lgoogloader | fee142712ee9fba0c3cc57b4e314480bf976e4b1707bbeb202a58ca2b98f39bd

Analysis

max time kernel
112s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23/01/2023, 03:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 1.8MB
Sample230123-ejg4psbf58
SHA256 fee142712ee9fba0c3cc57b4e314480bf976e4b1707bbeb202a58ca2b98f39bd
MD5 9939636c25206396c4919d90777f814d
SHA1 8cc2b7ea3cc5f67e76ba7d705dc97c91f4f8cb1a
SHA512 ada7df35959ab619ae45319a32f167fbcffb3d0266859d984e38fc343e7961d7d6105aef0254047ddfe0f1fcdfd3a826364ba6b117dafdf5155c541c32a33b08
SSDEEP 49152:VeD4m8wmppTlh/hn8K7/DEdgcWkygLudab3zzG:VeEm8wmppTlhpnp/4degLfe
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lgoogloader rhadamanthys downloader stealer

Malware Config

Signatures

Detect rhadamanthys stealer shellcode 2 IoCs

resource	yara_rule
behavioral2/memory/4680-148-0x00000000028E0000-0x00000000028FD000-memory.dmp	family_rhadamanthys
behavioral2/memory/4680-152-0x00000000028E0000-0x00000000028FD000-memory.dmp	family_rhadamanthys

Detects LgoogLoader payload 1 IoCs

resource	yara_rule
behavioral2/memory/1692-142-0x0000000002A00000-0x0000000002A0D000-memory.dmp	family_lgoogloader

LgoogLoader
A downloader capable of dropping and executing other malware families.
downloader lgoogloader
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 520 created 2616	520	file.exe	44

Loads dropped DLL 1 IoCs

pid	Process
520	file.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
4680	fontview.exe
4680	fontview.exe
4680	fontview.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 520 set thread context of 1692	520	file.exe	82

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3632	520	WerFault.exe	78
5104	520	WerFault.exe	78

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	fontview.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	fontview.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	fontview.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	fontview.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	fontview.exe

Suspicious behavior: EnumeratesProcesses 46 IoCs

pid	Process
520	file.exe
520	file.exe
520	file.exe
520	file.exe
520	file.exe
520	file.exe
520	file.exe
520	file.exe
520	file.exe
520	file.exe
520	file.exe
520	file.exe
520	file.exe
520	file.exe
520	file.exe
520	file.exe
520	file.exe
520	file.exe
520	file.exe
520	file.exe
520	file.exe
520	file.exe
520	file.exe
520	file.exe
520	file.exe
520	file.exe
520	file.exe
520	file.exe
520	file.exe
520	file.exe
520	file.exe
520	file.exe
520	file.exe
520	file.exe
520	file.exe
520	file.exe
520	file.exe
520	file.exe
520	file.exe
520	file.exe
520	file.exe
520	file.exe
520	file.exe
520	file.exe
520	file.exe
520	file.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4680	fontview.exe
Token: SeCreatePagefilePrivilege	4680	fontview.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 520 wrote to memory of 1692	520	file.exe	82
PID 520 wrote to memory of 1692	520	file.exe	82
PID 520 wrote to memory of 1692	520	file.exe	82
PID 520 wrote to memory of 1692	520	file.exe	82
PID 520 wrote to memory of 1692	520	file.exe	82
PID 520 wrote to memory of 4680	520	file.exe	83
PID 520 wrote to memory of 4680	520	file.exe	83
PID 520 wrote to memory of 4680	520	file.exe	83
PID 520 wrote to memory of 4680	520	file.exe	83

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2616
- C:\Windows\SysWOW64\fontview.exe
  "C:\Windows\SYSWOW64\fontview.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Checks SCSI registry key(s)
  - Suspicious use of AdjustPrivilegeToken
  PID:4680

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:520
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"
  2⤵
  PID:1692
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 520 -s 584
  2⤵
  - Program crash
  PID:3632
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 520 -s 628
  2⤵
  - Program crash
  PID:5104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 520 -ip 520
1⤵
PID:4160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 520 -ip 520
1⤵
PID:4784

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

240554734.dll

Path C:\Users\Admin\AppData\Local\Temp\240554734.dll
Size 335KB
SHA256 959bd4b08d3f72347082976e5e6b5ad2a04201cda4a4b67d27dc3dfe04c73ebe
MD5 af92bfcb7e4c67628a686accbf4231df
SHA1 e5b392743d1731ca6fbe6b344d88028588548cac
SHA512 553c992234635a6e1463ce99107346200c8fbdcfc41421021761321a5e4621db774a6a0e7df0b3883bd1d367c0a58d031443ced015e01875b88e3695fb71f23c
SSDEEP 6144:224+ZV6NuvwV+hq3kd2UaXYnKUFbMFi+hSUgK+2c8SarppXad:7uNuvwUhq3kd2USYKUWFiUSUgK+2c8Sb
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/520-133-0x000000000F780000-0x000000000FA63000-memory.dmp

Download

memory/520-134-0x000000000F780000-0x000000000FA63000-memory.dmp

Download

memory/520-154-0x0000000002F60000-0x00000000030E8000-memory.dmp

Download

memory/520-153-0x000000000F780000-0x000000000FA63000-memory.dmp

Download

memory/520-132-0x0000000002F60000-0x00000000030E8000-memory.dmp

Download

memory/520-150-0x0000000002F60000-0x00000000030E8000-memory.dmp

Download

memory/1692-138-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1692-139-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1692-142-0x0000000002A00000-0x0000000002A0D000-memory.dmp

Download

memory/1692-140-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1692-141-0x00000000029E0000-0x00000000029E9000-memory.dmp

Download

memory/1692-136-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4680-144-0x0000000000B30000-0x0000000000B65000-memory.dmp

Download

memory/4680-148-0x00000000028E0000-0x00000000028FD000-memory.dmp

Download

memory/4680-149-0x0000000002DC0000-0x0000000003DC0000-memory.dmp

Download

memory/4680-147-0x0000000001014000-0x0000000001017000-memory.dmp

Download

memory/4680-151-0x0000000000B30000-0x0000000000B65000-memory.dmp

Download

memory/4680-152-0x00000000028E0000-0x00000000028FD000-memory.dmp

Download

memory/4680-146-0x0000000000B30000-0x0000000000B65000-memory.dmp

Download