lgoogloader | eef5dadd86d75161ef22dabd6fa41cdfffaaa5dad743b2aea23762ff364fa0c6

Analysis

max time kernel
141s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
11-07-2023 20:54

Target

file.exe
Size

168KB
MD5

69479c1cca7d8e7c58a1d4b6d7c02e2a
SHA1

b4618f496a727c6c4f7496c8cf386cf24561e0c3
SHA256

eef5dadd86d75161ef22dabd6fa41cdfffaaa5dad743b2aea23762ff364fa0c6
SHA512

a0a929cd5a244362fe916f7557262785eaa0c981ed444df00e839a2b95dd121b5d5531bc5163f0d57672a74214a9588e2d382577092281ae18bda0324f24a3d0
SSDEEP

3072:D7kFWnfXvzRRzWrWXSuhO4AkxioseOrkbL+RPT9LD9VSuh4vefil19G:D7CkpO01waCdfUuh4veZ

Score

10^/10

Detects LgoogLoader payload 1 IoCs

resource	yara_rule
behavioral2/memory/1036-139-0x0000000002D30000-0x0000000002D3D000-memory.dmp	family_lgoogloader

LgoogLoader
A downloader capable of dropping and executing other malware families.
downloader lgoogloader

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{6180CCF7-1C1B-4FB2-84E5-64FCB5E0A927}.catalogItem	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3792 set thread context of 1036	3792	file.exe	83

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3792	file.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3792 wrote to memory of 1036	3792	file.exe	83
PID 3792 wrote to memory of 1036	3792	file.exe	83
PID 3792 wrote to memory of 1036	3792	file.exe	83
PID 3792 wrote to memory of 1036	3792	file.exe	83
PID 3792 wrote to memory of 1036	3792	file.exe	83
PID 3792 wrote to memory of 1036	3792	file.exe	83
PID 3792 wrote to memory of 1036	3792	file.exe	83
PID 3792 wrote to memory of 1036	3792	file.exe	83
PID 3792 wrote to memory of 1036	3792	file.exe	83
PID 3792 wrote to memory of 1036	3792	file.exe	83
PID 3792 wrote to memory of 1036	3792	file.exe	83

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3792
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
  2⤵
  PID:1036

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
PID:1980

memory/1036-135-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1036-136-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1036-137-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1036-138-0x0000000001170000-0x0000000001179000-memory.dmp

Filesize
36KB

Download
memory/1036-139-0x0000000002D30000-0x0000000002D3D000-memory.dmp

Filesize
52KB

Download
memory/3792-133-0x000001D96E1F0000-0x000001D96E21E000-memory.dmp

Filesize
184KB

Download
memory/3792-134-0x000001D970710000-0x000001D970720000-memory.dmp

Filesize
64KB

Download
memory/3792-140-0x000001D970710000-0x000001D970720000-memory.dmp

Filesize
64KB

Download