Overview

overview

10

Static

static

1

c4290abc9b...75.exe

windows7-x64

1

c4290abc9b...75.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    c4290abc9b05d22cb4112768759acf854f881d08e697528fa2549740f89b9d75.exe
  • Size 40KB
  • Sample240212-fd9gfabb81
  • SHA256 c4290abc9b05d22cb4112768759acf854f881d08e697528fa2549740f89b9d75
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
lgoogloaderdownloaderevasiontrojan

Malware Config

Targets

    • Target
      c4290abc9b05d22cb4112768759acf854f881d08e697528fa2549740f89b9d75.exe
    • Size 40KB
    • SHA256 c4290abc9b05d22cb4112768759acf854f881d08e697528fa2549740f89b9d75
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    lgoogloaderdownloaderevasiontrojan

    • Detects LgoogLoader payload

    • LgoogLoader

      A downloader capable of dropping and executing other malware families.

      downloaderlgoogloader

    • UAC bypass

      evasiontrojan

    • Windows security bypass

      evasiontrojan

    • Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF

    • Detects Windows executables referencing non-Windows User-Agents

    • Detects executables containing artifacts associated with disabling Widnows Defender

    • Detects executables embedding command execution via IExecuteCommand COM object

    • Detects executables potentially checking for WinJail sandbox window

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Windows security modification

      evasiontrojan

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks