lgoogloader | ee444f87cd33352f2bb9b9bc1a15ff2142613b78553343027f39d5c44128fee3

General

Target

ee444f87cd33352f2bb9b9bc1a15ff2142613b78553343027f39d5c44128fee3.exe
Size

21KB
MD5

3803666407877f6bc945425ce874653d
SHA1

fc824bd0430c2e70e9bfad65a70e78bf059aa82e
SHA256

ee444f87cd33352f2bb9b9bc1a15ff2142613b78553343027f39d5c44128fee3
SHA512

c223764ffb89b13a301904593045a5a5ae7b4eeb0d4f4e21c2a53e072d3d12f3e654f4a750a71fbb9679206c8682dc0664ff167ff142d03adb110e956923bdd2
SSDEEP

384:TAuZSCDIElD/AW6zyeUci3BBcWnYNBa20cDGXwfwqppg6+KnhkMSaTFTD:xlD/22eUcusWY6gZYUTJD

Score

10^/10

Malware Config

Signatures

Detects LgoogLoader payload 1 IoCs

resource	yara_rule
behavioral1/memory/4940-127-0x00000000014D0000-0x00000000014DD000-memory.dmp	family_lgoogloader

LgoogLoader
A downloader capable of dropping and executing other malware families.
downloader lgoogloader

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\TaskKill\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\Иисус.sys"	ee444f87cd33352f2bb9b9bc1a15ff2142613b78553343027f39d5c44128fee3.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3480 set thread context of 4940	3480	ee444f87cd33352f2bb9b9bc1a15ff2142613b78553343027f39d5c44128fee3.exe	68

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3480	ee444f87cd33352f2bb9b9bc1a15ff2142613b78553343027f39d5c44128fee3.exe
3480	ee444f87cd33352f2bb9b9bc1a15ff2142613b78553343027f39d5c44128fee3.exe
3480	ee444f87cd33352f2bb9b9bc1a15ff2142613b78553343027f39d5c44128fee3.exe
3480	ee444f87cd33352f2bb9b9bc1a15ff2142613b78553343027f39d5c44128fee3.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
3480	ee444f87cd33352f2bb9b9bc1a15ff2142613b78553343027f39d5c44128fee3.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3480	ee444f87cd33352f2bb9b9bc1a15ff2142613b78553343027f39d5c44128fee3.exe
Token: SeDebugPrivilege	3480	ee444f87cd33352f2bb9b9bc1a15ff2142613b78553343027f39d5c44128fee3.exe
Token: SeLoadDriverPrivilege	3480	ee444f87cd33352f2bb9b9bc1a15ff2142613b78553343027f39d5c44128fee3.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3480 wrote to memory of 3456	3480	ee444f87cd33352f2bb9b9bc1a15ff2142613b78553343027f39d5c44128fee3.exe	66
PID 3480 wrote to memory of 3456	3480	ee444f87cd33352f2bb9b9bc1a15ff2142613b78553343027f39d5c44128fee3.exe	66
PID 3480 wrote to memory of 4924	3480	ee444f87cd33352f2bb9b9bc1a15ff2142613b78553343027f39d5c44128fee3.exe	67
PID 3480 wrote to memory of 4924	3480	ee444f87cd33352f2bb9b9bc1a15ff2142613b78553343027f39d5c44128fee3.exe	67
PID 3480 wrote to memory of 4940	3480	ee444f87cd33352f2bb9b9bc1a15ff2142613b78553343027f39d5c44128fee3.exe	68
PID 3480 wrote to memory of 4940	3480	ee444f87cd33352f2bb9b9bc1a15ff2142613b78553343027f39d5c44128fee3.exe	68
PID 3480 wrote to memory of 4940	3480	ee444f87cd33352f2bb9b9bc1a15ff2142613b78553343027f39d5c44128fee3.exe	68
PID 3480 wrote to memory of 4940	3480	ee444f87cd33352f2bb9b9bc1a15ff2142613b78553343027f39d5c44128fee3.exe	68
PID 3480 wrote to memory of 4940	3480	ee444f87cd33352f2bb9b9bc1a15ff2142613b78553343027f39d5c44128fee3.exe	68
PID 3480 wrote to memory of 4940	3480	ee444f87cd33352f2bb9b9bc1a15ff2142613b78553343027f39d5c44128fee3.exe	68
PID 3480 wrote to memory of 4940	3480	ee444f87cd33352f2bb9b9bc1a15ff2142613b78553343027f39d5c44128fee3.exe	68
PID 3480 wrote to memory of 4940	3480	ee444f87cd33352f2bb9b9bc1a15ff2142613b78553343027f39d5c44128fee3.exe	68
PID 3480 wrote to memory of 4940	3480	ee444f87cd33352f2bb9b9bc1a15ff2142613b78553343027f39d5c44128fee3.exe	68
PID 3480 wrote to memory of 4940	3480	ee444f87cd33352f2bb9b9bc1a15ff2142613b78553343027f39d5c44128fee3.exe	68

C:\Users\Admin\AppData\Local\Temp\ee444f87cd33352f2bb9b9bc1a15ff2142613b78553343027f39d5c44128fee3.exe
"C:\Users\Admin\AppData\Local\Temp\ee444f87cd33352f2bb9b9bc1a15ff2142613b78553343027f39d5c44128fee3.exe"
1⤵
- Sets service image path in registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3480
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe"
  2⤵
  PID:3456
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe"
  2⤵
  PID:4924
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:4940

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3480-117-0x0000024DCECD0000-0x0000024DCECDA000-memory.dmp

Filesize
40KB

Download
memory/3480-118-0x0000024DE9860000-0x0000024DE9D86000-memory.dmp

Filesize
5.1MB

Download
memory/3480-119-0x0000024DE9320000-0x0000024DE9330000-memory.dmp

Filesize
64KB

Download
memory/3480-120-0x0000024DE9050000-0x0000024DE90C8000-memory.dmp

Filesize
480KB

Download
memory/4940-122-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4940-124-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4940-125-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4940-127-0x00000000014D0000-0x00000000014DD000-memory.dmp

Filesize
52KB

Download
memory/4940-126-0x0000000000F90000-0x0000000000F99000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing