Analysis Overview
SHA256
e47a532cd03b6821118c75b26215c13f83173e00afac9f5860cbaa119b9828e2
Threat Level: Known bad
The file 7120cf1ad3fdcae7ba6956749a8988e8181837a05948b432cec6ae11229b1d12_payload.bin was found to be: Known bad.
Malicious Activity Summary
LgoogLoader
Detects LgoogLoader payload
MITRE ATT&CK
Analysis: static1
Detonation Overview
Reported
2023-01-18 20:11
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2023-01-18 20:11
Reported
2023-01-18 20:13
Platform
win7-20221111-en
Max time kernel
31s
Max time network
34s
Command Line
Signatures
Detects LgoogLoader payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
LgoogLoader
Processes
C:\Users\Admin\AppData\Local\Temp\7120cf1ad3fdcae7ba6956749a8988e8181837a05948b432cec6ae11229b1d12_payload.exe
"C:\Users\Admin\AppData\Local\Temp\7120cf1ad3fdcae7ba6956749a8988e8181837a05948b432cec6ae11229b1d12_payload.exe"
Network
Files
memory/888-54-0x00000000759F1000-0x00000000759F3000-memory.dmp
memory/888-56-0x00000000000B0000-0x00000000000BD000-memory.dmp
memory/888-55-0x0000000000080000-0x0000000000089000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2023-01-18 20:11
Reported
2023-01-18 20:13
Platform
win10v2004-20220812-en
Max time kernel
144s
Max time network
164s
Command Line
Signatures
Detects LgoogLoader payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
LgoogLoader
Processes
C:\Users\Admin\AppData\Local\Temp\7120cf1ad3fdcae7ba6956749a8988e8181837a05948b432cec6ae11229b1d12_payload.exe
"C:\Users\Admin\AppData\Local\Temp\7120cf1ad3fdcae7ba6956749a8988e8181837a05948b432cec6ae11229b1d12_payload.exe"
Network
| Country | Destination | Domain | Proto |
| N/A | 93.184.220.29:80 | tcp | |
| N/A | 52.168.112.66:443 | tcp | |
| N/A | 8.8.8.8:53 | 176.122.125.40.in-addr.arpa | udp |
| N/A | 8.252.51.254:80 | tcp | |
| N/A | 104.80.225.205:443 | tcp | |
| N/A | 8.8.8.8:53 | 6.9.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.3.0.4.0.0.3.0.1.3.0.6.2.ip6.arpa | udp |
Files
memory/5080-132-0x0000000000DB0000-0x0000000000DB9000-memory.dmp
memory/5080-133-0x0000000002900000-0x000000000290D000-memory.dmp