lgoogloader | dab93347420163d40b37fbbc39f09095ce7ed4fda5168a92c012ea886cb9cff7

Analysis

max time kernel
125s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2023 16:32

Target

de3da19e14938202243b8b47b1246077.exe
Size

3.1MB
MD5

de3da19e14938202243b8b47b1246077
SHA1

89c8f1e75894cd344917d23caa12a47be2a9a2c3
SHA256

dab93347420163d40b37fbbc39f09095ce7ed4fda5168a92c012ea886cb9cff7
SHA512

0ce94e0d9be1efc7fef96f6eae6951aad803a22e2fdb330e76ccbc824a80a6e0e878c3c32bf8d2958055849a2aef9b1f0bd47caadf54b1b6a5de16e3ad6be55a
SSDEEP

24576:mM1ctJUvqpJnXG6uxyUEHPyW1Xnr29cFUA0yjW+d9o6E4vGH5a4V5+47l7Mwb2tf:mlW0Se3yGKdC7iWQQd

Score

10^/10

Detects LgoogLoader payload 2 IoCs

resource	yara_rule
behavioral2/memory/1132-4-0x0000000000FE0000-0x0000000000FED000-memory.dmp	family_lgoogloader
behavioral2/memory/1132-5-0x0000000000FE0000-0x0000000000FED000-memory.dmp	family_lgoogloader

LgoogLoader
A downloader capable of dropping and executing other malware families.
downloader lgoogloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4768 set thread context of 1132	4768	de3da19e14938202243b8b47b1246077.exe	83

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4768 wrote to memory of 1132	4768	de3da19e14938202243b8b47b1246077.exe	83
PID 4768 wrote to memory of 1132	4768	de3da19e14938202243b8b47b1246077.exe	83
PID 4768 wrote to memory of 1132	4768	de3da19e14938202243b8b47b1246077.exe	83
PID 4768 wrote to memory of 1132	4768	de3da19e14938202243b8b47b1246077.exe	83
PID 4768 wrote to memory of 1132	4768	de3da19e14938202243b8b47b1246077.exe	83
PID 4768 wrote to memory of 1132	4768	de3da19e14938202243b8b47b1246077.exe	83
PID 4768 wrote to memory of 1132	4768	de3da19e14938202243b8b47b1246077.exe	83
PID 4768 wrote to memory of 1132	4768	de3da19e14938202243b8b47b1246077.exe	83
PID 4768 wrote to memory of 1132	4768	de3da19e14938202243b8b47b1246077.exe	83
PID 4768 wrote to memory of 1132	4768	de3da19e14938202243b8b47b1246077.exe	83

C:\Users\Admin\AppData\Local\Temp\de3da19e14938202243b8b47b1246077.exe
"C:\Users\Admin\AppData\Local\Temp\de3da19e14938202243b8b47b1246077.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:1132

memory/1132-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1132-1-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1132-2-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1132-3-0x0000000000CC0000-0x0000000000CC9000-memory.dmp

Filesize
36KB

Download
memory/1132-4-0x0000000000FE0000-0x0000000000FED000-memory.dmp

Filesize
52KB

Download
memory/1132-5-0x0000000000FE0000-0x0000000000FED000-memory.dmp

Filesize
52KB

Download