lgoogloader | dab93347420163d40b37fbbc39f09095ce7ed4fda5168a92c012ea886cb9cff7

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
19-09-2023 16:32

Target

de3da19e14938202243b8b47b1246077.exe
Size

3.1MB
MD5

de3da19e14938202243b8b47b1246077
SHA1

89c8f1e75894cd344917d23caa12a47be2a9a2c3
SHA256

dab93347420163d40b37fbbc39f09095ce7ed4fda5168a92c012ea886cb9cff7
SHA512

0ce94e0d9be1efc7fef96f6eae6951aad803a22e2fdb330e76ccbc824a80a6e0e878c3c32bf8d2958055849a2aef9b1f0bd47caadf54b1b6a5de16e3ad6be55a
SSDEEP

24576:mM1ctJUvqpJnXG6uxyUEHPyW1Xnr29cFUA0yjW+d9o6E4vGH5a4V5+47l7Mwb2tf:mlW0Se3yGKdC7iWQQd

Score

10^/10

Detects LgoogLoader payload 2 IoCs

resource	yara_rule
behavioral1/memory/2740-4-0x00000000001C0000-0x00000000001CD000-memory.dmp	family_lgoogloader
behavioral1/memory/2740-5-0x00000000001C0000-0x00000000001CD000-memory.dmp	family_lgoogloader

LgoogLoader
A downloader capable of dropping and executing other malware families.
downloader lgoogloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2244 set thread context of 2740	2244	de3da19e14938202243b8b47b1246077.exe	29

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 2740	2244	de3da19e14938202243b8b47b1246077.exe	29
PID 2244 wrote to memory of 2740	2244	de3da19e14938202243b8b47b1246077.exe	29
PID 2244 wrote to memory of 2740	2244	de3da19e14938202243b8b47b1246077.exe	29
PID 2244 wrote to memory of 2740	2244	de3da19e14938202243b8b47b1246077.exe	29
PID 2244 wrote to memory of 2740	2244	de3da19e14938202243b8b47b1246077.exe	29
PID 2244 wrote to memory of 2740	2244	de3da19e14938202243b8b47b1246077.exe	29
PID 2244 wrote to memory of 2740	2244	de3da19e14938202243b8b47b1246077.exe	29
PID 2244 wrote to memory of 2740	2244	de3da19e14938202243b8b47b1246077.exe	29
PID 2244 wrote to memory of 2740	2244	de3da19e14938202243b8b47b1246077.exe	29
PID 2244 wrote to memory of 2740	2244	de3da19e14938202243b8b47b1246077.exe	29
PID 2244 wrote to memory of 2740	2244	de3da19e14938202243b8b47b1246077.exe	29

C:\Users\Admin\AppData\Local\Temp\de3da19e14938202243b8b47b1246077.exe
"C:\Users\Admin\AppData\Local\Temp\de3da19e14938202243b8b47b1246077.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:2740

memory/2740-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2740-2-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2740-3-0x0000000000090000-0x0000000000099000-memory.dmp

Filesize
36KB

Download
memory/2740-4-0x00000000001C0000-0x00000000001CD000-memory.dmp

Filesize
52KB

Download
memory/2740-5-0x00000000001C0000-0x00000000001CD000-memory.dmp

Filesize
52KB

Download