lgoogloader | 70c0eab50ed39298ca6961b54dff822adde204067d84d1783f7d1b88ebbfe360

General

Target

file.exe
Size

710KB
MD5

8536f1680e65cb9b9e93fa916d2ae93b
SHA1

2eb995c3da87f07fcbfb48008afbf3253ea86e76
SHA256

70c0eab50ed39298ca6961b54dff822adde204067d84d1783f7d1b88ebbfe360
SHA512

7a34ec0fdfe7977bfbd07b2041172155d32019910801e8cf0c60a64c1d0a50dc2f1f6c028507039b5fca71575475f5f060d10931458f1518613ad332282c4ec7
SSDEEP

12288:ErIIpwFjtUQ0RlPdPd64bRZUDNVR9WnsGJxoeM4:ErIKQtUpfVPd6A/UjunLJxoC

Score

10^/10

lgoogloader downloader persistence

Malware Config

Signatures

Detects LgoogLoader payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/568-62-0x00000000000E0000-0x00000000000ED000-memory.dmp	family_lgoogloader

LgoogLoader
A downloader capable of dropping and executing other malware families.
downloader lgoogloader

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

file.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\TaskKill\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\Иисус.sys"	file.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

file.exe

description pid process target process

PID 2000 set thread context of 568 2000 file.exe jsc.exe

description	pid	process	target process
PID 2000 set thread context of 568	2000	file.exe	jsc.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

file.exe

pid	process
2000	file.exe
2000	file.exe
2000	file.exe
2000	file.exe
2000	file.exe
2000	file.exe
2000	file.exe
2000	file.exe
2000	file.exe
2000	file.exe
2000	file.exe
2000	file.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

file.exe

pid process

2000 file.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

file.exe

description pid process

Token: SeDebugPrivilege 2000 file.exe
Token: SeLoadDriverPrivilege 2000 file.exe
Token: SeDebugPrivilege 2000 file.exe

description	pid	process
Token: SeDebugPrivilege	2000	file.exe
Token: SeLoadDriverPrivilege	2000	file.exe
Token: SeDebugPrivilege	2000	file.exe

Suspicious use of WriteProcessMemory 48 IoCs

Processes:

file.exe

description	pid	process	target process
PID 2000 wrote to memory of 1944	2000	file.exe	regtlibv12.exe
PID 2000 wrote to memory of 1944	2000	file.exe	regtlibv12.exe
PID 2000 wrote to memory of 1944	2000	file.exe	regtlibv12.exe
PID 2000 wrote to memory of 1952	2000	file.exe	WsatConfig.exe
PID 2000 wrote to memory of 1952	2000	file.exe	WsatConfig.exe
PID 2000 wrote to memory of 1952	2000	file.exe	WsatConfig.exe
PID 2000 wrote to memory of 952	2000	file.exe	InstallUtil.exe
PID 2000 wrote to memory of 952	2000	file.exe	InstallUtil.exe
PID 2000 wrote to memory of 952	2000	file.exe	InstallUtil.exe
PID 2000 wrote to memory of 1912	2000	file.exe	dfsvc.exe
PID 2000 wrote to memory of 1912	2000	file.exe	dfsvc.exe
PID 2000 wrote to memory of 1912	2000	file.exe	dfsvc.exe
PID 2000 wrote to memory of 1636	2000	file.exe	RegSvcs.exe
PID 2000 wrote to memory of 1636	2000	file.exe	RegSvcs.exe
PID 2000 wrote to memory of 1636	2000	file.exe	RegSvcs.exe
PID 2000 wrote to memory of 564	2000	file.exe	aspnet_regsql.exe
PID 2000 wrote to memory of 564	2000	file.exe	aspnet_regsql.exe
PID 2000 wrote to memory of 564	2000	file.exe	aspnet_regsql.exe
PID 2000 wrote to memory of 1504	2000	file.exe	csc.exe
PID 2000 wrote to memory of 1504	2000	file.exe	csc.exe
PID 2000 wrote to memory of 1504	2000	file.exe	csc.exe
PID 2000 wrote to memory of 868	2000	file.exe	aspnet_regbrowsers.exe
PID 2000 wrote to memory of 868	2000	file.exe	aspnet_regbrowsers.exe
PID 2000 wrote to memory of 868	2000	file.exe	aspnet_regbrowsers.exe
PID 2000 wrote to memory of 1372	2000	file.exe	AddInUtil.exe
PID 2000 wrote to memory of 1372	2000	file.exe	AddInUtil.exe
PID 2000 wrote to memory of 1372	2000	file.exe	AddInUtil.exe
PID 2000 wrote to memory of 668	2000	file.exe	RegAsm.exe
PID 2000 wrote to memory of 668	2000	file.exe	RegAsm.exe
PID 2000 wrote to memory of 668	2000	file.exe	RegAsm.exe
PID 2000 wrote to memory of 684	2000	file.exe	AppLaunch.exe
PID 2000 wrote to memory of 684	2000	file.exe	AppLaunch.exe
PID 2000 wrote to memory of 684	2000	file.exe	AppLaunch.exe
PID 2000 wrote to memory of 432	2000	file.exe	ComSvcConfig.exe
PID 2000 wrote to memory of 432	2000	file.exe	ComSvcConfig.exe
PID 2000 wrote to memory of 432	2000	file.exe	ComSvcConfig.exe
PID 2000 wrote to memory of 568	2000	file.exe	jsc.exe
PID 2000 wrote to memory of 568	2000	file.exe	jsc.exe
PID 2000 wrote to memory of 568	2000	file.exe	jsc.exe
PID 2000 wrote to memory of 568	2000	file.exe	jsc.exe
PID 2000 wrote to memory of 568	2000	file.exe	jsc.exe
PID 2000 wrote to memory of 568	2000	file.exe	jsc.exe
PID 2000 wrote to memory of 568	2000	file.exe	jsc.exe
PID 2000 wrote to memory of 568	2000	file.exe	jsc.exe
PID 2000 wrote to memory of 568	2000	file.exe	jsc.exe
PID 2000 wrote to memory of 568	2000	file.exe	jsc.exe
PID 2000 wrote to memory of 568	2000	file.exe	jsc.exe
PID 2000 wrote to memory of 568	2000	file.exe	jsc.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Sets service image path in registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2000

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regtlibv12.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regtlibv12.exe"
2⤵
PID:1944

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe"
2⤵
PID:1952

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
2⤵
PID:952

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
2⤵
PID:1912

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe"
2⤵
PID:1636

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe"
2⤵
PID:564

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"
2⤵
PID:1504

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe"
2⤵
PID:868

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe"
2⤵
PID:1372

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe"
2⤵
PID:668

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe"
2⤵
PID:684

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe"
2⤵
PID:432

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe"
2⤵
PID:568

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/568-57-0x0000000000403980-mapping.dmp

Download
memory/568-56-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/568-60-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/568-59-0x0000000075D11000-0x0000000075D13000-memory.dmp

Filesize
8KB

Download
memory/568-61-0x00000000000C0000-0x00000000000C9000-memory.dmp

Filesize
36KB

Download
memory/568-62-0x00000000000E0000-0x00000000000ED000-memory.dmp

Filesize
52KB

Download
memory/2000-54-0x00000000012E0000-0x0000000001394000-memory.dmp

Filesize
720KB

Download
memory/2000-55-0x00000000010B0000-0x000000000112C000-memory.dmp

Filesize
496KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads