lgoogloader | d391ab8cbe5abb12553d2fbbfe2b6b6e7ed324ccb965a7982a5f1a1a2e8db6d2

Analysis

max time kernel
143s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230831-en
resource tags

arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
submitted
03-09-2023 07:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

254b59f42e31662e8f96e920f41fce17.exe
Size

562KB
MD5

254b59f42e31662e8f96e920f41fce17
SHA1

6fc8dad426bacbe61e3c45525b99b5e9d131abfa
SHA256

d391ab8cbe5abb12553d2fbbfe2b6b6e7ed324ccb965a7982a5f1a1a2e8db6d2
SHA512

65350c7fc7a810fdb418c13f621cb0a0d20a012337ef9269a6292de8bde364277a8a56873f9cb7deda94cbe21736ac79044344c80570594c10949ea7b8870f5a
SSDEEP

12288:U7/Rv/yjqjEZjb0uYZRU04qm77kteMJR4GHdVlksHgwixnYTm7PHh:gXSk4faZRJ277PMJ+GHHlVynYTg/h

Score

10^/10

lgoogloader downloader

Malware Config

Signatures

Detects LgoogLoader payload 2 IoCs

resource	yara_rule
behavioral2/memory/3016-10-0x0000000002AA0000-0x0000000002AAD000-memory.dmp	family_lgoogloader
behavioral2/memory/3016-11-0x0000000002AA0000-0x0000000002AAD000-memory.dmp	family_lgoogloader

LgoogLoader
A downloader capable of dropping and executing other malware families.
downloader lgoogloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4736 set thread context of 3016	4736	254b59f42e31662e8f96e920f41fce17.exe	109

Suspicious behavior: EnumeratesProcesses 44 IoCs

pid	Process
4736	254b59f42e31662e8f96e920f41fce17.exe
4736	254b59f42e31662e8f96e920f41fce17.exe
4736	254b59f42e31662e8f96e920f41fce17.exe
4736	254b59f42e31662e8f96e920f41fce17.exe
4736	254b59f42e31662e8f96e920f41fce17.exe
4736	254b59f42e31662e8f96e920f41fce17.exe
4736	254b59f42e31662e8f96e920f41fce17.exe
4736	254b59f42e31662e8f96e920f41fce17.exe
4736	254b59f42e31662e8f96e920f41fce17.exe
4736	254b59f42e31662e8f96e920f41fce17.exe
4736	254b59f42e31662e8f96e920f41fce17.exe
4736	254b59f42e31662e8f96e920f41fce17.exe
4736	254b59f42e31662e8f96e920f41fce17.exe
4736	254b59f42e31662e8f96e920f41fce17.exe
4736	254b59f42e31662e8f96e920f41fce17.exe
4736	254b59f42e31662e8f96e920f41fce17.exe
4736	254b59f42e31662e8f96e920f41fce17.exe
4736	254b59f42e31662e8f96e920f41fce17.exe
4736	254b59f42e31662e8f96e920f41fce17.exe
4736	254b59f42e31662e8f96e920f41fce17.exe
4736	254b59f42e31662e8f96e920f41fce17.exe
4736	254b59f42e31662e8f96e920f41fce17.exe
4736	254b59f42e31662e8f96e920f41fce17.exe
4736	254b59f42e31662e8f96e920f41fce17.exe
4736	254b59f42e31662e8f96e920f41fce17.exe
4736	254b59f42e31662e8f96e920f41fce17.exe
4736	254b59f42e31662e8f96e920f41fce17.exe
4736	254b59f42e31662e8f96e920f41fce17.exe
4736	254b59f42e31662e8f96e920f41fce17.exe
4736	254b59f42e31662e8f96e920f41fce17.exe
4736	254b59f42e31662e8f96e920f41fce17.exe
4736	254b59f42e31662e8f96e920f41fce17.exe
4736	254b59f42e31662e8f96e920f41fce17.exe
4736	254b59f42e31662e8f96e920f41fce17.exe
4736	254b59f42e31662e8f96e920f41fce17.exe
4736	254b59f42e31662e8f96e920f41fce17.exe
4736	254b59f42e31662e8f96e920f41fce17.exe
4736	254b59f42e31662e8f96e920f41fce17.exe
4736	254b59f42e31662e8f96e920f41fce17.exe
4736	254b59f42e31662e8f96e920f41fce17.exe
4736	254b59f42e31662e8f96e920f41fce17.exe
4736	254b59f42e31662e8f96e920f41fce17.exe
4736	254b59f42e31662e8f96e920f41fce17.exe
4736	254b59f42e31662e8f96e920f41fce17.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4736	254b59f42e31662e8f96e920f41fce17.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 4736 wrote to memory of 4852	4736	254b59f42e31662e8f96e920f41fce17.exe	87
PID 4736 wrote to memory of 4852	4736	254b59f42e31662e8f96e920f41fce17.exe	87
PID 4736 wrote to memory of 636	4736	254b59f42e31662e8f96e920f41fce17.exe	88
PID 4736 wrote to memory of 636	4736	254b59f42e31662e8f96e920f41fce17.exe	88
PID 4736 wrote to memory of 3636	4736	254b59f42e31662e8f96e920f41fce17.exe	89
PID 4736 wrote to memory of 3636	4736	254b59f42e31662e8f96e920f41fce17.exe	89
PID 4736 wrote to memory of 548	4736	254b59f42e31662e8f96e920f41fce17.exe	90
PID 4736 wrote to memory of 548	4736	254b59f42e31662e8f96e920f41fce17.exe	90
PID 4736 wrote to memory of 3244	4736	254b59f42e31662e8f96e920f41fce17.exe	91
PID 4736 wrote to memory of 3244	4736	254b59f42e31662e8f96e920f41fce17.exe	91
PID 4736 wrote to memory of 1448	4736	254b59f42e31662e8f96e920f41fce17.exe	92
PID 4736 wrote to memory of 1448	4736	254b59f42e31662e8f96e920f41fce17.exe	92
PID 4736 wrote to memory of 1212	4736	254b59f42e31662e8f96e920f41fce17.exe	93
PID 4736 wrote to memory of 1212	4736	254b59f42e31662e8f96e920f41fce17.exe	93
PID 4736 wrote to memory of 3708	4736	254b59f42e31662e8f96e920f41fce17.exe	94
PID 4736 wrote to memory of 3708	4736	254b59f42e31662e8f96e920f41fce17.exe	94
PID 4736 wrote to memory of 4740	4736	254b59f42e31662e8f96e920f41fce17.exe	95
PID 4736 wrote to memory of 4740	4736	254b59f42e31662e8f96e920f41fce17.exe	95
PID 4736 wrote to memory of 4780	4736	254b59f42e31662e8f96e920f41fce17.exe	96
PID 4736 wrote to memory of 4780	4736	254b59f42e31662e8f96e920f41fce17.exe	96
PID 4736 wrote to memory of 840	4736	254b59f42e31662e8f96e920f41fce17.exe	97
PID 4736 wrote to memory of 840	4736	254b59f42e31662e8f96e920f41fce17.exe	97
PID 4736 wrote to memory of 1664	4736	254b59f42e31662e8f96e920f41fce17.exe	98
PID 4736 wrote to memory of 1664	4736	254b59f42e31662e8f96e920f41fce17.exe	98
PID 4736 wrote to memory of 1672	4736	254b59f42e31662e8f96e920f41fce17.exe	99
PID 4736 wrote to memory of 1672	4736	254b59f42e31662e8f96e920f41fce17.exe	99
PID 4736 wrote to memory of 1292	4736	254b59f42e31662e8f96e920f41fce17.exe	100
PID 4736 wrote to memory of 1292	4736	254b59f42e31662e8f96e920f41fce17.exe	100
PID 4736 wrote to memory of 4344	4736	254b59f42e31662e8f96e920f41fce17.exe	101
PID 4736 wrote to memory of 4344	4736	254b59f42e31662e8f96e920f41fce17.exe	101
PID 4736 wrote to memory of 2940	4736	254b59f42e31662e8f96e920f41fce17.exe	102
PID 4736 wrote to memory of 2940	4736	254b59f42e31662e8f96e920f41fce17.exe	102
PID 4736 wrote to memory of 4424	4736	254b59f42e31662e8f96e920f41fce17.exe	103
PID 4736 wrote to memory of 4424	4736	254b59f42e31662e8f96e920f41fce17.exe	103
PID 4736 wrote to memory of 3040	4736	254b59f42e31662e8f96e920f41fce17.exe	104
PID 4736 wrote to memory of 3040	4736	254b59f42e31662e8f96e920f41fce17.exe	104
PID 4736 wrote to memory of 2780	4736	254b59f42e31662e8f96e920f41fce17.exe	105
PID 4736 wrote to memory of 2780	4736	254b59f42e31662e8f96e920f41fce17.exe	105
PID 4736 wrote to memory of 4412	4736	254b59f42e31662e8f96e920f41fce17.exe	106
PID 4736 wrote to memory of 4412	4736	254b59f42e31662e8f96e920f41fce17.exe	106
PID 4736 wrote to memory of 4560	4736	254b59f42e31662e8f96e920f41fce17.exe	107
PID 4736 wrote to memory of 4560	4736	254b59f42e31662e8f96e920f41fce17.exe	107
PID 4736 wrote to memory of 1468	4736	254b59f42e31662e8f96e920f41fce17.exe	108
PID 4736 wrote to memory of 1468	4736	254b59f42e31662e8f96e920f41fce17.exe	108
PID 4736 wrote to memory of 3016	4736	254b59f42e31662e8f96e920f41fce17.exe	109
PID 4736 wrote to memory of 3016	4736	254b59f42e31662e8f96e920f41fce17.exe	109
PID 4736 wrote to memory of 3016	4736	254b59f42e31662e8f96e920f41fce17.exe	109
PID 4736 wrote to memory of 3016	4736	254b59f42e31662e8f96e920f41fce17.exe	109
PID 4736 wrote to memory of 3016	4736	254b59f42e31662e8f96e920f41fce17.exe	109
PID 4736 wrote to memory of 3016	4736	254b59f42e31662e8f96e920f41fce17.exe	109
PID 4736 wrote to memory of 3016	4736	254b59f42e31662e8f96e920f41fce17.exe	109
PID 4736 wrote to memory of 3016	4736	254b59f42e31662e8f96e920f41fce17.exe	109
PID 4736 wrote to memory of 3016	4736	254b59f42e31662e8f96e920f41fce17.exe	109
PID 4736 wrote to memory of 3016	4736	254b59f42e31662e8f96e920f41fce17.exe	109
PID 4736 wrote to memory of 3016	4736	254b59f42e31662e8f96e920f41fce17.exe	109

C:\Users\Admin\AppData\Local\Temp\254b59f42e31662e8f96e920f41fce17.exe
"C:\Users\Admin\AppData\Local\Temp\254b59f42e31662e8f96e920f41fce17.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4736
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"
  2⤵
  PID:4852
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe"
  2⤵
  PID:636
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe"
  2⤵
  PID:3636
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe"
  2⤵
  PID:548
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe"
  2⤵
  PID:3244
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe"
  2⤵
  PID:1448
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe"
  2⤵
  PID:1212
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:3708
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"
  2⤵
  PID:4740
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe"
  2⤵
  PID:4780
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe"
  2⤵
  PID:840
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe"
  2⤵
  PID:1664
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe"
  2⤵
  PID:1672
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe"
  2⤵
  PID:1292
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"
  2⤵
  PID:4344
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  PID:2940
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe"
  2⤵
  PID:4424
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:3040
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe"
  2⤵
  PID:2780
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe"
  2⤵
  PID:4412
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe"
  2⤵
  PID:4560
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe"
  2⤵
  PID:1468
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:3016

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3016-4-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3016-6-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3016-7-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3016-9-0x0000000002A80000-0x0000000002A89000-memory.dmp

Filesize
36KB

Download
memory/3016-10-0x0000000002AA0000-0x0000000002AAD000-memory.dmp

Filesize
52KB

Download
memory/3016-11-0x0000000002AA0000-0x0000000002AAD000-memory.dmp

Filesize
52KB

Download
memory/4736-0-0x00000134BB790000-0x00000134BB820000-memory.dmp

Filesize
576KB

Download
memory/4736-1-0x00000134BD410000-0x00000134BD42A000-memory.dmp

Filesize
104KB

Download
memory/4736-2-0x00007FFC50040000-0x00007FFC50B01000-memory.dmp

Filesize
10.8MB

Download
memory/4736-3-0x00000134D5DE0000-0x00000134D5DF0000-memory.dmp

Filesize
64KB

Download
memory/4736-8-0x00007FFC50040000-0x00007FFC50B01000-memory.dmp

Filesize
10.8MB

Download