lgoogloader | ffb44a5388958cda3be00af5170e3fa51c5bc59e7b6ea659836417a17594d18c

Analysis

max time kernel
241s
max time network
318s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
13-10-2023 02:17

Target

UM.exe
Size

2.0MB
MD5

ff7712b5d2dcafd6b9c775eecc8266a1
SHA1

a11c9bd80f1c80f057517fc555fcf9b53c327302
SHA256

51d0be1366d229621051abb5df81316256c997c46265be8c9fb6b6b01fd1ccb1
SHA512

a8dbf46d54d80dd206c61007c668bd93a00a4d8b35937cfdf1b723d69484bc6230763a0cd73b602e58392a0b6814c8143877b479709fd6ab03ea98eda61c0edf
SSDEEP

24576:Q1ZRQOCf1lwVKwZJ/g9zNCehkmWIUB+AzLXalEk1XgTQCQIIKY12ZvxjtXI/cMRW:FOCd4GdAB1d4DfUz5kGrr

Score

10^/10

Detects LgoogLoader payload 1 IoCs

resource	yara_rule
behavioral31/memory/2420-4-0x00000000000B0000-0x00000000000BD000-memory.dmp	family_lgoogloader

LgoogLoader
A downloader capable of dropping and executing other malware families.
downloader lgoogloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2908 set thread context of 2420	2908	UM.exe	28

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 2420	2908	UM.exe	28
PID 2908 wrote to memory of 2420	2908	UM.exe	28
PID 2908 wrote to memory of 2420	2908	UM.exe	28
PID 2908 wrote to memory of 2420	2908	UM.exe	28
PID 2908 wrote to memory of 2420	2908	UM.exe	28
PID 2908 wrote to memory of 2420	2908	UM.exe	28
PID 2908 wrote to memory of 2420	2908	UM.exe	28
PID 2908 wrote to memory of 2420	2908	UM.exe	28
PID 2908 wrote to memory of 2420	2908	UM.exe	28
PID 2908 wrote to memory of 2420	2908	UM.exe	28
PID 2908 wrote to memory of 2420	2908	UM.exe	28
PID 2908 wrote to memory of 2420	2908	UM.exe	28

C:\Users\Admin\AppData\Local\Temp\UM.exe
"C:\Users\Admin\AppData\Local\Temp\UM.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:2420

memory/2420-0-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2420-2-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2420-4-0x00000000000B0000-0x00000000000BD000-memory.dmp

Filesize
52KB

Download
memory/2420-3-0x0000000000090000-0x0000000000099000-memory.dmp

Filesize
36KB

Download
memory/2420-5-0x00000000000B0000-0x00000000000BD000-memory.dmp

Filesize
52KB

Download