lgoogloader | 3f73ddf43bef7f72423397a3a7d469d3bd4c3b84f7ffa7ee0fbdbed16bbe204c

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
19-07-2023 22:14

Target

file.exe
Size

37KB
MD5

fb85b4100eef2959e1ef86fa3be686f9
SHA1

0035bb53c437d3e821c5010402ce7dca03de068b
SHA256

3f73ddf43bef7f72423397a3a7d469d3bd4c3b84f7ffa7ee0fbdbed16bbe204c
SHA512

ccb07610dc061d861fe3cde16049981d82715dd2576bfc7f405bf13976837337dd7ab2104cb741fef8d4983dd2f400bd0f2003eec24e6c2b3fa3df829a4edef1
SSDEEP

768:VlnkNhgIGhb0+kl3M2F7Tllmu24Ra2DovIieNhIPVQPamq+:YhvGhA+B2JTll92m7ov0oWJq+

Score

10^/10

Detects LgoogLoader payload 1 IoCs

resource	yara_rule
behavioral1/memory/2912-66-0x0000000000110000-0x000000000011D000-memory.dmp	family_lgoogloader

LgoogLoader
A downloader capable of dropping and executing other malware families.
downloader lgoogloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1688 set thread context of 2912	1688	file.exe	33

Suspicious behavior: EnumeratesProcesses 10 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1688	file.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 2824	1688	file.exe	28
PID 1688 wrote to memory of 2824	1688	file.exe	28
PID 1688 wrote to memory of 2824	1688	file.exe	28
PID 1688 wrote to memory of 2844	1688	file.exe	29
PID 1688 wrote to memory of 2844	1688	file.exe	29
PID 1688 wrote to memory of 2844	1688	file.exe	29
PID 1688 wrote to memory of 2316	1688	file.exe	30
PID 1688 wrote to memory of 2316	1688	file.exe	30
PID 1688 wrote to memory of 2316	1688	file.exe	30
PID 1688 wrote to memory of 2988	1688	file.exe	31
PID 1688 wrote to memory of 2988	1688	file.exe	31
PID 1688 wrote to memory of 2988	1688	file.exe	31
PID 1688 wrote to memory of 2852	1688	file.exe	32
PID 1688 wrote to memory of 2852	1688	file.exe	32
PID 1688 wrote to memory of 2852	1688	file.exe	32
PID 1688 wrote to memory of 2912	1688	file.exe	33
PID 1688 wrote to memory of 2912	1688	file.exe	33
PID 1688 wrote to memory of 2912	1688	file.exe	33
PID 1688 wrote to memory of 2912	1688	file.exe	33
PID 1688 wrote to memory of 2912	1688	file.exe	33
PID 1688 wrote to memory of 2912	1688	file.exe	33
PID 1688 wrote to memory of 2912	1688	file.exe	33
PID 1688 wrote to memory of 2912	1688	file.exe	33
PID 1688 wrote to memory of 2912	1688	file.exe	33
PID 1688 wrote to memory of 2912	1688	file.exe	33
PID 1688 wrote to memory of 2912	1688	file.exe	33
PID 1688 wrote to memory of 2912	1688	file.exe	33

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe"
  2⤵
  PID:2824
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"
  2⤵
  PID:2844
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:2316
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regtlibv12.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regtlibv12.exe"
  2⤵
  PID:2988
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe"
  2⤵
  PID:2852
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:2912

memory/1688-54-0x00000000012A0000-0x00000000012AE000-memory.dmp

Filesize
56KB

Download
memory/1688-55-0x000007FEF5A00000-0x000007FEF63EC000-memory.dmp

Filesize
9.9MB

Download
memory/1688-56-0x000000001AB20000-0x000000001ABA0000-memory.dmp

Filesize
512KB

Download
memory/1688-57-0x0000000000550000-0x0000000000558000-memory.dmp

Filesize
32KB

Download
memory/1688-58-0x0000000000580000-0x000000000059A000-memory.dmp

Filesize
104KB

Download
memory/1688-59-0x000000001AA80000-0x000000001AB08000-memory.dmp

Filesize
544KB

Download
memory/1688-65-0x000007FEF5A00000-0x000007FEF63EC000-memory.dmp

Filesize
9.9MB

Download
memory/2912-61-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2912-63-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2912-64-0x00000000000F0000-0x00000000000F9000-memory.dmp

Filesize
36KB

Download
memory/2912-66-0x0000000000110000-0x000000000011D000-memory.dmp

Filesize
52KB

Download
memory/2912-67-0x0000000000110000-0x000000000011D000-memory.dmp

Filesize
52KB

Download