lgoogloader | fb5e26fb2c6209e4ec7ff82659fbdb03e68fe1adf088166cea4dc479af5ba151

Analysis

max time kernel
142s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
29-07-2023 18:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fb5e26fb2c6209e4ec7ff8265_JC.exe
Size

561KB
MD5

651230dae2c0dc316d24bcf5d999c001
SHA1

7e76383fa315e43e54e1f25ae4d72d550e208127
SHA256

fb5e26fb2c6209e4ec7ff82659fbdb03e68fe1adf088166cea4dc479af5ba151
SHA512

02c1f4bff17d72fccf04e3f21be9a5a387d43715780b985922032f3a656cc5ff233d40be9ff39449604cf47e41d33e273a4bd21b3042e1513b971339d1c11a62
SSDEEP

12288:41CCeUe/mB0Km1Tqy/y7R2upCFmg58ROh9YG2m7PHY:47eHmB0Km1Jy7RF8yRS9z2g/Y

Score

10^/10

lgoogloader downloader

Malware Config

Signatures

Detects LgoogLoader payload 2 IoCs

resource	yara_rule
behavioral2/memory/2228-143-0x0000000002B80000-0x0000000002B8D000-memory.dmp	family_lgoogloader
behavioral2/memory/2228-144-0x0000000002B80000-0x0000000002B8D000-memory.dmp	family_lgoogloader

LgoogLoader
A downloader capable of dropping and executing other malware families.
downloader lgoogloader
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3376 set thread context of 2228	3376	fb5e26fb2c6209e4ec7ff8265_JC.exe	102

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
3376	fb5e26fb2c6209e4ec7ff8265_JC.exe
3376	fb5e26fb2c6209e4ec7ff8265_JC.exe
3376	fb5e26fb2c6209e4ec7ff8265_JC.exe
3376	fb5e26fb2c6209e4ec7ff8265_JC.exe
3376	fb5e26fb2c6209e4ec7ff8265_JC.exe
3376	fb5e26fb2c6209e4ec7ff8265_JC.exe
3376	fb5e26fb2c6209e4ec7ff8265_JC.exe
3376	fb5e26fb2c6209e4ec7ff8265_JC.exe
3376	fb5e26fb2c6209e4ec7ff8265_JC.exe
3376	fb5e26fb2c6209e4ec7ff8265_JC.exe
3376	fb5e26fb2c6209e4ec7ff8265_JC.exe
3376	fb5e26fb2c6209e4ec7ff8265_JC.exe
3376	fb5e26fb2c6209e4ec7ff8265_JC.exe
3376	fb5e26fb2c6209e4ec7ff8265_JC.exe
3376	fb5e26fb2c6209e4ec7ff8265_JC.exe
3376	fb5e26fb2c6209e4ec7ff8265_JC.exe
3376	fb5e26fb2c6209e4ec7ff8265_JC.exe
3376	fb5e26fb2c6209e4ec7ff8265_JC.exe
3376	fb5e26fb2c6209e4ec7ff8265_JC.exe
3376	fb5e26fb2c6209e4ec7ff8265_JC.exe
3376	fb5e26fb2c6209e4ec7ff8265_JC.exe
3376	fb5e26fb2c6209e4ec7ff8265_JC.exe
3376	fb5e26fb2c6209e4ec7ff8265_JC.exe
3376	fb5e26fb2c6209e4ec7ff8265_JC.exe
3376	fb5e26fb2c6209e4ec7ff8265_JC.exe
3376	fb5e26fb2c6209e4ec7ff8265_JC.exe
3376	fb5e26fb2c6209e4ec7ff8265_JC.exe
3376	fb5e26fb2c6209e4ec7ff8265_JC.exe
3376	fb5e26fb2c6209e4ec7ff8265_JC.exe
3376	fb5e26fb2c6209e4ec7ff8265_JC.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3376	fb5e26fb2c6209e4ec7ff8265_JC.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 3376 wrote to memory of 2020	3376	fb5e26fb2c6209e4ec7ff8265_JC.exe	87
PID 3376 wrote to memory of 2020	3376	fb5e26fb2c6209e4ec7ff8265_JC.exe	87
PID 3376 wrote to memory of 992	3376	fb5e26fb2c6209e4ec7ff8265_JC.exe	88
PID 3376 wrote to memory of 992	3376	fb5e26fb2c6209e4ec7ff8265_JC.exe	88
PID 3376 wrote to memory of 2904	3376	fb5e26fb2c6209e4ec7ff8265_JC.exe	89
PID 3376 wrote to memory of 2904	3376	fb5e26fb2c6209e4ec7ff8265_JC.exe	89
PID 3376 wrote to memory of 2676	3376	fb5e26fb2c6209e4ec7ff8265_JC.exe	90
PID 3376 wrote to memory of 2676	3376	fb5e26fb2c6209e4ec7ff8265_JC.exe	90
PID 3376 wrote to memory of 4644	3376	fb5e26fb2c6209e4ec7ff8265_JC.exe	91
PID 3376 wrote to memory of 4644	3376	fb5e26fb2c6209e4ec7ff8265_JC.exe	91
PID 3376 wrote to memory of 1552	3376	fb5e26fb2c6209e4ec7ff8265_JC.exe	92
PID 3376 wrote to memory of 1552	3376	fb5e26fb2c6209e4ec7ff8265_JC.exe	92
PID 3376 wrote to memory of 1684	3376	fb5e26fb2c6209e4ec7ff8265_JC.exe	93
PID 3376 wrote to memory of 1684	3376	fb5e26fb2c6209e4ec7ff8265_JC.exe	93
PID 3376 wrote to memory of 4008	3376	fb5e26fb2c6209e4ec7ff8265_JC.exe	94
PID 3376 wrote to memory of 4008	3376	fb5e26fb2c6209e4ec7ff8265_JC.exe	94
PID 3376 wrote to memory of 2828	3376	fb5e26fb2c6209e4ec7ff8265_JC.exe	95
PID 3376 wrote to memory of 2828	3376	fb5e26fb2c6209e4ec7ff8265_JC.exe	95
PID 3376 wrote to memory of 1964	3376	fb5e26fb2c6209e4ec7ff8265_JC.exe	96
PID 3376 wrote to memory of 1964	3376	fb5e26fb2c6209e4ec7ff8265_JC.exe	96
PID 3376 wrote to memory of 2088	3376	fb5e26fb2c6209e4ec7ff8265_JC.exe	97
PID 3376 wrote to memory of 2088	3376	fb5e26fb2c6209e4ec7ff8265_JC.exe	97
PID 3376 wrote to memory of 3704	3376	fb5e26fb2c6209e4ec7ff8265_JC.exe	98
PID 3376 wrote to memory of 3704	3376	fb5e26fb2c6209e4ec7ff8265_JC.exe	98
PID 3376 wrote to memory of 3604	3376	fb5e26fb2c6209e4ec7ff8265_JC.exe	99
PID 3376 wrote to memory of 3604	3376	fb5e26fb2c6209e4ec7ff8265_JC.exe	99
PID 3376 wrote to memory of 3124	3376	fb5e26fb2c6209e4ec7ff8265_JC.exe	100
PID 3376 wrote to memory of 3124	3376	fb5e26fb2c6209e4ec7ff8265_JC.exe	100
PID 3376 wrote to memory of 3124	3376	fb5e26fb2c6209e4ec7ff8265_JC.exe	100
PID 3376 wrote to memory of 2868	3376	fb5e26fb2c6209e4ec7ff8265_JC.exe	101
PID 3376 wrote to memory of 2868	3376	fb5e26fb2c6209e4ec7ff8265_JC.exe	101
PID 3376 wrote to memory of 2228	3376	fb5e26fb2c6209e4ec7ff8265_JC.exe	102
PID 3376 wrote to memory of 2228	3376	fb5e26fb2c6209e4ec7ff8265_JC.exe	102
PID 3376 wrote to memory of 2228	3376	fb5e26fb2c6209e4ec7ff8265_JC.exe	102
PID 3376 wrote to memory of 2228	3376	fb5e26fb2c6209e4ec7ff8265_JC.exe	102
PID 3376 wrote to memory of 2228	3376	fb5e26fb2c6209e4ec7ff8265_JC.exe	102
PID 3376 wrote to memory of 2228	3376	fb5e26fb2c6209e4ec7ff8265_JC.exe	102
PID 3376 wrote to memory of 2228	3376	fb5e26fb2c6209e4ec7ff8265_JC.exe	102
PID 3376 wrote to memory of 2228	3376	fb5e26fb2c6209e4ec7ff8265_JC.exe	102
PID 3376 wrote to memory of 2228	3376	fb5e26fb2c6209e4ec7ff8265_JC.exe	102
PID 3376 wrote to memory of 2228	3376	fb5e26fb2c6209e4ec7ff8265_JC.exe	102
PID 3376 wrote to memory of 2228	3376	fb5e26fb2c6209e4ec7ff8265_JC.exe	102

C:\Users\Admin\AppData\Local\Temp\fb5e26fb2c6209e4ec7ff8265_JC.exe
"C:\Users\Admin\AppData\Local\Temp\fb5e26fb2c6209e4ec7ff8265_JC.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3376
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe"
  2⤵
  PID:2020
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:992
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"
  2⤵
  PID:2904
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe"
  2⤵
  PID:2676
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  PID:4644
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe"
  2⤵
  PID:1552
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe"
  2⤵
  PID:1684
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe"
  2⤵
  PID:4008
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe"
  2⤵
  PID:2828
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe"
  2⤵
  PID:1964
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe"
  2⤵
  PID:2088
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe"
  2⤵
  PID:3704
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe"
  2⤵
  PID:3604
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe"
  2⤵
  PID:3124
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:2868
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:2228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2228-137-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2228-139-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2228-141-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2228-142-0x0000000000E60000-0x0000000000E69000-memory.dmp

Filesize
36KB

Download
memory/2228-143-0x0000000002B80000-0x0000000002B8D000-memory.dmp

Filesize
52KB

Download
memory/2228-144-0x0000000002B80000-0x0000000002B8D000-memory.dmp

Filesize
52KB

Download
memory/3376-133-0x0000026EFCCD0000-0x0000026EFCD60000-memory.dmp

Filesize
576KB

Download
memory/3376-134-0x0000026EFF2D0000-0x0000026EFF2EA000-memory.dmp

Filesize
104KB

Download
memory/3376-136-0x0000026EFEA50000-0x0000026EFEA60000-memory.dmp

Filesize
64KB

Download
memory/3376-135-0x00007FFDA7FC0000-0x00007FFDA8A81000-memory.dmp

Filesize
10.8MB

Download
memory/3376-140-0x00007FFDA7FC0000-0x00007FFDA8A81000-memory.dmp

Filesize
10.8MB

Download