lgoogloader | 65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91

Analysis

max time kernel
117s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
13/05/2023, 17:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe
Size

1.4MB
MD5

da194fc0a973d6cccffbde4b5774e699
SHA1

5350d405a18d7386d32e348a1b685ae0dc6ff9a4
SHA256

65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91
SHA512

625ea058bdf687e59efbf44bcc49bfd2300eaded57fbc873e13aa2d6d7ab4a0ac21be1859e0b783e02e93273679afe4b0014956fc9ecceb8f0573adf01d13567
SSDEEP

24576:bkp5gJc0LjcQhC1au7XR8pLfBKjrrEi5I7d4:bkpIfLhC1aiOuG4

Score

10^/10

lgoogloader downloader persistence

Malware Config

Signatures

Detects LgoogLoader payload 1 IoCs

resource	yara_rule
behavioral1/memory/3760-142-0x0000000001790000-0x000000000179D000-memory.dmp	family_lgoogloader

LgoogLoader
A downloader capable of dropping and executing other malware families.
downloader lgoogloader

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\TaskKill\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\Иисус.sys"	65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4352 set thread context of 3760	4352	65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe	101

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
4352	65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe
4352	65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe
4352	65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe
4352	65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe
4352	65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe
4352	65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe
4352	65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe
4352	65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe
4352	65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe
4352	65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe
4352	65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe
4352	65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe
4352	65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe
4352	65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe
4352	65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe
4352	65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe
4352	65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe
4352	65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe
4352	65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe
4352	65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe
4352	65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe
4352	65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe
4352	65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe
4352	65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe
4352	65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe
4352	65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe
4352	65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe
4352	65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe
4352	65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe
4352	65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe
4352	65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe
4352	65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe
4352	65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe
4352	65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
4352	65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4352	65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe
Token: SeLoadDriverPrivilege	4352	65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe
Token: SeDebugPrivilege	4352	65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 4352 wrote to memory of 1876	4352	65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe	84
PID 4352 wrote to memory of 1876	4352	65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe	84
PID 4352 wrote to memory of 5060	4352	65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe	85
PID 4352 wrote to memory of 5060	4352	65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe	85
PID 4352 wrote to memory of 5056	4352	65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe	86
PID 4352 wrote to memory of 5056	4352	65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe	86
PID 4352 wrote to memory of 1660	4352	65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe	87
PID 4352 wrote to memory of 1660	4352	65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe	87
PID 4352 wrote to memory of 4116	4352	65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe	88
PID 4352 wrote to memory of 4116	4352	65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe	88
PID 4352 wrote to memory of 5064	4352	65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe	89
PID 4352 wrote to memory of 5064	4352	65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe	89
PID 4352 wrote to memory of 1668	4352	65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe	90
PID 4352 wrote to memory of 1668	4352	65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe	90
PID 4352 wrote to memory of 1832	4352	65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe	91
PID 4352 wrote to memory of 1832	4352	65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe	91
PID 4352 wrote to memory of 1576	4352	65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe	92
PID 4352 wrote to memory of 1576	4352	65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe	92
PID 4352 wrote to memory of 1052	4352	65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe	93
PID 4352 wrote to memory of 1052	4352	65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe	93
PID 4352 wrote to memory of 2468	4352	65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe	94
PID 4352 wrote to memory of 2468	4352	65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe	94
PID 4352 wrote to memory of 4808	4352	65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe	95
PID 4352 wrote to memory of 4808	4352	65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe	95
PID 4352 wrote to memory of 4068	4352	65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe	96
PID 4352 wrote to memory of 4068	4352	65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe	96
PID 4352 wrote to memory of 3908	4352	65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe	97
PID 4352 wrote to memory of 3908	4352	65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe	97
PID 4352 wrote to memory of 1268	4352	65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe	98
PID 4352 wrote to memory of 1268	4352	65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe	98
PID 4352 wrote to memory of 1284	4352	65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe	99
PID 4352 wrote to memory of 1284	4352	65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe	99
PID 4352 wrote to memory of 2516	4352	65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe	100
PID 4352 wrote to memory of 2516	4352	65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe	100
PID 4352 wrote to memory of 3760	4352	65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe	101
PID 4352 wrote to memory of 3760	4352	65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe	101
PID 4352 wrote to memory of 3760	4352	65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe	101
PID 4352 wrote to memory of 3760	4352	65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe	101
PID 4352 wrote to memory of 3760	4352	65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe	101
PID 4352 wrote to memory of 3760	4352	65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe	101
PID 4352 wrote to memory of 3760	4352	65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe	101
PID 4352 wrote to memory of 3760	4352	65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe	101
PID 4352 wrote to memory of 3760	4352	65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe	101
PID 4352 wrote to memory of 3760	4352	65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe	101

C:\Users\Admin\AppData\Local\Temp\65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe
"C:\Users\Admin\AppData\Local\Temp\65ce604e533d2bc6572497a19e4729a52970533955e0d72741ca8f065447db91.exe"
1⤵
- Sets service image path in registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4352
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe"
  2⤵
  PID:1876
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe"
  2⤵
  PID:5060
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe"
  2⤵
  PID:5056
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe"
  2⤵
  PID:1660
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:4116
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"
  2⤵
  PID:5064
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:1668
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe"
  2⤵
  PID:1832
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  PID:1576
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe"
  2⤵
  PID:1052
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe"
  2⤵
  PID:2468
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe"
  2⤵
  PID:4808
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"
  2⤵
  PID:4068
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe"
  2⤵
  PID:3908
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:1268
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"
  2⤵
  PID:1284
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe"
  2⤵
  PID:2516
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:3760

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3760-137-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3760-139-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3760-140-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3760-141-0x0000000001370000-0x0000000001379000-memory.dmp

Filesize
36KB

Download
memory/3760-142-0x0000000001790000-0x000000000179D000-memory.dmp

Filesize
52KB

Download
memory/4352-133-0x0000028F5C530000-0x0000028F5C6A4000-memory.dmp

Filesize
1.5MB

Download
memory/4352-134-0x0000028F76BE0000-0x0000028F76C8A000-memory.dmp

Filesize
680KB

Download
memory/4352-136-0x0000028F5CAB0000-0x0000028F5CAC0000-memory.dmp

Filesize
64KB

Download