lgoogloader | ae5bf7d05d5714bf2758fd5c127f405de0c02223643a22279bcbf03fb648cd2d

Analysis

max time kernel
99s
max time network
107s
platform
windows10-1703_x64
resource
win10-20230703-en
resource tags

arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
submitted
23-07-2023 00:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ae5bf7d05d5714bf2758fd5c127f405de0c02223643a22279bcbf03fb648cd2d.exe
Size

539KB
MD5

79b79167999cd38863c16ba5de372081
SHA1

b3d276a972f6ed0805fe339624e68b2845d3154c
SHA256

ae5bf7d05d5714bf2758fd5c127f405de0c02223643a22279bcbf03fb648cd2d
SHA512

218275c9d88cad809c88cf36fdf750dd68e3ca7c5b6005c722be0874028ccd38728ef6ac15a4c9beef6827d2351c50ff9aa7ffe00cf6435f33b5f598ffd5ff11
SSDEEP

12288:4IgQ0KaWFEEHXSz/yUToiGBYn4sBcL005M14p0UgQkDbm7PH/:4IgLK1FqnToiUYn4s0Sg0UsDbg//

Score

10^/10

lgoogloader downloader

Malware Config

Signatures

Detects LgoogLoader payload 1 IoCs

resource	yara_rule
behavioral1/memory/3316-129-0x0000000001800000-0x000000000180D000-memory.dmp	family_lgoogloader

LgoogLoader
A downloader capable of dropping and executing other malware families.
downloader lgoogloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1232 set thread context of 3316	1232	ae5bf7d05d5714bf2758fd5c127f405de0c02223643a22279bcbf03fb648cd2d.exe	79

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
1232	ae5bf7d05d5714bf2758fd5c127f405de0c02223643a22279bcbf03fb648cd2d.exe
1232	ae5bf7d05d5714bf2758fd5c127f405de0c02223643a22279bcbf03fb648cd2d.exe
1232	ae5bf7d05d5714bf2758fd5c127f405de0c02223643a22279bcbf03fb648cd2d.exe
1232	ae5bf7d05d5714bf2758fd5c127f405de0c02223643a22279bcbf03fb648cd2d.exe
1232	ae5bf7d05d5714bf2758fd5c127f405de0c02223643a22279bcbf03fb648cd2d.exe
1232	ae5bf7d05d5714bf2758fd5c127f405de0c02223643a22279bcbf03fb648cd2d.exe
1232	ae5bf7d05d5714bf2758fd5c127f405de0c02223643a22279bcbf03fb648cd2d.exe
1232	ae5bf7d05d5714bf2758fd5c127f405de0c02223643a22279bcbf03fb648cd2d.exe
1232	ae5bf7d05d5714bf2758fd5c127f405de0c02223643a22279bcbf03fb648cd2d.exe
1232	ae5bf7d05d5714bf2758fd5c127f405de0c02223643a22279bcbf03fb648cd2d.exe
1232	ae5bf7d05d5714bf2758fd5c127f405de0c02223643a22279bcbf03fb648cd2d.exe
1232	ae5bf7d05d5714bf2758fd5c127f405de0c02223643a22279bcbf03fb648cd2d.exe
1232	ae5bf7d05d5714bf2758fd5c127f405de0c02223643a22279bcbf03fb648cd2d.exe
1232	ae5bf7d05d5714bf2758fd5c127f405de0c02223643a22279bcbf03fb648cd2d.exe
1232	ae5bf7d05d5714bf2758fd5c127f405de0c02223643a22279bcbf03fb648cd2d.exe
1232	ae5bf7d05d5714bf2758fd5c127f405de0c02223643a22279bcbf03fb648cd2d.exe
1232	ae5bf7d05d5714bf2758fd5c127f405de0c02223643a22279bcbf03fb648cd2d.exe
1232	ae5bf7d05d5714bf2758fd5c127f405de0c02223643a22279bcbf03fb648cd2d.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1232	ae5bf7d05d5714bf2758fd5c127f405de0c02223643a22279bcbf03fb648cd2d.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1232 wrote to memory of 4384	1232	ae5bf7d05d5714bf2758fd5c127f405de0c02223643a22279bcbf03fb648cd2d.exe	70
PID 1232 wrote to memory of 4384	1232	ae5bf7d05d5714bf2758fd5c127f405de0c02223643a22279bcbf03fb648cd2d.exe	70
PID 1232 wrote to memory of 4100	1232	ae5bf7d05d5714bf2758fd5c127f405de0c02223643a22279bcbf03fb648cd2d.exe	71
PID 1232 wrote to memory of 4100	1232	ae5bf7d05d5714bf2758fd5c127f405de0c02223643a22279bcbf03fb648cd2d.exe	71
PID 1232 wrote to memory of 2768	1232	ae5bf7d05d5714bf2758fd5c127f405de0c02223643a22279bcbf03fb648cd2d.exe	72
PID 1232 wrote to memory of 2768	1232	ae5bf7d05d5714bf2758fd5c127f405de0c02223643a22279bcbf03fb648cd2d.exe	72
PID 1232 wrote to memory of 3936	1232	ae5bf7d05d5714bf2758fd5c127f405de0c02223643a22279bcbf03fb648cd2d.exe	73
PID 1232 wrote to memory of 3936	1232	ae5bf7d05d5714bf2758fd5c127f405de0c02223643a22279bcbf03fb648cd2d.exe	73
PID 1232 wrote to memory of 2908	1232	ae5bf7d05d5714bf2758fd5c127f405de0c02223643a22279bcbf03fb648cd2d.exe	74
PID 1232 wrote to memory of 2908	1232	ae5bf7d05d5714bf2758fd5c127f405de0c02223643a22279bcbf03fb648cd2d.exe	74
PID 1232 wrote to memory of 3900	1232	ae5bf7d05d5714bf2758fd5c127f405de0c02223643a22279bcbf03fb648cd2d.exe	75
PID 1232 wrote to memory of 3900	1232	ae5bf7d05d5714bf2758fd5c127f405de0c02223643a22279bcbf03fb648cd2d.exe	75
PID 1232 wrote to memory of 3768	1232	ae5bf7d05d5714bf2758fd5c127f405de0c02223643a22279bcbf03fb648cd2d.exe	76
PID 1232 wrote to memory of 3768	1232	ae5bf7d05d5714bf2758fd5c127f405de0c02223643a22279bcbf03fb648cd2d.exe	76
PID 1232 wrote to memory of 4472	1232	ae5bf7d05d5714bf2758fd5c127f405de0c02223643a22279bcbf03fb648cd2d.exe	77
PID 1232 wrote to memory of 4472	1232	ae5bf7d05d5714bf2758fd5c127f405de0c02223643a22279bcbf03fb648cd2d.exe	77
PID 1232 wrote to memory of 1328	1232	ae5bf7d05d5714bf2758fd5c127f405de0c02223643a22279bcbf03fb648cd2d.exe	78
PID 1232 wrote to memory of 1328	1232	ae5bf7d05d5714bf2758fd5c127f405de0c02223643a22279bcbf03fb648cd2d.exe	78
PID 1232 wrote to memory of 3316	1232	ae5bf7d05d5714bf2758fd5c127f405de0c02223643a22279bcbf03fb648cd2d.exe	79
PID 1232 wrote to memory of 3316	1232	ae5bf7d05d5714bf2758fd5c127f405de0c02223643a22279bcbf03fb648cd2d.exe	79
PID 1232 wrote to memory of 3316	1232	ae5bf7d05d5714bf2758fd5c127f405de0c02223643a22279bcbf03fb648cd2d.exe	79
PID 1232 wrote to memory of 3316	1232	ae5bf7d05d5714bf2758fd5c127f405de0c02223643a22279bcbf03fb648cd2d.exe	79
PID 1232 wrote to memory of 3316	1232	ae5bf7d05d5714bf2758fd5c127f405de0c02223643a22279bcbf03fb648cd2d.exe	79
PID 1232 wrote to memory of 3316	1232	ae5bf7d05d5714bf2758fd5c127f405de0c02223643a22279bcbf03fb648cd2d.exe	79
PID 1232 wrote to memory of 3316	1232	ae5bf7d05d5714bf2758fd5c127f405de0c02223643a22279bcbf03fb648cd2d.exe	79
PID 1232 wrote to memory of 3316	1232	ae5bf7d05d5714bf2758fd5c127f405de0c02223643a22279bcbf03fb648cd2d.exe	79
PID 1232 wrote to memory of 3316	1232	ae5bf7d05d5714bf2758fd5c127f405de0c02223643a22279bcbf03fb648cd2d.exe	79
PID 1232 wrote to memory of 3316	1232	ae5bf7d05d5714bf2758fd5c127f405de0c02223643a22279bcbf03fb648cd2d.exe	79

C:\Users\Admin\AppData\Local\Temp\ae5bf7d05d5714bf2758fd5c127f405de0c02223643a22279bcbf03fb648cd2d.exe
"C:\Users\Admin\AppData\Local\Temp\ae5bf7d05d5714bf2758fd5c127f405de0c02223643a22279bcbf03fb648cd2d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1232
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe"
  2⤵
  PID:4384
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe"
  2⤵
  PID:4100
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"
  2⤵
  PID:2768
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe"
  2⤵
  PID:3936
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe"
  2⤵
  PID:2908
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe"
  2⤵
  PID:3900
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe"
  2⤵
  PID:3768
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe"
  2⤵
  PID:4472
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"
  2⤵
  PID:1328
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe"
  2⤵
  PID:3316

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1232-127-0x00007FFB10C40000-0x00007FFB1162C000-memory.dmp

Filesize
9.9MB

Download
memory/1232-118-0x00007FFB10C40000-0x00007FFB1162C000-memory.dmp

Filesize
9.9MB

Download
memory/1232-120-0x000001AFAE8B0000-0x000001AFAE8CA000-memory.dmp

Filesize
104KB

Download
memory/1232-119-0x000001AFACF20000-0x000001AFACF28000-memory.dmp

Filesize
32KB

Download
memory/1232-122-0x000001AFC7140000-0x000001AFC71C2000-memory.dmp

Filesize
520KB

Download
memory/1232-121-0x000001AFAE8E0000-0x000001AFAE8F0000-memory.dmp

Filesize
64KB

Download
memory/1232-117-0x000001AFACAF0000-0x000001AFACB7A000-memory.dmp

Filesize
552KB

Download
memory/3316-123-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3316-126-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3316-128-0x00000000017E0000-0x00000000017E9000-memory.dmp

Filesize
36KB

Download
memory/3316-125-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3316-129-0x0000000001800000-0x000000000180D000-memory.dmp

Filesize
52KB

Download
memory/3316-130-0x0000000001800000-0x000000000180D000-memory.dmp

Filesize
52KB

Download