lgoogloader | 9f800400f5ed4b80a6d032a437e3b7fc8fa53978854726fdfc0f2737c1237596

General

Target

123[1].exe
Size

493KB
MD5

8e92c683e644b7e88184427d1b8625bb
SHA1

8b57d61299f7eaa32df979f54483ff72b47ba8f6
SHA256

9f800400f5ed4b80a6d032a437e3b7fc8fa53978854726fdfc0f2737c1237596
SHA512

027a5b35ef52be102fe4447be581140fc3cdbfd73d4531f1ebfab75672c84946dd9a4dd5ac144d9cf5e9b60a2890e0a975b254674d58ee24e3cbfc5282521dde
SSDEEP

12288:86dbSjl1WZ1oIL0WoxG3arMd9sG3SOH5:PmBMIIoWCN4Hsk7Z

Score

10^/10

lgoogloader discovery downloader persistence

Malware Config

Signatures

Detects LgoogLoader payload 2 IoCs

resource	yara_rule
behavioral1/memory/4528-13-0x0000000001950000-0x000000000195D000-memory.dmp	family_lgoogloader
behavioral1/memory/4528-14-0x0000000001950000-0x000000000195D000-memory.dmp	family_lgoogloader

LgoogLoader
A downloader capable of dropping and executing other malware families.
downloader lgoogloader
Lgoogloader family
lgoogloader

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\TaskKill\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\Иисус.sys"	123[1].exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3432 set thread context of 4528	3432	123[1].exe	91

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jsc.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3432	123[1].exe
3432	123[1].exe
3432	123[1].exe
3432	123[1].exe
3432	123[1].exe
3432	123[1].exe
3432	123[1].exe
3432	123[1].exe
3432	123[1].exe
3432	123[1].exe
3432	123[1].exe
3432	123[1].exe
3432	123[1].exe
3432	123[1].exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
3432	123[1].exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3432	123[1].exe
Token: SeLoadDriverPrivilege	3432	123[1].exe
Token: SeDebugPrivilege	3432	123[1].exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 3432 wrote to memory of 3760	3432	123[1].exe	84
PID 3432 wrote to memory of 3760	3432	123[1].exe	84
PID 3432 wrote to memory of 2348	3432	123[1].exe	85
PID 3432 wrote to memory of 2348	3432	123[1].exe	85
PID 3432 wrote to memory of 4196	3432	123[1].exe	86
PID 3432 wrote to memory of 4196	3432	123[1].exe	86
PID 3432 wrote to memory of 5004	3432	123[1].exe	87
PID 3432 wrote to memory of 5004	3432	123[1].exe	87
PID 3432 wrote to memory of 1452	3432	123[1].exe	88
PID 3432 wrote to memory of 1452	3432	123[1].exe	88
PID 3432 wrote to memory of 1736	3432	123[1].exe	89
PID 3432 wrote to memory of 1736	3432	123[1].exe	89
PID 3432 wrote to memory of 5028	3432	123[1].exe	90
PID 3432 wrote to memory of 5028	3432	123[1].exe	90
PID 3432 wrote to memory of 4528	3432	123[1].exe	91
PID 3432 wrote to memory of 4528	3432	123[1].exe	91
PID 3432 wrote to memory of 4528	3432	123[1].exe	91
PID 3432 wrote to memory of 4528	3432	123[1].exe	91
PID 3432 wrote to memory of 4528	3432	123[1].exe	91
PID 3432 wrote to memory of 4528	3432	123[1].exe	91
PID 3432 wrote to memory of 4528	3432	123[1].exe	91
PID 3432 wrote to memory of 4528	3432	123[1].exe	91
PID 3432 wrote to memory of 4528	3432	123[1].exe	91
PID 3432 wrote to memory of 4528	3432	123[1].exe	91

C:\Users\Admin\AppData\Local\Temp\123[1].exe
"C:\Users\Admin\AppData\Local\Temp\123[1].exe"
1⤵
- Sets service image path in registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3432
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:3760
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"
  2⤵
  PID:2348
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe"
  2⤵
  PID:4196
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe"
  2⤵
  PID:5004
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe"
  2⤵
  PID:1452
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:1736
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  PID:5028
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3432-11-0x00007FFC7EB30000-0x00007FFC7F5F1000-memory.dmp

Filesize
10.8MB

Download
memory/3432-1-0x000001BAD5F40000-0x000001BAD5FBE000-memory.dmp

Filesize
504KB

Download
memory/3432-2-0x000001BAF03D0000-0x000001BAF0446000-memory.dmp

Filesize
472KB

Download
memory/3432-3-0x000001BAF0350000-0x000001BAF03C8000-memory.dmp

Filesize
480KB

Download
memory/3432-5-0x00007FFC7EB30000-0x00007FFC7F5F1000-memory.dmp

Filesize
10.8MB

Download
memory/3432-4-0x000001BAD7C60000-0x000001BAD7C7E000-memory.dmp

Filesize
120KB

Download
memory/3432-0-0x00007FFC7EB33000-0x00007FFC7EB35000-memory.dmp

Filesize
8KB

Download
memory/4528-7-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4528-10-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4528-9-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4528-12-0x0000000001930000-0x0000000001939000-memory.dmp

Filesize
36KB

Download
memory/4528-13-0x0000000001950000-0x000000000195D000-memory.dmp

Filesize
52KB

Download
memory/4528-14-0x0000000001950000-0x000000000195D000-memory.dmp

Filesize
52KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads