lgoogloader | 3f73ddf43bef7f72423397a3a7d469d3bd4c3b84f7ffa7ee0fbdbed16bbe204c

Analysis

max time kernel
142s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
19-07-2023 22:14

Target

file.exe
Size

37KB
MD5

fb85b4100eef2959e1ef86fa3be686f9
SHA1

0035bb53c437d3e821c5010402ce7dca03de068b
SHA256

3f73ddf43bef7f72423397a3a7d469d3bd4c3b84f7ffa7ee0fbdbed16bbe204c
SHA512

ccb07610dc061d861fe3cde16049981d82715dd2576bfc7f405bf13976837337dd7ab2104cb741fef8d4983dd2f400bd0f2003eec24e6c2b3fa3df829a4edef1
SSDEEP

768:VlnkNhgIGhb0+kl3M2F7Tllmu24Ra2DovIieNhIPVQPamq+:YhvGhA+B2JTll92m7ov0oWJq+

Score

10^/10

Detects LgoogLoader payload 2 IoCs

resource	yara_rule
behavioral2/memory/1152-144-0x0000000002B40000-0x0000000002B4D000-memory.dmp	family_lgoogloader
behavioral2/memory/1152-145-0x0000000002B40000-0x0000000002B4D000-memory.dmp	family_lgoogloader

LgoogLoader
A downloader capable of dropping and executing other malware families.
downloader lgoogloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4512 set thread context of 1152	4512	file.exe	89

Suspicious behavior: EnumeratesProcesses 10 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4512	file.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4512 wrote to memory of 708	4512	file.exe	84
PID 4512 wrote to memory of 708	4512	file.exe	84
PID 4512 wrote to memory of 4280	4512	file.exe	85
PID 4512 wrote to memory of 4280	4512	file.exe	85
PID 4512 wrote to memory of 4668	4512	file.exe	86
PID 4512 wrote to memory of 4668	4512	file.exe	86
PID 4512 wrote to memory of 4880	4512	file.exe	87
PID 4512 wrote to memory of 4880	4512	file.exe	87
PID 4512 wrote to memory of 4044	4512	file.exe	88
PID 4512 wrote to memory of 4044	4512	file.exe	88
PID 4512 wrote to memory of 1152	4512	file.exe	89
PID 4512 wrote to memory of 1152	4512	file.exe	89
PID 4512 wrote to memory of 1152	4512	file.exe	89
PID 4512 wrote to memory of 1152	4512	file.exe	89
PID 4512 wrote to memory of 1152	4512	file.exe	89
PID 4512 wrote to memory of 1152	4512	file.exe	89
PID 4512 wrote to memory of 1152	4512	file.exe	89
PID 4512 wrote to memory of 1152	4512	file.exe	89
PID 4512 wrote to memory of 1152	4512	file.exe	89
PID 4512 wrote to memory of 1152	4512	file.exe	89
PID 4512 wrote to memory of 1152	4512	file.exe	89

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4512
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:708
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe"
  2⤵
  PID:4280
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe"
  2⤵
  PID:4668
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe"
  2⤵
  PID:4880
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe"
  2⤵
  PID:4044
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe"
  2⤵
  PID:1152

memory/1152-138-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1152-140-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1152-142-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1152-143-0x0000000002B20000-0x0000000002B29000-memory.dmp

Filesize
36KB

Download
memory/1152-144-0x0000000002B40000-0x0000000002B4D000-memory.dmp

Filesize
52KB

Download
memory/1152-145-0x0000000002B40000-0x0000000002B4D000-memory.dmp

Filesize
52KB

Download
memory/4512-133-0x00000207F1760000-0x00000207F176E000-memory.dmp

Filesize
56KB

Download
memory/4512-134-0x00000207F1BC0000-0x00000207F1BDA000-memory.dmp

Filesize
104KB

Download
memory/4512-135-0x00007FF9CBFC0000-0x00007FF9CCA81000-memory.dmp

Filesize
10.8MB

Download
memory/4512-136-0x00000207F1BB0000-0x00000207F1BC0000-memory.dmp

Filesize
64KB

Download
memory/4512-141-0x00007FF9CBFC0000-0x00007FF9CCA81000-memory.dmp

Filesize
10.8MB

Download