lgoogloader | 75d167249768d3b15728389b25c65e97f6ad92610b26b7d65fe8e2db83c41e4d

Analysis

max time kernel
92s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08-11-2024 09:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

inst002.exe
Size

265KB
MD5

f38f3aab5af6435226dcca8751f61e6c
SHA1

e555e536dca72784f73422a216aa35206441444a
SHA256

94590b6681e3f9255a27b41a356d0334460ed596daab947258110a4ab94708db
SHA512

0402a9d77388348aa055ab58a3211222ffdbe043e73052e075d861d1d0888437cfdeb2c2d7676b23e539b573bd4a4180d4e5f8af840693823979997f99c76c09
SSDEEP

3072:7DO+LxoC9PZUFfYS3azG0CYUZTCldBG//7VxSVzsC1X6R8geXrVpAFdcmuYT:7a0Sf7oQYUdgiizn9XrXeddTT

Score

10^/10

lgoogloader discovery downloader

Malware Config

Signatures

Detects LgoogLoader payload 2 IoCs

Processes:

resource	yara_rule
behavioral20/memory/2332-1-0x0000000002D00000-0x0000000002D12000-memory.dmp	family_lgoogloader
behavioral20/memory/2332-12-0x0000000002D00000-0x0000000002D12000-memory.dmp	family_lgoogloader

LgoogLoader
A downloader capable of dropping and executing other malware families.
downloader lgoogloader
Lgoogloader family
lgoogloader
Deletes itself 1 IoCs

Processes:

inst002.exe

pid process

2332 inst002.exe
Executes dropped EXE 1 IoCs

Processes:

xSAqdS

pid process

3836 xSAqdS
Suspicious use of SetThreadContext 1 IoCs

Processes:

inst002.exe

description pid process target process

PID 2332 set thread context of 3836 2332 inst002.exe xSAqdS
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2612 3836 WerFault.exe xSAqdS

pid	process
2332	inst002.exe

pid	process
3836	xSAqdS

description	pid	process	target process
PID 2332 set thread context of 3836	2332	inst002.exe	xSAqdS

pid	pid_target	process	target process
2612	3836	WerFault.exe	xSAqdS

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

inst002.exexSAqdS

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	inst002.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xSAqdS

Suspicious behavior: RenamesItself 1 IoCs

Processes:

inst002.exe

pid process

2332 inst002.exe

pid	process
2332	inst002.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

inst002.exe

description	pid	process	target process
PID 2332 wrote to memory of 3836	2332	inst002.exe	xSAqdS
PID 2332 wrote to memory of 3836	2332	inst002.exe	xSAqdS
PID 2332 wrote to memory of 3836	2332	inst002.exe	xSAqdS
PID 2332 wrote to memory of 3836	2332	inst002.exe	xSAqdS
PID 2332 wrote to memory of 3836	2332	inst002.exe	xSAqdS
PID 2332 wrote to memory of 3836	2332	inst002.exe	xSAqdS
PID 2332 wrote to memory of 3836	2332	inst002.exe	xSAqdS
PID 2332 wrote to memory of 3836	2332	inst002.exe	xSAqdS
PID 2332 wrote to memory of 3836	2332	inst002.exe	xSAqdS
PID 2332 wrote to memory of 3836	2332	inst002.exe	xSAqdS
PID 2332 wrote to memory of 3836	2332	inst002.exe	xSAqdS
PID 2332 wrote to memory of 3836	2332	inst002.exe	xSAqdS

C:\Users\Admin\AppData\Local\Temp\inst002.exe
"C:\Users\Admin\AppData\Local\Temp\inst002.exe"
1⤵
- Deletes itself
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Users\Admin\AppData\Local\Temp\qydBuSyJtmSmHNNaqr\xSAqdS
  C:\Users\Admin\AppData\Local\Temp\qydBuSyJtmSmHNNaqr\xSAqdS
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3836
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3836 -s 472
    3⤵
    - Program crash
    PID:2612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3836 -ip 3836
1⤵
PID:1788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\qydBuSyJtmSmHNNaqr\xSAqdS

Filesize
42KB

MD5
9dabbd84d79a0330f7635748177a2d93

SHA1
73a4e520d772e4260651cb20b61ba4cb9a29635a

SHA256
a6e4be06d34448f4efa8655a3ae6e294c98ae4cb42f7c3da3be06b419fa8389d

SHA512
020114ba08ccb7ad7934e2046d2b61ebd1b006b8c31194f2cfb49ff4397f4db35dc67c8191552346d04709dee4871a13797cf284ef543e7280bc390a6746a314

Download Submit
memory/2332-0-0x0000000001110000-0x0000000001120000-memory.dmp

Filesize
64KB

Download
memory/2332-1-0x0000000002D00000-0x0000000002D12000-memory.dmp

Filesize
72KB

Download
memory/2332-11-0x00000000009B0000-0x00000000009FE000-memory.dmp

Filesize
312KB

Download
memory/2332-12-0x0000000002D00000-0x0000000002D12000-memory.dmp

Filesize
72KB

Download
memory/3836-8-0x0000000000010000-0x000000000005E000-memory.dmp

Filesize
312KB

Download
memory/3836-10-0x0000000000010000-0x000000000005E000-memory.dmp

Filesize
312KB

Download
memory/3836-4-0x0000000000010000-0x000000000005E000-memory.dmp

Filesize
312KB

Download