lgoogloader | f5a6cabc167d6ae3999dc047e6d45076468446f334cbb334e3f5220365acec63

Analysis

max time kernel
142s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2023 16:32

Target

bba7cf3a70a424ea0626bb9a8bb9295b.exe
Size

3.4MB
MD5

bba7cf3a70a424ea0626bb9a8bb9295b
SHA1

a001759346c5a9f799fac6b1d6b35d286131d4df
SHA256

f5a6cabc167d6ae3999dc047e6d45076468446f334cbb334e3f5220365acec63
SHA512

98f766637cf46baa26e9490363148edd7b15d15eb57a3ba81626c409d3dc509d74ded40a1acdc1df14875b3e509dc8cce0fed0cd61286e6cd0be2b8a1f7e51c4
SSDEEP

24576:BjTqkQ3Wi+9kdv+gzvri0MyCJD688hYsbO4tIbgcgMRHPTnqzlJBRZzJChZ2bV9/:BvAfzks2MKuskp99vKq8UoQ5

Score

10^/10

Detects LgoogLoader payload 2 IoCs

resource	yara_rule
behavioral2/memory/1360-4-0x0000000002FA0000-0x0000000002FAD000-memory.dmp	family_lgoogloader
behavioral2/memory/1360-5-0x0000000002FA0000-0x0000000002FAD000-memory.dmp	family_lgoogloader

LgoogLoader
A downloader capable of dropping and executing other malware families.
downloader lgoogloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4248 set thread context of 1360	4248	bba7cf3a70a424ea0626bb9a8bb9295b.exe	87

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4248 wrote to memory of 1360	4248	bba7cf3a70a424ea0626bb9a8bb9295b.exe	87
PID 4248 wrote to memory of 1360	4248	bba7cf3a70a424ea0626bb9a8bb9295b.exe	87
PID 4248 wrote to memory of 1360	4248	bba7cf3a70a424ea0626bb9a8bb9295b.exe	87
PID 4248 wrote to memory of 1360	4248	bba7cf3a70a424ea0626bb9a8bb9295b.exe	87
PID 4248 wrote to memory of 1360	4248	bba7cf3a70a424ea0626bb9a8bb9295b.exe	87
PID 4248 wrote to memory of 1360	4248	bba7cf3a70a424ea0626bb9a8bb9295b.exe	87
PID 4248 wrote to memory of 1360	4248	bba7cf3a70a424ea0626bb9a8bb9295b.exe	87
PID 4248 wrote to memory of 1360	4248	bba7cf3a70a424ea0626bb9a8bb9295b.exe	87
PID 4248 wrote to memory of 1360	4248	bba7cf3a70a424ea0626bb9a8bb9295b.exe	87
PID 4248 wrote to memory of 1360	4248	bba7cf3a70a424ea0626bb9a8bb9295b.exe	87
PID 4248 wrote to memory of 1360	4248	bba7cf3a70a424ea0626bb9a8bb9295b.exe	87

C:\Users\Admin\AppData\Local\Temp\bba7cf3a70a424ea0626bb9a8bb9295b.exe
"C:\Users\Admin\AppData\Local\Temp\bba7cf3a70a424ea0626bb9a8bb9295b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4248
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:1360

memory/1360-0-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1360-1-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1360-2-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1360-3-0x0000000002F80000-0x0000000002F89000-memory.dmp

Filesize
36KB

Download
memory/1360-4-0x0000000002FA0000-0x0000000002FAD000-memory.dmp

Filesize
52KB

Download
memory/1360-5-0x0000000002FA0000-0x0000000002FAD000-memory.dmp

Filesize
52KB

Download