lgoogloader | 70c0eab50ed39298ca6961b54dff822adde204067d84d1783f7d1b88ebbfe360

Analysis

max time kernel
146s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
18-01-2023 06:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

710KB
MD5

8536f1680e65cb9b9e93fa916d2ae93b
SHA1

2eb995c3da87f07fcbfb48008afbf3253ea86e76
SHA256

70c0eab50ed39298ca6961b54dff822adde204067d84d1783f7d1b88ebbfe360
SHA512

7a34ec0fdfe7977bfbd07b2041172155d32019910801e8cf0c60a64c1d0a50dc2f1f6c028507039b5fca71575475f5f060d10931458f1518613ad332282c4ec7
SSDEEP

12288:ErIIpwFjtUQ0RlPdPd64bRZUDNVR9WnsGJxoeM4:ErIKQtUpfVPd6A/UjunLJxoC

Score

10^/10

lgoogloader downloader persistence

Malware Config

Signatures

Detects LgoogLoader payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4932-140-0x00000000014A0000-0x00000000014AD000-memory.dmp	family_lgoogloader

LgoogLoader
A downloader capable of dropping and executing other malware families.
downloader lgoogloader

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

file.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\TaskKill\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\Иисус.sys"	file.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

file.exe

description pid process target process

PID 1964 set thread context of 4932 1964 file.exe jsc.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

file.exe

pid process

1964 file.exe
1964 file.exe
1964 file.exe
1964 file.exe
1964 file.exe
1964 file.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

file.exe

pid process

1964 file.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

file.exe

description pid process

Token: SeDebugPrivilege 1964 file.exe
Token: SeLoadDriverPrivilege 1964 file.exe
Token: SeDebugPrivilege 1964 file.exe

description	pid	process	target process
PID 1964 set thread context of 4932	1964	file.exe	jsc.exe

pid	process
1964	file.exe
1964	file.exe
1964	file.exe
1964	file.exe
1964	file.exe
1964	file.exe

pid	process
1964	file.exe

description	pid	process
Token: SeDebugPrivilege	1964	file.exe
Token: SeLoadDriverPrivilege	1964	file.exe
Token: SeDebugPrivilege	1964	file.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

file.exe

description	pid	process	target process
PID 1964 wrote to memory of 4068	1964	file.exe	CasPol.exe
PID 1964 wrote to memory of 4068	1964	file.exe	CasPol.exe
PID 1964 wrote to memory of 4628	1964	file.exe	aspnet_regbrowsers.exe
PID 1964 wrote to memory of 4628	1964	file.exe	aspnet_regbrowsers.exe
PID 1964 wrote to memory of 4924	1964	file.exe	WsatConfig.exe
PID 1964 wrote to memory of 4924	1964	file.exe	WsatConfig.exe
PID 1964 wrote to memory of 4932	1964	file.exe	jsc.exe
PID 1964 wrote to memory of 4932	1964	file.exe	jsc.exe
PID 1964 wrote to memory of 4932	1964	file.exe	jsc.exe
PID 1964 wrote to memory of 4932	1964	file.exe	jsc.exe
PID 1964 wrote to memory of 4932	1964	file.exe	jsc.exe
PID 1964 wrote to memory of 4932	1964	file.exe	jsc.exe
PID 1964 wrote to memory of 4932	1964	file.exe	jsc.exe
PID 1964 wrote to memory of 4932	1964	file.exe	jsc.exe
PID 1964 wrote to memory of 4932	1964	file.exe	jsc.exe
PID 1964 wrote to memory of 4932	1964	file.exe	jsc.exe
PID 1964 wrote to memory of 4932	1964	file.exe	jsc.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Sets service image path in registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1964

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe"
2⤵
PID:4068

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe"
2⤵
PID:4628

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe"
2⤵
PID:4924

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe"
2⤵
PID:4932

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1964-132-0x000001DDC6A70000-0x000001DDC6B24000-memory.dmp

Filesize
720KB

Download
memory/1964-133-0x00007FFBBCCE0000-0x00007FFBBD7A1000-memory.dmp

Filesize
10.8MB

Download
memory/1964-137-0x00007FFBBCCE0000-0x00007FFBBD7A1000-memory.dmp

Filesize
10.8MB

Download
memory/4932-134-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4932-135-0x0000000000403980-mapping.dmp

Download
memory/4932-136-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4932-138-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4932-139-0x0000000001300000-0x0000000001309000-memory.dmp

Filesize
36KB

Download
memory/4932-140-0x00000000014A0000-0x00000000014AD000-memory.dmp

Filesize
52KB

Download