lgoogloader | d31807444bfccc0098292f170da09220ed8f5c1aaccf08d9d01c9438c7e0c4f8

General

Target

b70354fa72344ed5262ef55243ab71e20149fcd87ec772b4b77ea44c93ff79b8.exe
Size

1.7MB
MD5

7811c8e24019a783e1c72e7eeb58215f
SHA1

d21422ed627d291a80e08fa77d3cfc126e94d4cc
SHA256

b70354fa72344ed5262ef55243ab71e20149fcd87ec772b4b77ea44c93ff79b8
SHA512

1f6299d5df5fa6c59f5cefe1a4b64e19511e5308c82d279d237bf1d6492fcc7e01eff349382c9dfddaf51e01f55d735849c6ba351f86a4fa437dae811efbcf10
SSDEEP

24576:IzYyxHFKIlJX0oXMAsksIyESF/PvWGS5JcT1pWNpFj6zpe3rNNyJfOxmsAYQCOUO:+YyjxM3kMF/Eb+o3QYQJURnCyZrxS

Score

10^/10

lgoogloader vidar ba1fc89d9f7df84dadf34886aabb246c downloader spyware stealer

Malware Config

Extracted

Family

vidar

Version

3.1

Botnet

ba1fc89d9f7df84dadf34886aabb246c

C2

https://t.me/owned001

http://65.109.236.2:80

https://t.me/tabootalks

https://steamcommunity.com/profiles/76561199472266392

http://135.181.26.183:80

Attributes

profile_id_v2
ba1fc89d9f7df84dadf34886aabb246c
user_agent
Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36 OPR/91.0.4516.79

Signatures

Detects LgoogLoader payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2624-140-0x0000000001140000-0x000000000114D000-memory.dmp	family_lgoogloader

LgoogLoader
A downloader capable of dropping and executing other malware families.
downloader lgoogloader
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

b70354fa72344ed5262ef55243ab71e20149fcd87ec772b4b77ea44c93ff79b8.exe

description pid process target process

PID 4504 created 2572 4504 b70354fa72344ed5262ef55243ab71e20149fcd87ec772b4b77ea44c93ff79b8.exe taskhostw.exe
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Loads dropped DLL 3 IoCs

Processes:

b70354fa72344ed5262ef55243ab71e20149fcd87ec772b4b77ea44c93ff79b8.exefontview.exe

pid process

4504 b70354fa72344ed5262ef55243ab71e20149fcd87ec772b4b77ea44c93ff79b8.exe
1144 fontview.exe
1144 fontview.exe
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

description	pid	process	target process
PID 4504 created 2572	4504	b70354fa72344ed5262ef55243ab71e20149fcd87ec772b4b77ea44c93ff79b8.exe	taskhostw.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

b70354fa72344ed5262ef55243ab71e20149fcd87ec772b4b77ea44c93ff79b8.exe

description	pid	process	target process
PID 4504 set thread context of 2624	4504	b70354fa72344ed5262ef55243ab71e20149fcd87ec772b4b77ea44c93ff79b8.exe	ngentask.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3892 1144 WerFault.exe fontview.exe

pid	pid_target	process	target process
3892	1144	WerFault.exe	fontview.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

fontview.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	fontview.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	fontview.exe

Suspicious behavior: EnumeratesProcesses 50 IoCs

Processes:

b70354fa72344ed5262ef55243ab71e20149fcd87ec772b4b77ea44c93ff79b8.exefontview.exe

pid	process
4504	b70354fa72344ed5262ef55243ab71e20149fcd87ec772b4b77ea44c93ff79b8.exe
4504	b70354fa72344ed5262ef55243ab71e20149fcd87ec772b4b77ea44c93ff79b8.exe
4504	b70354fa72344ed5262ef55243ab71e20149fcd87ec772b4b77ea44c93ff79b8.exe
4504	b70354fa72344ed5262ef55243ab71e20149fcd87ec772b4b77ea44c93ff79b8.exe
4504	b70354fa72344ed5262ef55243ab71e20149fcd87ec772b4b77ea44c93ff79b8.exe
4504	b70354fa72344ed5262ef55243ab71e20149fcd87ec772b4b77ea44c93ff79b8.exe
4504	b70354fa72344ed5262ef55243ab71e20149fcd87ec772b4b77ea44c93ff79b8.exe
4504	b70354fa72344ed5262ef55243ab71e20149fcd87ec772b4b77ea44c93ff79b8.exe
4504	b70354fa72344ed5262ef55243ab71e20149fcd87ec772b4b77ea44c93ff79b8.exe
4504	b70354fa72344ed5262ef55243ab71e20149fcd87ec772b4b77ea44c93ff79b8.exe
4504	b70354fa72344ed5262ef55243ab71e20149fcd87ec772b4b77ea44c93ff79b8.exe
4504	b70354fa72344ed5262ef55243ab71e20149fcd87ec772b4b77ea44c93ff79b8.exe
4504	b70354fa72344ed5262ef55243ab71e20149fcd87ec772b4b77ea44c93ff79b8.exe
4504	b70354fa72344ed5262ef55243ab71e20149fcd87ec772b4b77ea44c93ff79b8.exe
4504	b70354fa72344ed5262ef55243ab71e20149fcd87ec772b4b77ea44c93ff79b8.exe
4504	b70354fa72344ed5262ef55243ab71e20149fcd87ec772b4b77ea44c93ff79b8.exe
4504	b70354fa72344ed5262ef55243ab71e20149fcd87ec772b4b77ea44c93ff79b8.exe
4504	b70354fa72344ed5262ef55243ab71e20149fcd87ec772b4b77ea44c93ff79b8.exe
4504	b70354fa72344ed5262ef55243ab71e20149fcd87ec772b4b77ea44c93ff79b8.exe
4504	b70354fa72344ed5262ef55243ab71e20149fcd87ec772b4b77ea44c93ff79b8.exe
4504	b70354fa72344ed5262ef55243ab71e20149fcd87ec772b4b77ea44c93ff79b8.exe
4504	b70354fa72344ed5262ef55243ab71e20149fcd87ec772b4b77ea44c93ff79b8.exe
4504	b70354fa72344ed5262ef55243ab71e20149fcd87ec772b4b77ea44c93ff79b8.exe
4504	b70354fa72344ed5262ef55243ab71e20149fcd87ec772b4b77ea44c93ff79b8.exe
4504	b70354fa72344ed5262ef55243ab71e20149fcd87ec772b4b77ea44c93ff79b8.exe
4504	b70354fa72344ed5262ef55243ab71e20149fcd87ec772b4b77ea44c93ff79b8.exe
4504	b70354fa72344ed5262ef55243ab71e20149fcd87ec772b4b77ea44c93ff79b8.exe
4504	b70354fa72344ed5262ef55243ab71e20149fcd87ec772b4b77ea44c93ff79b8.exe
4504	b70354fa72344ed5262ef55243ab71e20149fcd87ec772b4b77ea44c93ff79b8.exe
4504	b70354fa72344ed5262ef55243ab71e20149fcd87ec772b4b77ea44c93ff79b8.exe
4504	b70354fa72344ed5262ef55243ab71e20149fcd87ec772b4b77ea44c93ff79b8.exe
4504	b70354fa72344ed5262ef55243ab71e20149fcd87ec772b4b77ea44c93ff79b8.exe
4504	b70354fa72344ed5262ef55243ab71e20149fcd87ec772b4b77ea44c93ff79b8.exe
4504	b70354fa72344ed5262ef55243ab71e20149fcd87ec772b4b77ea44c93ff79b8.exe
4504	b70354fa72344ed5262ef55243ab71e20149fcd87ec772b4b77ea44c93ff79b8.exe
4504	b70354fa72344ed5262ef55243ab71e20149fcd87ec772b4b77ea44c93ff79b8.exe
4504	b70354fa72344ed5262ef55243ab71e20149fcd87ec772b4b77ea44c93ff79b8.exe
4504	b70354fa72344ed5262ef55243ab71e20149fcd87ec772b4b77ea44c93ff79b8.exe
4504	b70354fa72344ed5262ef55243ab71e20149fcd87ec772b4b77ea44c93ff79b8.exe
4504	b70354fa72344ed5262ef55243ab71e20149fcd87ec772b4b77ea44c93ff79b8.exe
4504	b70354fa72344ed5262ef55243ab71e20149fcd87ec772b4b77ea44c93ff79b8.exe
4504	b70354fa72344ed5262ef55243ab71e20149fcd87ec772b4b77ea44c93ff79b8.exe
4504	b70354fa72344ed5262ef55243ab71e20149fcd87ec772b4b77ea44c93ff79b8.exe
4504	b70354fa72344ed5262ef55243ab71e20149fcd87ec772b4b77ea44c93ff79b8.exe
4504	b70354fa72344ed5262ef55243ab71e20149fcd87ec772b4b77ea44c93ff79b8.exe
4504	b70354fa72344ed5262ef55243ab71e20149fcd87ec772b4b77ea44c93ff79b8.exe
4504	b70354fa72344ed5262ef55243ab71e20149fcd87ec772b4b77ea44c93ff79b8.exe
4504	b70354fa72344ed5262ef55243ab71e20149fcd87ec772b4b77ea44c93ff79b8.exe
1144	fontview.exe
1144	fontview.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

b70354fa72344ed5262ef55243ab71e20149fcd87ec772b4b77ea44c93ff79b8.exe

description	pid	process	target process
PID 4504 wrote to memory of 2624	4504	b70354fa72344ed5262ef55243ab71e20149fcd87ec772b4b77ea44c93ff79b8.exe	ngentask.exe
PID 4504 wrote to memory of 2624	4504	b70354fa72344ed5262ef55243ab71e20149fcd87ec772b4b77ea44c93ff79b8.exe	ngentask.exe
PID 4504 wrote to memory of 2624	4504	b70354fa72344ed5262ef55243ab71e20149fcd87ec772b4b77ea44c93ff79b8.exe	ngentask.exe
PID 4504 wrote to memory of 2624	4504	b70354fa72344ed5262ef55243ab71e20149fcd87ec772b4b77ea44c93ff79b8.exe	ngentask.exe
PID 4504 wrote to memory of 2624	4504	b70354fa72344ed5262ef55243ab71e20149fcd87ec772b4b77ea44c93ff79b8.exe	ngentask.exe
PID 4504 wrote to memory of 1144	4504	b70354fa72344ed5262ef55243ab71e20149fcd87ec772b4b77ea44c93ff79b8.exe	fontview.exe
PID 4504 wrote to memory of 1144	4504	b70354fa72344ed5262ef55243ab71e20149fcd87ec772b4b77ea44c93ff79b8.exe	fontview.exe
PID 4504 wrote to memory of 1144	4504	b70354fa72344ed5262ef55243ab71e20149fcd87ec772b4b77ea44c93ff79b8.exe	fontview.exe
PID 4504 wrote to memory of 1144	4504	b70354fa72344ed5262ef55243ab71e20149fcd87ec772b4b77ea44c93ff79b8.exe	fontview.exe

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2572
- C:\Windows\SysWOW64\fontview.exe
  "C:\Windows\SYSWOW64\fontview.exe"
  2⤵
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:1144
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1144 -s 1832
    3⤵
    - Program crash
    PID:3892

C:\Users\Admin\AppData\Local\Temp\b70354fa72344ed5262ef55243ab71e20149fcd87ec772b4b77ea44c93ff79b8.exe
"C:\Users\Admin\AppData\Local\Temp\b70354fa72344ed5262ef55243ab71e20149fcd87ec772b4b77ea44c93ff79b8.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4504
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"
  2⤵
  PID:2624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1144 -ip 1144
1⤵
PID:4708

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
C:\Users\Admin\AppData\Local\Temp\240551546.dll

Filesize
566KB

MD5
8e084634f942776f71c350a5545fe39f

SHA1
f245590544ddbfdd97691383fef1b1056d89f28a

SHA256
ee83bc569b8fd831c17845778042ffef7f4a96f9fa54a28ab8517ff2954a1517

SHA512
80e7350c1749923017bbcf08545ccea3ef78926557047a034aa99916851226c1c959bba74920cf3640abe124c0052cf0736662b5eabdbbeb91236602a20f13f0

Download Submit
memory/1144-145-0x00000000008E0000-0x000000000094D000-memory.dmp

Filesize
436KB

Download
memory/1144-156-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/1144-224-0x00000000008E0000-0x000000000094D000-memory.dmp

Filesize
436KB

Download
memory/1144-225-0x00000000008E0000-0x000000000094D000-memory.dmp

Filesize
436KB

Download
memory/2624-138-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2624-140-0x0000000001140000-0x000000000114D000-memory.dmp

Filesize
52KB

Download
memory/2624-139-0x0000000001120000-0x0000000001129000-memory.dmp

Filesize
36KB

Download
memory/2624-137-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2624-135-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4504-134-0x000000000B240000-0x000000000B4E3000-memory.dmp

Filesize
2.6MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads