lgoogloader | 51d0be1366d229621051abb5df81316256c997c46265be8c9fb6b6b01fd1ccb1

Analysis

max time kernel
126s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2023, 03:31

Target
51d0be1366d229621051abb5df81316256c997c46265be8c9fb6b6b01fd1ccb1.exe
Size 2.0MB
Sample231013-d3c4esee36
SHA256 51d0be1366d229621051abb5df81316256c997c46265be8c9fb6b6b01fd1ccb1
MD5 ff7712b5d2dcafd6b9c775eecc8266a1
SHA1 a11c9bd80f1c80f057517fc555fcf9b53c327302
SHA512 a8dbf46d54d80dd206c61007c668bd93a00a4d8b35937cfdf1b723d69484bc6230763a0cd73b602e58392a0b6814c8143877b479709fd6ab03ea98eda61c0edf
SSDEEP 24576:Q1ZRQOCf1lwVKwZJ/g9zNCehkmWIUB+AzLXalEk1XgTQCQIIKY12ZvxjtXI/cMRW:FOCd4GdAB1d4DfUz5kGrr
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Detects LgoogLoader payload 2 IoCs

resource	yara_rule
behavioral2/memory/3596-4-0x00000000029A0000-0x00000000029AD000-memory.dmp	family_lgoogloader
behavioral2/memory/3596-5-0x00000000029A0000-0x00000000029AD000-memory.dmp	family_lgoogloader

LgoogLoader
A downloader capable of dropping and executing other malware families.
downloader lgoogloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3912 set thread context of 3596	3912	51d0be1366d229621051abb5df81316256c997c46265be8c9fb6b6b01fd1ccb1.exe	82

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3912 wrote to memory of 3596	3912	51d0be1366d229621051abb5df81316256c997c46265be8c9fb6b6b01fd1ccb1.exe	82
PID 3912 wrote to memory of 3596	3912	51d0be1366d229621051abb5df81316256c997c46265be8c9fb6b6b01fd1ccb1.exe	82
PID 3912 wrote to memory of 3596	3912	51d0be1366d229621051abb5df81316256c997c46265be8c9fb6b6b01fd1ccb1.exe	82
PID 3912 wrote to memory of 3596	3912	51d0be1366d229621051abb5df81316256c997c46265be8c9fb6b6b01fd1ccb1.exe	82
PID 3912 wrote to memory of 3596	3912	51d0be1366d229621051abb5df81316256c997c46265be8c9fb6b6b01fd1ccb1.exe	82
PID 3912 wrote to memory of 3596	3912	51d0be1366d229621051abb5df81316256c997c46265be8c9fb6b6b01fd1ccb1.exe	82
PID 3912 wrote to memory of 3596	3912	51d0be1366d229621051abb5df81316256c997c46265be8c9fb6b6b01fd1ccb1.exe	82
PID 3912 wrote to memory of 3596	3912	51d0be1366d229621051abb5df81316256c997c46265be8c9fb6b6b01fd1ccb1.exe	82
PID 3912 wrote to memory of 3596	3912	51d0be1366d229621051abb5df81316256c997c46265be8c9fb6b6b01fd1ccb1.exe	82
PID 3912 wrote to memory of 3596	3912	51d0be1366d229621051abb5df81316256c997c46265be8c9fb6b6b01fd1ccb1.exe	82
PID 3912 wrote to memory of 3596	3912	51d0be1366d229621051abb5df81316256c997c46265be8c9fb6b6b01fd1ccb1.exe	82

C:\Users\Admin\AppData\Local\Temp\51d0be1366d229621051abb5df81316256c997c46265be8c9fb6b6b01fd1ccb1.exe
"C:\Users\Admin\AppData\Local\Temp\51d0be1366d229621051abb5df81316256c997c46265be8c9fb6b6b01fd1ccb1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3912
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:3596

memory/3596-0-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3596-1-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3596-2-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3596-3-0x0000000000C50000-0x0000000000C59000-memory.dmp

Download

memory/3596-4-0x00000000029A0000-0x00000000029AD000-memory.dmp

Download

memory/3596-5-0x00000000029A0000-0x00000000029AD000-memory.dmp

Download