lgoogloader | f75d6ee676e63208489f05cd8c82d44fdda74b5752963e3967071f2d2d080113

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08-11-2024 01:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

inst002.exe
Size

265KB
MD5

f38f3aab5af6435226dcca8751f61e6c
SHA1

e555e536dca72784f73422a216aa35206441444a
SHA256

94590b6681e3f9255a27b41a356d0334460ed596daab947258110a4ab94708db
SHA512

0402a9d77388348aa055ab58a3211222ffdbe043e73052e075d861d1d0888437cfdeb2c2d7676b23e539b573bd4a4180d4e5f8af840693823979997f99c76c09
SSDEEP

3072:7DO+LxoC9PZUFfYS3azG0CYUZTCldBG//7VxSVzsC1X6R8geXrVpAFdcmuYT:7a0Sf7oQYUdgiizn9XrXeddTT

Score

10^/10

lgoogloader discovery downloader

Malware Config

Signatures

Detects LgoogLoader payload 2 IoCs

resource	yara_rule
behavioral20/memory/4812-1-0x0000000000920000-0x0000000000932000-memory.dmp	family_lgoogloader
behavioral20/memory/4812-9-0x0000000000920000-0x0000000000932000-memory.dmp	family_lgoogloader

LgoogLoader
A downloader capable of dropping and executing other malware families.
downloader lgoogloader
Lgoogloader family
lgoogloader

Deletes itself 1 IoCs

pid	Process
4812	inst002.exe

Executes dropped EXE 1 IoCs

pid	Process
1336	aplYTN

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4812 set thread context of 1336	4812	inst002.exe	84

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2024	1336	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	inst002.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aplYTN

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4812	inst002.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4812 wrote to memory of 1336	4812	inst002.exe	84
PID 4812 wrote to memory of 1336	4812	inst002.exe	84
PID 4812 wrote to memory of 1336	4812	inst002.exe	84
PID 4812 wrote to memory of 1336	4812	inst002.exe	84
PID 4812 wrote to memory of 1336	4812	inst002.exe	84
PID 4812 wrote to memory of 1336	4812	inst002.exe	84
PID 4812 wrote to memory of 1336	4812	inst002.exe	84
PID 4812 wrote to memory of 1336	4812	inst002.exe	84
PID 4812 wrote to memory of 1336	4812	inst002.exe	84
PID 4812 wrote to memory of 1336	4812	inst002.exe	84
PID 4812 wrote to memory of 1336	4812	inst002.exe	84
PID 4812 wrote to memory of 1336	4812	inst002.exe	84

C:\Users\Admin\AppData\Local\Temp\inst002.exe
"C:\Users\Admin\AppData\Local\Temp\inst002.exe"
1⤵
- Deletes itself
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4812
- C:\Users\Admin\AppData\Local\Temp\XqhdfdAdILYftNJvjC\aplYTN
  C:\Users\Admin\AppData\Local\Temp\XqhdfdAdILYftNJvjC\aplYTN
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1336
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1336 -s 472
    3⤵
    - Program crash
    PID:2024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1336 -ip 1336
1⤵
PID:3092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\XqhdfdAdILYftNJvjC\aplYTN

Filesize
42KB

MD5
9dabbd84d79a0330f7635748177a2d93

SHA1
73a4e520d772e4260651cb20b61ba4cb9a29635a

SHA256
a6e4be06d34448f4efa8655a3ae6e294c98ae4cb42f7c3da3be06b419fa8389d

SHA512
020114ba08ccb7ad7934e2046d2b61ebd1b006b8c31194f2cfb49ff4397f4db35dc67c8191552346d04709dee4871a13797cf284ef543e7280bc390a6746a314

Download Submit
memory/1336-4-0x0000000000010000-0x000000000005E000-memory.dmp

Filesize
312KB

Download
memory/1336-10-0x0000000000010000-0x000000000005E000-memory.dmp

Filesize
312KB

Download
memory/1336-12-0x0000000000010000-0x000000000005E000-memory.dmp

Filesize
312KB

Download
memory/4812-1-0x0000000000920000-0x0000000000932000-memory.dmp

Filesize
72KB

Download
memory/4812-0-0x00000000007E0000-0x00000000007F0000-memory.dmp

Filesize
64KB

Download
memory/4812-9-0x0000000000920000-0x0000000000932000-memory.dmp

Filesize
72KB

Download
memory/4812-6-0x0000000000390000-0x00000000003DE000-memory.dmp

Filesize
312KB

Download