Analysis
- max time kernel
94s - max time network
124s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
28/09/2024, 08:34
General
- Target 2024-09-28_7dda564955fa2f0d8c64135cb34221c0_avoslocker.exe
- Size 4.3MB
- Sample240928-kgnflawern
- SHA256 d68b06e73cb3a0807bc442c0782ac667bdc2ceff4bc566c2c2c30e0adea42686
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 39 IoCs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-28_7dda564955fa2f0d8c64135cb34221c0_avoslocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-28_7dda564955fa2f0d8c64135cb34221c0_avoslocker.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\temp\5DCCD7B747D7FE119921E410FFFC09D8\2024-09-28_7dda564955fa2f0d8c64135cb34221c0_avoslocker.exe"C:\Windows\temp\5DCCD7B747D7FE119921E410FFFC09D8\2024-09-28_7dda564955fa2f0d8c64135cb34221c0_avoslocker.exe" -initialNonSecureSetupPath="C:\Users\Admin\AppData\Local\Temp\2024-09-28_7dda564955fa2f0d8c64135cb34221c0_avoslocker.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
kl.setup.ui.core.dll
kl.setup.ui.dll
kl.setup.ui.interoplayer.dll
kl.setup.ui.visuals.dll
kl.ui.framework.dll
kl.ui.framework.localization.dll
kl.ui.framework.uikit.b2c.dll
kl.ui.framework.uikit.dll
setup.dll
sharpvectorconverterswpf.dll
sharpvectorcore.dll
sharpvectorcss.dll
sharpvectordom.dll
sharpvectormodel.dll
sharpvectorrenderingwpf.dll
sharpvectorruntimewpf.dll
downloader_fr-FR.ini
2024-09-28_7dda564955fa2f0d8c64135cb34221c0_avoslocker.exe
memory/3124-0-0x0000000077E20000-0x0000000077E30000-memory.dmp
memory/3124-2-0x0000000077E20000-0x0000000077E30000-memory.dmp
memory/3124-3-0x0000000077CB2000-0x0000000077CB3000-memory.dmp
memory/3124-1-0x0000000077E20000-0x0000000077E30000-memory.dmp
memory/4860-96-0x0000000007C30000-0x0000000007C9A000-memory.dmp
memory/4860-123-0x0000000007F20000-0x0000000007F54000-memory.dmp
memory/4860-92-0x0000000007300000-0x00000000075C0000-memory.dmp
memory/4860-84-0x0000000006B20000-0x0000000006B36000-memory.dmp
memory/4860-103-0x0000000074460000-0x0000000074C10000-memory.dmp
memory/4860-80-0x0000000006960000-0x00000000069A2000-memory.dmp
memory/4860-52-0x00000000062F0000-0x0000000006336000-memory.dmp
memory/4860-107-0x0000000007D40000-0x0000000007DDE000-memory.dmp
memory/4860-114-0x0000000074460000-0x0000000074C10000-memory.dmp
memory/4860-127-0x0000000007F60000-0x0000000007F82000-memory.dmp
memory/4860-128-0x00000000087A0000-0x0000000008832000-memory.dmp
memory/4860-48-0x0000000074460000-0x0000000074C10000-memory.dmp
memory/4860-132-0x0000000008740000-0x0000000008772000-memory.dmp
memory/4860-46-0x0000000074460000-0x0000000074C10000-memory.dmp
memory/4860-44-0x0000000003D20000-0x0000000003D2E000-memory.dmp
memory/4860-138-0x00000000066C0000-0x00000000067BA000-memory.dmp
memory/4860-40-0x000000007446E000-0x000000007446F000-memory.dmp
memory/4860-88-0x0000000006FF0000-0x0000000007038000-memory.dmp
memory/4860-7-0x0000000077E00000-0x0000000077E10000-memory.dmp
memory/4860-147-0x00000000065A0000-0x00000000065AE000-memory.dmp
memory/4860-8-0x0000000077E00000-0x0000000077E10000-memory.dmp
memory/4860-151-0x0000000006630000-0x0000000006642000-memory.dmp
memory/4860-9-0x0000000077E00000-0x0000000077E10000-memory.dmp
memory/4860-143-0x00000000065B0000-0x00000000065CC000-memory.dmp
memory/4860-165-0x00000000089E0000-0x00000000089EE000-memory.dmp
memory/4860-164-0x000000000C920000-0x000000000C958000-memory.dmp
memory/4860-10-0x0000000077CB2000-0x0000000077CB3000-memory.dmp
memory/4860-191-0x000000000C4D0000-0x000000000C4D8000-memory.dmp
memory/4860-192-0x0000000074460000-0x0000000074C10000-memory.dmp
memory/4860-193-0x000000007446E000-0x000000007446F000-memory.dmp
memory/4860-194-0x0000000074460000-0x0000000074C10000-memory.dmp
memory/4860-195-0x0000000074460000-0x0000000074C10000-memory.dmp
memory/4860-196-0x0000000074460000-0x0000000074C10000-memory.dmp
memory/4860-197-0x0000000074460000-0x0000000074C10000-memory.dmp
memory/4860-198-0x0000000074460000-0x0000000074C10000-memory.dmp