lgoogloader | e8483e9918697dc2fd3b4fc0fde38795851312dd38c1a6c83acdcaba47f8de7b

Analysis

max time kernel
93s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
12-06-2023 11:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

01702199.exe
Size

403KB
MD5

194e670dffccd5785da26231d032e808
SHA1

0a6ce468233b96041edc69330a0efa4b90194b4f
SHA256

e8483e9918697dc2fd3b4fc0fde38795851312dd38c1a6c83acdcaba47f8de7b
SHA512

935183ef75fd7acf057773d96b9e41ea419a2705afa21193b13b763655d8659db5be141aad210e0afa241036b0d0610444de40b68168ccf711059be14ad8c890
SSDEEP

3072:eZSUo1eprSwrXx0ooARRMkAHFIxobrvZkJv6SjaFvVmuLyRpPS68urGh3Lzs/vqq:enpNmooARiXCFT2Fp6SQaofZAC

Score

10^/10

lgoogloader downloader persistence

Malware Config

Signatures

Detects LgoogLoader payload 1 IoCs

resource	yara_rule
behavioral2/memory/208-142-0x00000000015C0000-0x00000000015CD000-memory.dmp	family_lgoogloader

LgoogLoader
A downloader capable of dropping and executing other malware families.
downloader lgoogloader

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\TaskKill\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\Иисус.sys"	01702199.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4184 set thread context of 208	4184	01702199.exe	101

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
4184	01702199.exe
4184	01702199.exe
4184	01702199.exe
4184	01702199.exe
4184	01702199.exe
4184	01702199.exe
4184	01702199.exe
4184	01702199.exe
4184	01702199.exe
4184	01702199.exe
4184	01702199.exe
4184	01702199.exe
4184	01702199.exe
4184	01702199.exe
4184	01702199.exe
4184	01702199.exe
4184	01702199.exe
4184	01702199.exe
4184	01702199.exe
4184	01702199.exe
4184	01702199.exe
4184	01702199.exe
4184	01702199.exe
4184	01702199.exe
4184	01702199.exe
4184	01702199.exe
4184	01702199.exe
4184	01702199.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
4184	01702199.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4184	01702199.exe
Token: SeDebugPrivilege	4184	01702199.exe
Token: SeLoadDriverPrivilege	4184	01702199.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 4184 wrote to memory of 2448	4184	01702199.exe	87
PID 4184 wrote to memory of 2448	4184	01702199.exe	87
PID 4184 wrote to memory of 1552	4184	01702199.exe	88
PID 4184 wrote to memory of 1552	4184	01702199.exe	88
PID 4184 wrote to memory of 1776	4184	01702199.exe	89
PID 4184 wrote to memory of 1776	4184	01702199.exe	89
PID 4184 wrote to memory of 3392	4184	01702199.exe	90
PID 4184 wrote to memory of 3392	4184	01702199.exe	90
PID 4184 wrote to memory of 1944	4184	01702199.exe	91
PID 4184 wrote to memory of 1944	4184	01702199.exe	91
PID 4184 wrote to memory of 3960	4184	01702199.exe	92
PID 4184 wrote to memory of 3960	4184	01702199.exe	92
PID 4184 wrote to memory of 540	4184	01702199.exe	93
PID 4184 wrote to memory of 540	4184	01702199.exe	93
PID 4184 wrote to memory of 4984	4184	01702199.exe	94
PID 4184 wrote to memory of 4984	4184	01702199.exe	94
PID 4184 wrote to memory of 3992	4184	01702199.exe	95
PID 4184 wrote to memory of 3992	4184	01702199.exe	95
PID 4184 wrote to memory of 3604	4184	01702199.exe	96
PID 4184 wrote to memory of 3604	4184	01702199.exe	96
PID 4184 wrote to memory of 3164	4184	01702199.exe	97
PID 4184 wrote to memory of 3164	4184	01702199.exe	97
PID 4184 wrote to memory of 2676	4184	01702199.exe	98
PID 4184 wrote to memory of 2676	4184	01702199.exe	98
PID 4184 wrote to memory of 320	4184	01702199.exe	99
PID 4184 wrote to memory of 320	4184	01702199.exe	99
PID 4184 wrote to memory of 224	4184	01702199.exe	100
PID 4184 wrote to memory of 224	4184	01702199.exe	100
PID 4184 wrote to memory of 208	4184	01702199.exe	101
PID 4184 wrote to memory of 208	4184	01702199.exe	101
PID 4184 wrote to memory of 208	4184	01702199.exe	101
PID 4184 wrote to memory of 208	4184	01702199.exe	101
PID 4184 wrote to memory of 208	4184	01702199.exe	101
PID 4184 wrote to memory of 208	4184	01702199.exe	101
PID 4184 wrote to memory of 208	4184	01702199.exe	101
PID 4184 wrote to memory of 208	4184	01702199.exe	101
PID 4184 wrote to memory of 208	4184	01702199.exe	101
PID 4184 wrote to memory of 208	4184	01702199.exe	101

C:\Users\Admin\AppData\Local\Temp\01702199.exe
"C:\Users\Admin\AppData\Local\Temp\01702199.exe"
1⤵
- Sets service image path in registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4184
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"
  2⤵
  PID:2448
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe"
  2⤵
  PID:1552
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe"
  2⤵
  PID:1776
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe"
  2⤵
  PID:3392
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe"
  2⤵
  PID:1944
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe"
  2⤵
  PID:3960
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe"
  2⤵
  PID:540
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe"
  2⤵
  PID:4984
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe"
  2⤵
  PID:3992
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe"
  2⤵
  PID:3604
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3164
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe"
  2⤵
  PID:2676
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe"
  2⤵
  PID:320
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe"
  2⤵
  PID:224
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe"
  2⤵
  PID:208

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

T1064

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/208-137-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/208-139-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/208-140-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/208-141-0x00000000015A0000-0x00000000015A9000-memory.dmp

Filesize
36KB

Download
memory/208-142-0x00000000015C0000-0x00000000015CD000-memory.dmp

Filesize
52KB

Download
memory/4184-133-0x000001BA498B0000-0x000001BA4991A000-memory.dmp

Filesize
424KB

Download
memory/4184-134-0x000001BA644A0000-0x000001BA649C8000-memory.dmp

Filesize
5.2MB

Download
memory/4184-135-0x000001BA63F60000-0x000001BA63F70000-memory.dmp

Filesize
64KB

Download