lgoogloader | ffb44a5388958cda3be00af5170e3fa51c5bc59e7b6ea659836417a17594d18c

Analysis

max time kernel
91s
max time network
193s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
13-10-2023 02:17

Target

UM.exe
Size

2.0MB
MD5

ff7712b5d2dcafd6b9c775eecc8266a1
SHA1

a11c9bd80f1c80f057517fc555fcf9b53c327302
SHA256

51d0be1366d229621051abb5df81316256c997c46265be8c9fb6b6b01fd1ccb1
SHA512

a8dbf46d54d80dd206c61007c668bd93a00a4d8b35937cfdf1b723d69484bc6230763a0cd73b602e58392a0b6814c8143877b479709fd6ab03ea98eda61c0edf
SSDEEP

24576:Q1ZRQOCf1lwVKwZJ/g9zNCehkmWIUB+AzLXalEk1XgTQCQIIKY12ZvxjtXI/cMRW:FOCd4GdAB1d4DfUz5kGrr

Score

10^/10

Detects LgoogLoader payload 2 IoCs

resource	yara_rule
behavioral32/memory/1584-4-0x0000000002C00000-0x0000000002C0D000-memory.dmp	family_lgoogloader
behavioral32/memory/1584-5-0x0000000002C00000-0x0000000002C0D000-memory.dmp	family_lgoogloader

LgoogLoader
A downloader capable of dropping and executing other malware families.
downloader lgoogloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1872 set thread context of 1584	1872	UM.exe	82

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1872 wrote to memory of 1584	1872	UM.exe	82
PID 1872 wrote to memory of 1584	1872	UM.exe	82
PID 1872 wrote to memory of 1584	1872	UM.exe	82
PID 1872 wrote to memory of 1584	1872	UM.exe	82
PID 1872 wrote to memory of 1584	1872	UM.exe	82
PID 1872 wrote to memory of 1584	1872	UM.exe	82
PID 1872 wrote to memory of 1584	1872	UM.exe	82
PID 1872 wrote to memory of 1584	1872	UM.exe	82
PID 1872 wrote to memory of 1584	1872	UM.exe	82
PID 1872 wrote to memory of 1584	1872	UM.exe	82
PID 1872 wrote to memory of 1584	1872	UM.exe	82

C:\Users\Admin\AppData\Local\Temp\UM.exe
"C:\Users\Admin\AppData\Local\Temp\UM.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1872
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:1584

memory/1584-0-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1584-1-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1584-2-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1584-3-0x0000000002BE0000-0x0000000002BE9000-memory.dmp

Filesize
36KB

Download
memory/1584-4-0x0000000002C00000-0x0000000002C0D000-memory.dmp

Filesize
52KB

Download
memory/1584-5-0x0000000002C00000-0x0000000002C0D000-memory.dmp

Filesize
52KB

Download