lgoogloader | eef5dadd86d75161ef22dabd6fa41cdfffaaa5dad743b2aea23762ff364fa0c6

Analysis

max time kernel
31s
max time network
112s
platform
windows7_x64
resource
win7-20230705-en
resource tags

arch:x64arch:x86image:win7-20230705-enlocale:en-usos:windows7-x64system
submitted
11-07-2023 20:56

Target

file.exe
Size

168KB
MD5

69479c1cca7d8e7c58a1d4b6d7c02e2a
SHA1

b4618f496a727c6c4f7496c8cf386cf24561e0c3
SHA256

eef5dadd86d75161ef22dabd6fa41cdfffaaa5dad743b2aea23762ff364fa0c6
SHA512

a0a929cd5a244362fe916f7557262785eaa0c981ed444df00e839a2b95dd121b5d5531bc5163f0d57672a74214a9588e2d382577092281ae18bda0324f24a3d0
SSDEEP

3072:D7kFWnfXvzRRzWrWXSuhO4AkxioseOrkbL+RPT9LD9VSuh4vefil19G:D7CkpO01waCdfUuh4veZ

Score

10^/10

Detects LgoogLoader payload 1 IoCs

resource	yara_rule
behavioral1/memory/2060-61-0x0000000000110000-0x000000000011D000-memory.dmp	family_lgoogloader

LgoogLoader
A downloader capable of dropping and executing other malware families.
downloader lgoogloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2272 set thread context of 2060	2272	file.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2272	file.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 2060	2272	file.exe	27
PID 2272 wrote to memory of 2060	2272	file.exe	27
PID 2272 wrote to memory of 2060	2272	file.exe	27
PID 2272 wrote to memory of 2060	2272	file.exe	27
PID 2272 wrote to memory of 2060	2272	file.exe	27
PID 2272 wrote to memory of 2060	2272	file.exe	27
PID 2272 wrote to memory of 2060	2272	file.exe	27
PID 2272 wrote to memory of 2060	2272	file.exe	27
PID 2272 wrote to memory of 2060	2272	file.exe	27
PID 2272 wrote to memory of 2060	2272	file.exe	27
PID 2272 wrote to memory of 2060	2272	file.exe	27
PID 2272 wrote to memory of 2060	2272	file.exe	27

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
  2⤵
  PID:2060

memory/2060-57-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2060-59-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2060-60-0x00000000000F0000-0x00000000000F9000-memory.dmp

Filesize
36KB

Download
memory/2060-61-0x0000000000110000-0x000000000011D000-memory.dmp

Filesize
52KB

Download
memory/2272-54-0x0000000000C60000-0x0000000000C8E000-memory.dmp

Filesize
184KB

Download
memory/2272-55-0x000000001AFD0000-0x000000001B050000-memory.dmp

Filesize
512KB

Download
memory/2272-56-0x000000001B2A0000-0x000000001B328000-memory.dmp

Filesize
544KB

Download
memory/2272-62-0x000000001AFD0000-0x000000001B050000-memory.dmp

Filesize
512KB

Download