Analysis
-
max time kernel
139s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
23/08/2024, 00:46
General
-
Target
2024-08-23_877b75661c46e87b1005898df9651275_avoslocker_hijackloader_mafia.exe
-
Size
3.8MB
-
MD5
877b75661c46e87b1005898df9651275
-
SHA1
b749936424ee52992322f6e602db325bddb0720b
-
SHA256
f0029a6bf228970091a271cbe385404362ec853a3b0146138612e9bb0a4c550f
-
SHA512
afe9b88d6b05de1095330ff4b4167a01b0bd8867b2d710ce5d1803cc14f39c5e4615a5171fb4e127e6121446137a6fabf01010c6151cc365a442dcdb1f81ce63
-
SSDEEP
49152:aKyf6hgQVBFGu1PInC5QZuTtS0rQMYOQ+q8CERSW5wpqXG1ZP9KFeMG:aghgaBFDPFWsM0r1QnKSmG1J0FeX
Malware Config
Signatures
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
VMProtect packed file 3 IoCs
Detects executables packed with VMProtect commercial packer.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-23_877b75661c46e87b1005898df9651275_avoslocker_hijackloader_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-23_877b75661c46e87b1005898df9651275_avoslocker_hijackloader_mafia.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
972KB
-
Filesize
972KB
-
Filesize
972KB