Analysis
-
max time kernel
121s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
19-09-2023 16:32
Static task
static1
Behavioral task
behavioral1
Sample
bba7cf3a70a424ea0626bb9a8bb9295b.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
bba7cf3a70a424ea0626bb9a8bb9295b.exe
Resource
win10v2004-20230915-en
General
-
Target
bba7cf3a70a424ea0626bb9a8bb9295b.exe
-
Size
3.4MB
-
MD5
bba7cf3a70a424ea0626bb9a8bb9295b
-
SHA1
a001759346c5a9f799fac6b1d6b35d286131d4df
-
SHA256
f5a6cabc167d6ae3999dc047e6d45076468446f334cbb334e3f5220365acec63
-
SHA512
98f766637cf46baa26e9490363148edd7b15d15eb57a3ba81626c409d3dc509d74ded40a1acdc1df14875b3e509dc8cce0fed0cd61286e6cd0be2b8a1f7e51c4
-
SSDEEP
24576:BjTqkQ3Wi+9kdv+gzvri0MyCJD688hYsbO4tIbgcgMRHPTnqzlJBRZzJChZ2bV9/:BvAfzks2MKuskp99vKq8UoQ5
Malware Config
Signatures
-
Detects LgoogLoader payload 2 IoCs
resource yara_rule behavioral1/memory/2840-4-0x0000000000250000-0x000000000025D000-memory.dmp family_lgoogloader behavioral1/memory/2840-5-0x00000000000F0000-0x00000000000F9000-memory.dmp family_lgoogloader -
LgoogLoader
A downloader capable of dropping and executing other malware families.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2296 set thread context of 2840 2296 bba7cf3a70a424ea0626bb9a8bb9295b.exe 29 -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2296 wrote to memory of 2840 2296 bba7cf3a70a424ea0626bb9a8bb9295b.exe 29 PID 2296 wrote to memory of 2840 2296 bba7cf3a70a424ea0626bb9a8bb9295b.exe 29 PID 2296 wrote to memory of 2840 2296 bba7cf3a70a424ea0626bb9a8bb9295b.exe 29 PID 2296 wrote to memory of 2840 2296 bba7cf3a70a424ea0626bb9a8bb9295b.exe 29 PID 2296 wrote to memory of 2840 2296 bba7cf3a70a424ea0626bb9a8bb9295b.exe 29 PID 2296 wrote to memory of 2840 2296 bba7cf3a70a424ea0626bb9a8bb9295b.exe 29 PID 2296 wrote to memory of 2840 2296 bba7cf3a70a424ea0626bb9a8bb9295b.exe 29 PID 2296 wrote to memory of 2840 2296 bba7cf3a70a424ea0626bb9a8bb9295b.exe 29 PID 2296 wrote to memory of 2840 2296 bba7cf3a70a424ea0626bb9a8bb9295b.exe 29 PID 2296 wrote to memory of 2840 2296 bba7cf3a70a424ea0626bb9a8bb9295b.exe 29 PID 2296 wrote to memory of 2840 2296 bba7cf3a70a424ea0626bb9a8bb9295b.exe 29 PID 2296 wrote to memory of 2840 2296 bba7cf3a70a424ea0626bb9a8bb9295b.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\bba7cf3a70a424ea0626bb9a8bb9295b.exe"C:\Users\Admin\AppData\Local\Temp\bba7cf3a70a424ea0626bb9a8bb9295b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵PID:2840
-