lgoogloader | 111d6bd8088e8de3b52cb8ee838e0af2c2de59401451e06f068d9bee0c740440

Analysis

max time kernel
156s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2023, 16:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 1.3MB
Sample230511-txhdysag96
SHA256 111d6bd8088e8de3b52cb8ee838e0af2c2de59401451e06f068d9bee0c740440
MD5 1fc4b7d9c8cd525a29e2c9e4f811c9dd
SHA1 cd96cff1e72ffddbc0eefc7558f4d100182ae541
SHA512 9a4feed3643a96044df6f1a03f9035173fe2a0513706b677505c2b42c33ecee1b50abfe7d7d73da4bf684ed069f99b7d9a3a79c86bd560ce0dd3b1275f793891
SSDEEP 12288:zGFL0JOstrdzLurI7HchVgDquQz1h/bLO9uycii/ffOKYSbjlDdB0uN0IOoVyhrv:kbuRAnfd3ZjbyCWTUD9Q3800Taz4pTva
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lgoogloader downloader persistence

Malware Config

Signatures

Detects LgoogLoader payload 1 IoCs

resource	yara_rule
behavioral2/memory/1584-143-0x0000000000EC0000-0x0000000000ECD000-memory.dmp	family_lgoogloader

LgoogLoader
A downloader capable of dropping and executing other malware families.
downloader lgoogloader

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\TaskKill\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\Иисус.sys"	file.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1944 set thread context of 1584	1944	file.exe	102

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
1944	file.exe
1944	file.exe
1944	file.exe
1944	file.exe
1944	file.exe
1944	file.exe
1944	file.exe
1944	file.exe
1944	file.exe
1944	file.exe
1944	file.exe
1944	file.exe
1944	file.exe
1944	file.exe
1944	file.exe
1944	file.exe
1944	file.exe
1944	file.exe
1944	file.exe
1944	file.exe
1944	file.exe
1944	file.exe
1944	file.exe
1944	file.exe
1944	file.exe
1944	file.exe
1944	file.exe
1944	file.exe
1944	file.exe
1944	file.exe
1944	file.exe
1944	file.exe
1944	file.exe
1944	file.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
1944	file.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1944	file.exe
Token: SeLoadDriverPrivilege	1944	file.exe
Token: SeDebugPrivilege	1944	file.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 2176	1944	file.exe	85
PID 1944 wrote to memory of 2176	1944	file.exe	85
PID 1944 wrote to memory of 2156	1944	file.exe	86
PID 1944 wrote to memory of 2156	1944	file.exe	86
PID 1944 wrote to memory of 4540	1944	file.exe	87
PID 1944 wrote to memory of 4540	1944	file.exe	87
PID 1944 wrote to memory of 2152	1944	file.exe	88
PID 1944 wrote to memory of 2152	1944	file.exe	88
PID 1944 wrote to memory of 3964	1944	file.exe	89
PID 1944 wrote to memory of 3964	1944	file.exe	89
PID 1944 wrote to memory of 2348	1944	file.exe	90
PID 1944 wrote to memory of 2348	1944	file.exe	90
PID 1944 wrote to memory of 2344	1944	file.exe	91
PID 1944 wrote to memory of 2344	1944	file.exe	91
PID 1944 wrote to memory of 1716	1944	file.exe	92
PID 1944 wrote to memory of 1716	1944	file.exe	92
PID 1944 wrote to memory of 3836	1944	file.exe	93
PID 1944 wrote to memory of 3836	1944	file.exe	93
PID 1944 wrote to memory of 1820	1944	file.exe	94
PID 1944 wrote to memory of 1820	1944	file.exe	94
PID 1944 wrote to memory of 212	1944	file.exe	95
PID 1944 wrote to memory of 212	1944	file.exe	95
PID 1944 wrote to memory of 220	1944	file.exe	96
PID 1944 wrote to memory of 220	1944	file.exe	96
PID 1944 wrote to memory of 224	1944	file.exe	97
PID 1944 wrote to memory of 224	1944	file.exe	97
PID 1944 wrote to memory of 3820	1944	file.exe	98
PID 1944 wrote to memory of 3820	1944	file.exe	98
PID 1944 wrote to memory of 260	1944	file.exe	99
PID 1944 wrote to memory of 260	1944	file.exe	99
PID 1944 wrote to memory of 860	1944	file.exe	100
PID 1944 wrote to memory of 860	1944	file.exe	100
PID 1944 wrote to memory of 4776	1944	file.exe	101
PID 1944 wrote to memory of 4776	1944	file.exe	101
PID 1944 wrote to memory of 1584	1944	file.exe	102
PID 1944 wrote to memory of 1584	1944	file.exe	102
PID 1944 wrote to memory of 1584	1944	file.exe	102
PID 1944 wrote to memory of 1584	1944	file.exe	102
PID 1944 wrote to memory of 1584	1944	file.exe	102
PID 1944 wrote to memory of 1584	1944	file.exe	102
PID 1944 wrote to memory of 1584	1944	file.exe	102
PID 1944 wrote to memory of 1584	1944	file.exe	102
PID 1944 wrote to memory of 1584	1944	file.exe	102
PID 1944 wrote to memory of 1584	1944	file.exe	102

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Sets service image path in registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe"
  2⤵
  PID:2176
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:2156
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe"
  2⤵
  PID:4540
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  PID:2152
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"
  2⤵
  PID:3964
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:2348
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"
  2⤵
  PID:2344
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe"
  2⤵
  PID:1716
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe"
  2⤵
  PID:3836
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe"
  2⤵
  PID:1820
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe"
  2⤵
  PID:212
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"
  2⤵
  PID:220
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe"
  2⤵
  PID:224
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe"
  2⤵
  PID:3820
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"
  2⤵
  PID:260
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe"
  2⤵
  PID:860
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe"
  2⤵
  PID:4776
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:1584

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1584-138-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1584-140-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1584-141-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1584-143-0x0000000000EC0000-0x0000000000ECD000-memory.dmp

Download

memory/1584-142-0x0000000000EA0000-0x0000000000EA9000-memory.dmp

Download

memory/1944-133-0x000001D1A7190000-0x000001D1A72DA000-memory.dmp

Download

memory/1944-134-0x000001D1A8F30000-0x000001D1A8FA6000-memory.dmp

Download

memory/1944-135-0x000001D1C1B30000-0x000001D1C1B40000-memory.dmp

Download

memory/1944-136-0x000001D1A7740000-0x000001D1A775E000-memory.dmp

Download