lgoogloader | a5476eed216a55fa35d1a0ed0b4be51ce8c376e12a44a8f74f1ee9b1e0a1e685 | Triage

Analysis

max time kernel
137s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
29-06-2023 14:46

Sharing

Report Analysis Logs

General

Target

AAAd1.exe
Size

196KB
MD5

94f7dacd5b046eba244fceebe7b9a1dd
SHA1

02db8d219f8b97fc25d812e9c0012e6ffb3e71e1
SHA256

a5476eed216a55fa35d1a0ed0b4be51ce8c376e12a44a8f74f1ee9b1e0a1e685
SHA512

0364a6f74fb7e1632d540c30478f8e5f60c014de2a7282ec128fe5c00deb93d6d054a4519c089292aa72b0fe90b89579b6236a26223586a795beff0a0252594b
SSDEEP

3072:uaY0LwJqqkCPyIrxC55W86GOsKc9P5bivyKKT9cWCeGW801Io:u7VvxJGFrP5+vUOEf1Io

Score

10^/10

lgoogloader downloader

Malware Config

Signatures

Detects LgoogLoader payload 1 IoCs

resource	yara_rule
behavioral2/memory/1452-134-0x0000000000A20000-0x0000000000A2D000-memory.dmp	family_lgoogloader

LgoogLoader
A downloader capable of dropping and executing other malware families.
downloader lgoogloader

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{F522F204-1629-42CF-A7CC-4063B1C6058F}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{8594FEC4-EE18-4825-9000-84437AA62A6E}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{5851F1FE-E6A5-4F23-9FE6-8ABF1278C98A}.catalogItem	svchost.exe

C:\Users\Admin\AppData\Local\Temp\AAAd1.exe
"C:\Users\Admin\AppData\Local\Temp\AAAd1.exe"
1⤵
PID:1452

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
PID:3720

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1452-133-0x00000000006F0000-0x00000000006F9000-memory.dmp

Filesize
36KB

Download
memory/1452-134-0x0000000000A20000-0x0000000000A2D000-memory.dmp

Filesize
52KB

Download