Static task
static1
Behavioral task
behavioral1
Sample
2024-05-22_98d0b3721a326921d8174652d58c12df_avoslocker.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-22_98d0b3721a326921d8174652d58c12df_avoslocker.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-05-22_98d0b3721a326921d8174652d58c12df_avoslocker
-
Size
7.3MB
-
MD5
98d0b3721a326921d8174652d58c12df
-
SHA1
3ced6448d6ad433fc5b742e4f99f14d5728fd4e0
-
SHA256
413cb85e22ce03661d2c58762f20d14c6f7c459f1ae872c34668fbf089426000
-
SHA512
202a3df89344a8bf7fa972de294682dc52da32af662c2e0a79f4b2f5f445133018d26fd838db0e793a75f2af19fd5b5971e84d9dfdd2c01650514694d33b3f6b
-
SSDEEP
196608:IlWmoses5xBNI7dY2ukIFO/rnfVAwPS6AHmO2O:Ues5rq7NSF4VAEwHm
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 2024-05-22_98d0b3721a326921d8174652d58c12df_avoslocker
Files
-
2024-05-22_98d0b3721a326921d8174652d58c12df_avoslocker.exe windows:6 windows x86 arch:x86
0507656807332b09da2ceac2d8f2d393
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
dbghelp
SymInitialize
SymFromAddr
SymGetLineFromAddr64
advapi32
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
CryptAcquireContextW
CryptReleaseContext
CryptGenRandom
RegCreateKeyExW
RegEnumKeyExW
RegSetValueExW
RegDeleteValueW
RegEnumValueW
RegEnumKeyW
CryptAcquireContextA
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptDestroyKey
CryptImportKey
CryptEncrypt
SystemFunction036
ws2_32
WSAStartup
gethostname
WSACleanup
closesocket
recv
WSAGetLastError
gethostbyname
send
bind
shutdown
WSARecvFrom
WSARecv
WSASocketW
freeaddrinfo
getaddrinfo
select
__WSAFDIsSet
ioctlsocket
listen
htonl
accept
WSAIoctl
WSASetLastError
socket
setsockopt
ntohs
htons
getsockopt
getsockname
getpeername
connect
shell32
CommandLineToArgvW
ShellExecuteA
rpcrt4
RpcStringFreeW
UuidCreate
UuidToStringW
crypt32
CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
CryptStringToBinaryA
CertFindCertificateInStore
CertOpenStore
PFXIsPFXBlob
PFXImportCertStore
CertGetCertificateContextProperty
CertFreeCertificateContext
CertEnumCertificatesInStore
CertCloseStore
kernel32
SetThreadAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
FreeLibraryAndExitThread
CreateTimerQueueTimer
GetThreadTimes
CreateTimerQueue
InitializeSListHead
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
GetStringTypeW
GetLocaleInfoW
CompareStringW
VirtualProtect
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
RtlUnwind
SystemTimeToTzSpecificLocalTime
ExitProcess
FindFirstFileExW
ExitThread
GetCommandLineA
HeapFree
HeapAlloc
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
SignalObjectAndWait
GetStdHandle
GetFileSizeEx
GetFileType
ReadFile
WriteFile
GetLastError
MultiByteToWideChar
WideCharToMultiByte
GetACP
GetConsoleCP
GetConsoleMode
ReadConsoleW
WriteConsoleW
FlushConsoleInputBuffer
SetStdHandle
CreateFileW
GetFileAttributesW
GetFileSize
SetFileAttributesW
CloseHandle
DuplicateHandle
GetCurrentProcess
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameW
LocalFree
FormatMessageA
MoveFileExW
GetConsoleScreenBufferInfo
GetVersionExW
GetFileTime
SetFileTime
GetOEMCP
GetCPInfoExW
IsDBCSLeadByteEx
IsWow64Process
LockFileEx
UnlockFileEx
FormatMessageW
GetFileAttributesExW
GetVolumeInformationA
GetSystemDirectoryA
GetWindowsDirectoryA
CreatePipe
GetCommandLineW
GetFullPathNameW
ExpandEnvironmentStringsW
CompareFileTime
DeleteFileW
FindClose
FindFirstFileW
GetFileInformationByHandle
GetShortPathNameW
RemoveDirectoryW
SetLastError
DeviceIoControl
Sleep
GetModuleHandleW
GetProcAddress
GetTimeZoneInformation
SetCurrentDirectoryW
GetCurrentDirectoryW
GetHandleInformation
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
ReleaseSemaphore
WaitForSingleObject
WaitForMultipleObjects
CreateSemaphoreW
TerminateProcess
GetExitCodeProcess
CreateThread
ResumeThread
CreateProcessW
OpenProcess
SetConsoleCtrlHandler
GenerateConsoleCtrlEvent
SetConsoleTextAttribute
RtlCaptureStackBackTrace
QueryPerformanceCounter
QueryPerformanceFrequency
GlobalMemoryStatusEx
GetSystemInfo
FreeLibrary
LoadLibraryW
lstrcmpiW
LoadLibraryExW
CreateDirectoryW
SetEndOfFile
SetFilePointer
LoadLibraryA
GetTempPathW
FindNextFileW
GetDiskFreeSpaceW
HeapReAlloc
GetVolumePathNameW
GetOverlappedResult
CancelIo
ResetEvent
CreateEventW
VirtualAlloc
VirtualFree
IsValidCodePage
CreateFileA
GetFileAttributesA
PeekNamedPipe
SearchPathA
SetHandleInformation
CreateProcessA
SleepEx
VerSetConditionMask
GetModuleHandleA
VerifyVersionInfoA
GetTickCount
MoveFileExA
GetEnvironmentVariableA
FlushFileBuffers
GetFinalPathNameByHandleW
SetFilePointerEx
MapViewOfFile
FlushViewOfFile
UnmapViewOfFile
CreateFileMappingA
ReOpenFile
CopyFileW
CreateHardLinkW
GetFileInformationByHandleEx
CreateSymbolicLinkW
SetErrorMode
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
ConnectNamedPipe
SetNamedPipeHandleState
CreateNamedPipeW
CancelIoEx
CancelSynchronousIo
DeleteCriticalSection
CreateEventA
SwitchToThread
GetCurrentThread
QueueUserWorkItem
CreateNamedPipeA
GetNamedPipeHandleStateA
RegisterWaitForSingleObject
UnregisterWait
DebugBreak
SetEvent
GetNumberOfConsoleInputEvents
ReadConsoleInputW
SetConsoleCursorPosition
WriteConsoleInputW
GetEnvironmentVariableW
UnregisterWaitEx
CreateJobObjectW
AssignProcessToJobObject
SetInformationJobObject
GetProcessAffinityMask
SetProcessAffinityMask
LCMapStringW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
FileTimeToSystemTime
CreateToolhelp32Snapshot
Process32First
Process32Next
TryEnterCriticalSection
InitializeConditionVariable
WakeConditionVariable
SleepConditionVariableCS
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CreateSemaphoreA
GetLongPathNameW
ReadDirectoryChangesW
GetStartupInfoW
GetProcessHeap
WaitForSingleObjectEx
DecodePointer
EncodePointer
InitializeCriticalSectionAndSpinCount
IsProcessorFeaturePresent
GetModuleHandleExW
GetCurrentThreadId
RaiseException
HeapSize
EnumSystemLocalesW
GetDriveTypeW
user32
CharPrevExA
TranslateMessage
GetSystemMetrics
MapVirtualKeyW
DispatchMessageA
WaitForInputIdle
GetMessageA
ole32
CoCreateInstance
GetRunningObjectTable
CreateBindCtx
CoInitialize
CoTaskMemFree
CoInitializeEx
CoUninitialize
oleaut32
SysFreeString
SysAllocString
VariantInit
VariantClear
SafeArrayDestroy
Sections
.text Size: 6.1MB - Virtual size: 6.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 945KB - Virtual size: 944KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 75KB - Virtual size: 2.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 238KB - Virtual size: 237KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ