8b5586ec071c8778.exe	jsc.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

6326bea9cec6e2baec63ed96cd31a97770c6a63b96d1169a8b5586ec071c8778.exe

pid	process
4984	6326bea9cec6e2baec63ed96cd31a97770c6a63b96d1169a8b5586ec071c8778.exe
4984	6326bea9cec6e2baec63ed96cd31a97770c6a63b96d1169a8b5586ec071c8778.exe
4984	6326bea9cec6e2baec63ed96cd31a97770c6a63b96d1169a8b5586ec071c8778.exe
4984	6326bea9cec6e2baec63ed96cd31a97770c6a63b96d1169a8b5586ec071c8778.exe
4984	6326bea9cec6e2baec63ed96cd31a97770c6a63b96d1169a8b5586ec071c8778.exe
4984	6326bea9cec6e2baec63ed96cd31a97770c6a63b96d1169a8b5586ec071c8778.exe
4984	6326bea9cec6e2baec63ed96cd31a97770c6a63b96d1169a8b5586ec071c8778.exe
4984	6326bea9cec6e2baec63ed96cd31a97770c6a63b96d1169a8b5586ec071c8778.exe
4984	6326bea9cec6e2baec63ed96cd31a97770c6a63b96d1169a8b5586ec071c8778.exe
4984	6326bea9cec6e2baec63ed96cd31a97770c6a63b96d1169a8b5586ec071c8778.exe
4984	6326bea9cec6e2baec63ed96cd31a97770c6a63b96d1169a8b5586ec071c8778.exe
4984	6326bea9cec6e2baec63ed96cd31a97770c6a63b96d1169a8b5586ec071c8778.exe
4984	6326bea9cec6e2baec63ed96cd31a97770c6a63b96d1169a8b5586ec071c8778.exe
4984	6326bea9cec6e2baec63ed96cd31a97770c6a63b96d1169a8b5586ec071c8778.exe
4984	6326bea9cec6e2baec63ed96cd31a97770c6a63b96d1169a8b5586ec071c8778.exe
4984	6326bea9cec6e2baec63ed96cd31a97770c6a63b96d1169a8b5586ec071c8778.exe
4984	6326bea9cec6e2baec63ed96cd31a97770c6a63b96d1169a8b5586ec071c8778.exe
4984	6326bea9cec6e2baec63ed96cd31a97770c6a63b96d1169a8b5586ec071c8778.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

6326bea9cec6e2baec63ed96cd31a97770c6a63b96d1169a8b5586ec071c8778.exe

pid process

4984 6326bea9cec6e2baec63ed96cd31a97770c6a63b96d1169a8b5586ec071c8778.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

6326bea9cec6e2baec63ed96cd31a97770c6a63b96d1169a8b5586ec071c8778.exe

description	pid	process
Token: SeDebugPrivilege	4984	6326bea9cec6e2baec63ed96cd31a97770c6a63b96d1169a8b5586ec071c8778.exe
Token: SeLoadDriverPrivilege	4984	6326bea9cec6e2baec63ed96cd31a97770c6a63b96d1169a8b5586ec071c8778.exe
Token: SeDebugPrivilege	4984	6326bea9cec6e2baec63ed96cd31a97770c6a63b96d1169a8b5586ec071c8778.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

6326bea9cec6e2baec63ed96cd31a97770c6a63b96d1169a8b5586ec071c8778.exe

description	pid	process	target process
PID 4984 wrote to memory of 2100	4984	6326bea9cec6e2baec63ed96cd31a97770c6a63b96d1169a8b5586ec071c8778.exe	EdmGen.exe
PID 4984 wrote to memory of 2100	4984	6326bea9cec6e2baec63ed96cd31a97770c6a63b96d1169a8b5586ec071c8778.exe	EdmGen.exe
PID 4984 wrote to memory of 1520	4984	6326bea9cec6e2baec63ed96cd31a97770c6a63b96d1169a8b5586ec071c8778.exe	ComSvcConfig.exe
PID 4984 wrote to memory of 1520	4984	6326bea9cec6e2baec63ed96cd31a97770c6a63b96d1169a8b5586ec071c8778.exe	ComSvcConfig.exe
PID 4984 wrote to memory of 64	4984	6326bea9cec6e2baec63ed96cd31a97770c6a63b96d1169a8b5586ec071c8778.exe	aspnet_regiis.exe
PID 4984 wrote to memory of 64	4984	6326bea9cec6e2baec63ed96cd31a97770c6a63b96d1169a8b5586ec071c8778.exe	aspnet_regiis.exe
PID 4984 wrote to memory of 1028	4984	6326bea9cec6e2baec63ed96cd31a97770c6a63b96d1169a8b5586ec071c8778.exe	RegAsm.exe
PID 4984 wrote to memory of 1028	4984	6326bea9cec6e2baec63ed96cd31a97770c6a63b96d1169a8b5586ec071c8778.exe	RegAsm.exe
PID 4984 wrote to memory of 1468	4984	6326bea9cec6e2baec63ed96cd31a97770c6a63b96d1169a8b5586ec071c8778.exe	aspnet_compiler.exe
PID 4984 wrote to memory of 1468	4984	6326bea9cec6e2baec63ed96cd31a97770c6a63b96d1169a8b5586ec071c8778.exe	aspnet_compiler.exe
PID 4984 wrote to memory of 2592	4984	6326bea9cec6e2baec63ed96cd31a97770c6a63b96d1169a8b5586ec071c8778.exe	WsatConfig.exe
PID 4984 wrote to memory of 2592	4984	6326bea9cec6e2baec63ed96cd31a97770c6a63b96d1169a8b5586ec071c8778.exe	WsatConfig.exe
PID 4984 wrote to memory of 2752	4984	6326bea9cec6e2baec63ed96cd31a97770c6a63b96d1169a8b5586ec071c8778.exe	RegSvcs.exe
PID 4984 wrote to memory of 2752	4984	6326bea9cec6e2baec63ed96cd31a97770c6a63b96d1169a8b5586ec071c8778.exe	RegSvcs.exe
PID 4984 wrote to memory of 4952	4984	6326bea9cec6e2baec63ed96cd31a97770c6a63b96d1169a8b5586ec071c8778.exe	mscorsvw.exe
PID 4984 wrote to memory of 4952	4984	6326bea9cec6e2baec63ed96cd31a97770c6a63b96d1169a8b5586ec071c8778.exe	mscorsvw.exe
PID 4984 wrote to memory of 1080	4984	6326bea9cec6e2baec63ed96cd31a97770c6a63b96d1169a8b5586ec071c8778.exe	SMSvcHost.exe
PID 4984 wrote to memory of 1080	4984	6326bea9cec6e2baec63ed96cd31a97770c6a63b96d1169a8b5586ec071c8778.exe	SMSvcHost.exe
PID 4984 wrote to memory of 4156	4984	6326bea9cec6e2baec63ed96cd31a97770c6a63b96d1169a8b5586ec071c8778.exe	jsc.exe
PID 4984 wrote to memory of 4156	4984	6326bea9cec6e2baec63ed96cd31a97770c6a63b96d1169a8b5586ec071c8778.exe	jsc.exe
PID 4984 wrote to memory of 4156	4984	6326bea9cec6e2baec63ed96cd31a97770c6a63b96d1169a8b5586ec071c8778.exe	jsc.exe
PID 4984 wrote to memory of 4156	4984	6326bea9cec6e2baec63ed96cd31a97770c6a63b96d1169a8b5586ec071c8778.exe	jsc.exe
PID 4984 wrote to memory of 4156	4984	6326bea9cec6e2baec63ed96cd31a97770c6a63b96d1169a8b5586ec071c8778.exe	jsc.exe
PID 4984 wrote to memory of 4156	4984	6326bea9cec6e2baec63ed96cd31a97770c6a63b96d1169a8b5586ec071c8778.exe	jsc.exe
PID 4984 wrote to memory of 4156	4984	6326bea9cec6e2baec63ed96cd31a97770c6a63b96d1169a8b5586ec071c8778.exe	jsc.exe
PID 4984 wrote to memory of 4156	4984	6326bea9cec6e2baec63ed96cd31a97770c6a63b96d1169a8b5586ec071c8778.exe	jsc.exe
PID 4984 wrote to memory of 4156	4984	6326bea9cec6e2baec63ed96cd31a97770c6a63b96d1169a8b5586ec071c8778.exe	jsc.exe
PID 4984 wrote to memory of 4156	4984	6326bea9cec6e2baec63ed96cd31a97770c6a63b96d1169a8b5586ec071c8778.exe	jsc.exe
PID 4984 wrote to memory of 4156	4984	6326bea9cec6e2baec63ed96cd31a97770c6a63b96d1169a8b5586ec071c8778.exe	jsc.exe

C:\Users\Admin\AppData\Local\Temp\6326bea9cec6e2baec63ed96cd31a97770c6a63b96d1169a8b5586ec071c8778.exe
"C:\Users\Admin\AppData\Local\Temp\6326bea9cec6e2baec63ed96cd31a97770c6a63b96d1169a8b5586ec071c8778.exe"
1⤵
- Sets service image path in registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4984

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe"
2⤵
PID:2100

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe"
2⤵
PID:1520

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe"
2⤵
PID:64

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe"
2⤵
PID:1028

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"
2⤵
PID:1468

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe"
2⤵
PID:2592

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe"
2⤵
PID:2752

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe"
2⤵
PID:4952

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe"
2⤵
PID:1080

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe"
2⤵
PID:4156

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4156-134-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4156-135-0x0000000000403980-mapping.dmp

Download
memory/4156-136-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4156-138-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4156-139-0x0000000001370000-0x0000000001379000-memory.dmp

Filesize
36KB

Download
memory/4156-140-0x0000000001470000-0x000000000147D000-memory.dmp

Filesize
52KB

Download
memory/4984-132-0x000002A49B7A0000-0x000002A49B854000-memory.dmp

Filesize
720KB

Download
memory/4984-133-0x00007FF9C6AF0000-0x00007FF9C75B1000-memory.dmp

Filesize
10.8MB

Download
memory/4984-137-0x00007FF9C6AF0000-0x00007FF9C75B1000-memory.dmp

Filesize
10.8MB

Download