Malware Analysis Report

2024-11-30 15:04

Sample ID 241030-am1b8s1pbt
Target 2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader
SHA256 20592cd3af7ef4fc50bf5df5ad426ff7ee6094239422ae1eec91467927e7170a
Tags
vipkeylogger collection discovery keylogger macro persistence spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

20592cd3af7ef4fc50bf5df5ad426ff7ee6094239422ae1eec91467927e7170a

Threat Level: Known bad

The file 2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader was found to be: Known bad.

Malicious Activity Summary

vipkeylogger collection discovery keylogger macro persistence spyware stealer

Vipkeylogger family

VIPKeylogger

Suspicious Office macro

Checks computer location settings

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Executes dropped EXE

Loads dropped DLL

Accesses Microsoft Outlook profiles

Adds Run key to start application

Looks up external IP address via web service

Suspicious use of SetThreadContext

Browser Information Discovery

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Unsigned PE

outlook_win_path

outlook_office_path

Suspicious use of AdjustPrivilegeToken

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

Modifies registry class

Suspicious use of WriteProcessMemory

Suspicious behavior: AddClipboardFormatListener

Enumerates system info in registry

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-30 00:20

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-30 00:20

Reported

2024-10-30 00:23

Platform

win7-20240903-en

Max time kernel

122s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe"

Signatures

VIPKeylogger

stealer keylogger vipkeylogger

Vipkeylogger family

vipkeylogger

Suspicious Office macro

macro
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Reads user/profile data of local email clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\._cache_2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\._cache_2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\._cache_2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A checkip.dyndns.org N/A N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\._cache_2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\Synaptics\Synaptics.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\Synaptics\Synaptics.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2140 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe
PID 2140 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe
PID 2140 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe
PID 2140 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe
PID 2140 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe
PID 2140 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe
PID 2140 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe
PID 2140 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe
PID 2140 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe
PID 2140 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe
PID 2140 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe
PID 2140 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe
PID 2140 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe
PID 2140 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe
PID 2140 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe
PID 2140 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe
PID 2860 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\._cache_2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe
PID 2860 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\._cache_2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe
PID 2860 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\._cache_2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe
PID 2860 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\._cache_2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe
PID 2860 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2860 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2860 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2860 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2772 wrote to memory of 2804 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2772 wrote to memory of 2804 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2772 wrote to memory of 2804 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2772 wrote to memory of 2804 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2772 wrote to memory of 2804 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2772 wrote to memory of 2804 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2772 wrote to memory of 2804 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2772 wrote to memory of 2804 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2772 wrote to memory of 2804 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2772 wrote to memory of 2804 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2772 wrote to memory of 2804 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2772 wrote to memory of 2804 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2804 wrote to memory of 700 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 2804 wrote to memory of 700 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 2804 wrote to memory of 700 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 2804 wrote to memory of 700 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe

"C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe"

C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe

"C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe"

C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe

"C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe"

C:\Users\Admin\AppData\Local\Temp\._cache_2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe

"C:\Users\Admin\AppData\Local\Temp\._cache_2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe"

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe"

C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe

"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 checkip.dyndns.org udp
US 193.122.130.0:80 checkip.dyndns.org tcp
US 8.8.8.8:53 reallyfreegeoip.org udp
US 172.67.177.134:443 reallyfreegeoip.org tcp
US 8.8.8.8:53 xred.mooo.com udp
US 193.122.130.0:80 checkip.dyndns.org tcp
US 8.8.8.8:53 freedns.afraid.org udp
US 69.42.215.252:80 freedns.afraid.org tcp
US 172.67.177.134:443 reallyfreegeoip.org tcp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 docs.google.com udp
GB 216.58.204.78:443 docs.google.com tcp
US 8.8.8.8:53 c.pki.goog udp
GB 142.250.180.3:80 c.pki.goog tcp
US 8.8.8.8:53 o.pki.goog udp
GB 142.250.180.3:80 o.pki.goog tcp
US 8.8.8.8:53 drive.usercontent.google.com udp
GB 142.250.187.193:443 drive.usercontent.google.com tcp
US 8.8.8.8:53 crl.microsoft.com udp
GB 2.18.190.80:80 crl.microsoft.com tcp

Files

memory/2140-0-0x00000000745AE000-0x00000000745AF000-memory.dmp

memory/2140-1-0x00000000011F0000-0x00000000015BA000-memory.dmp

memory/2140-2-0x00000000745A0000-0x0000000074C8E000-memory.dmp

memory/2140-3-0x0000000005FB0000-0x0000000006120000-memory.dmp

memory/2140-4-0x0000000000740000-0x000000000075E000-memory.dmp

memory/2140-5-0x00000000745AE000-0x00000000745AF000-memory.dmp

memory/2140-6-0x00000000745A0000-0x0000000074C8E000-memory.dmp

memory/2140-7-0x000000000AF10000-0x000000000B058000-memory.dmp

memory/2860-8-0x0000000000400000-0x0000000000506000-memory.dmp

memory/2860-10-0x0000000000400000-0x0000000000506000-memory.dmp

memory/2860-9-0x0000000000400000-0x0000000000506000-memory.dmp

memory/2860-24-0x0000000000400000-0x0000000000506000-memory.dmp

memory/2860-23-0x0000000000400000-0x0000000000506000-memory.dmp

memory/2860-22-0x0000000000400000-0x0000000000506000-memory.dmp

memory/2860-20-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2860-18-0x0000000000400000-0x0000000000506000-memory.dmp

memory/2860-16-0x0000000000400000-0x0000000000506000-memory.dmp

memory/2860-14-0x0000000000400000-0x0000000000506000-memory.dmp

memory/2860-12-0x0000000000400000-0x0000000000506000-memory.dmp

memory/2140-25-0x00000000745A0000-0x0000000074C8E000-memory.dmp

memory/2860-26-0x00000000000F0000-0x00000000000F1000-memory.dmp

C:\ProgramData\Synaptics\Synaptics.exe

MD5 b38044c85c61344e55c645da14c2c5e9
SHA1 3c7234f791f2da542d318965f6868b909a4b6c3e
SHA256 20592cd3af7ef4fc50bf5df5ad426ff7ee6094239422ae1eec91467927e7170a
SHA512 ae2a94a1b3be245e9226d39b81301dbc17e82815547343ac7c222f1d2e89038efb160a44699eb13abc41a53ef78b484bb31110a402457d22f931286ab5e927ad

C:\Users\Admin\AppData\Local\Temp\._cache_2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe

MD5 5446eaf87fe423755a4611cd0ff939e4
SHA1 c4b2153f43659c6b0ff11527a02b0b0dbfe75b11
SHA256 f7f3df09f0759f03d0d3d114caadac597c767ebfeaba7115d2963c732864daff
SHA512 1b82fc09028091ca718ee02853c0a4a3096ac92f2ba707e181c78cccb8ca717deedda3d7605a704112660575ab0d30f556e8317bbc15940c96265b0da2b4a73c

memory/2628-44-0x0000000001300000-0x0000000001348000-memory.dmp

memory/2772-51-0x0000000000BD0000-0x0000000000F9A000-memory.dmp

memory/2804-66-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2804-69-0x0000000000400000-0x0000000000506000-memory.dmp

\??\PIPE\srvsvc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/700-80-0x0000000000030000-0x0000000000078000-memory.dmp

memory/1836-81-0x000000005FFF0000-0x0000000060000000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\nLOwXkcX.xlsm

MD5 e566fc53051035e1e6fd0ed1823de0f9
SHA1 00bc96c48b98676ecd67e81a6f1d7754e4156044
SHA256 8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512 a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

C:\Users\Admin\AppData\Local\Temp\nLOwXkcX.xlsm

MD5 3b597ab3a0f1afacd07611a05372651e
SHA1 b655c05dfb3f52aede7a6f2f53ce4d3a2d23f89d
SHA256 7d90eb491a16bdc577952de9b635dae01e6cda967699d35febbae30e8f6b35fc
SHA512 80231c7583c61d56f5f14ae1e860255ebf7d82a4b818671ffaec2f3e02a539cbde6f00c92b38580f1a85846185b77d5c9b81084f1d151c1bfbf03dc29065460b

C:\Users\Admin\AppData\Local\Temp\nLOwXkcX.xlsm

MD5 d6e34ab0a9f99a995dd7fa186d5fce9e
SHA1 091eb50ea4488402ad31aee23dba913c098c060a
SHA256 bc43a9a29910655766d46b9951d79403e8f41d890084d4453c0984f93fa4feb5
SHA512 121f9aac95980a1f6bbd3c48eac93e00d4fc65b0784e10ba40db68a3f786cf16144e5479559dbd219688c0eb1b5de61e05e7c024901ad6fe55f76399cc4f1fea

C:\Users\Admin\AppData\Local\Temp\nLOwXkcX.xlsm

MD5 34e773539747b34bbea7f44d2f92d29e
SHA1 841870303ee5416443e9cfbfad7182c3d2d6a7a6
SHA256 20adc4a079b420f9d02fa7db5933b4d04010ac7ed0e914a987860f9ced7bc141
SHA512 69a3c15390452076c01820e03224e4dbeda3aea3abe3a084cb20a9403de27261b09c9c638595e315ab5bdcd87de94a6837f3709191ff2830c6cc22051cfe2e72

memory/2804-146-0x0000000000400000-0x0000000000506000-memory.dmp

memory/2804-147-0x0000000000400000-0x0000000000506000-memory.dmp

memory/1836-148-0x000000005FFF0000-0x0000000060000000-memory.dmp

memory/2804-149-0x0000000000400000-0x0000000000506000-memory.dmp

memory/2804-179-0x0000000000400000-0x0000000000506000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-30 00:20

Reported

2024-10-30 00:23

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe"

Signatures

VIPKeylogger

stealer keylogger vipkeylogger

Vipkeylogger family

vipkeylogger

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation C:\ProgramData\Synaptics\Synaptics.exe N/A

Reads user/profile data of local email clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\._cache_2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\._cache_2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\._cache_2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A checkip.dyndns.org N/A N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\Synaptics\Synaptics.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\._cache_2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\Synaptics\Synaptics.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\ProgramData\Synaptics\Synaptics.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2608 wrote to memory of 4772 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe
PID 2608 wrote to memory of 4772 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe
PID 2608 wrote to memory of 4772 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe
PID 2608 wrote to memory of 4772 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe
PID 2608 wrote to memory of 4772 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe
PID 2608 wrote to memory of 4772 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe
PID 2608 wrote to memory of 4772 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe
PID 2608 wrote to memory of 4772 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe
PID 2608 wrote to memory of 4772 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe
PID 2608 wrote to memory of 4772 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe
PID 2608 wrote to memory of 4772 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe
PID 4772 wrote to memory of 4572 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\._cache_2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe
PID 4772 wrote to memory of 4572 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\._cache_2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe
PID 4772 wrote to memory of 4572 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\._cache_2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe
PID 4772 wrote to memory of 832 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 4772 wrote to memory of 832 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 4772 wrote to memory of 832 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 832 wrote to memory of 64 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 832 wrote to memory of 64 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 832 wrote to memory of 64 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 832 wrote to memory of 64 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 832 wrote to memory of 64 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 832 wrote to memory of 64 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 832 wrote to memory of 64 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 832 wrote to memory of 64 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 832 wrote to memory of 64 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 832 wrote to memory of 64 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 832 wrote to memory of 64 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 64 wrote to memory of 5052 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 64 wrote to memory of 5052 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 64 wrote to memory of 5052 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe

"C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe"

C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe

"C:\Users\Admin\AppData\Local\Temp\2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe"

C:\Users\Admin\AppData\Local\Temp\._cache_2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe

"C:\Users\Admin\AppData\Local\Temp\._cache_2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe"

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe"

C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe

"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE

"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 checkip.dyndns.org udp
DE 193.122.6.168:80 checkip.dyndns.org tcp
US 8.8.8.8:53 reallyfreegeoip.org udp
US 172.67.177.134:443 reallyfreegeoip.org tcp
US 8.8.8.8:53 168.6.122.193.in-addr.arpa udp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 134.177.67.172.in-addr.arpa udp
US 8.8.8.8:53 220.167.154.149.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
DE 193.122.6.168:80 checkip.dyndns.org tcp
US 172.67.177.134:443 reallyfreegeoip.org tcp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 xred.mooo.com udp
US 8.8.8.8:53 freedns.afraid.org udp
US 69.42.215.252:80 freedns.afraid.org tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 252.215.42.69.in-addr.arpa udp
US 8.8.8.8:53 170.117.168.52.in-addr.arpa udp
US 8.8.8.8:53 69.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 69.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 docs.google.com udp
GB 216.58.204.78:443 docs.google.com tcp
US 8.8.8.8:53 c.pki.goog udp
GB 142.250.180.3:80 c.pki.goog tcp
US 8.8.8.8:53 o.pki.goog udp
GB 142.250.180.3:80 o.pki.goog tcp
US 8.8.8.8:53 drive.usercontent.google.com udp
GB 142.250.187.193:443 drive.usercontent.google.com tcp
US 8.8.8.8:53 78.204.58.216.in-addr.arpa udp
US 8.8.8.8:53 3.180.250.142.in-addr.arpa udp
US 8.8.8.8:53 193.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 udp

Files

memory/2608-0-0x0000000074BFE000-0x0000000074BFF000-memory.dmp

memory/2608-1-0x0000000000E40000-0x000000000120A000-memory.dmp

memory/2608-2-0x0000000006120000-0x00000000066C4000-memory.dmp

memory/2608-3-0x0000000005C10000-0x0000000005CA2000-memory.dmp

memory/2608-4-0x0000000005CB0000-0x0000000006004000-memory.dmp

memory/2608-5-0x0000000006060000-0x000000000606A000-memory.dmp

memory/2608-6-0x0000000074BF0000-0x00000000753A0000-memory.dmp

memory/2608-7-0x0000000008D90000-0x0000000008F00000-memory.dmp

memory/2608-8-0x0000000008F20000-0x0000000008F3E000-memory.dmp

memory/2608-9-0x0000000008FE0000-0x000000000907C000-memory.dmp

memory/2608-10-0x0000000074BFE000-0x0000000074BFF000-memory.dmp

memory/2608-11-0x0000000074BF0000-0x00000000753A0000-memory.dmp

memory/2608-12-0x0000000009180000-0x00000000092C8000-memory.dmp

memory/4772-13-0x0000000000400000-0x0000000000506000-memory.dmp

memory/4772-14-0x0000000000400000-0x0000000000506000-memory.dmp

memory/4772-16-0x0000000000400000-0x0000000000506000-memory.dmp

memory/4772-17-0x0000000000400000-0x0000000000506000-memory.dmp

memory/2608-18-0x0000000074BF0000-0x00000000753A0000-memory.dmp

memory/4772-19-0x0000000002E60000-0x0000000002E61000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\._cache_2024-10-29_b38044c85c61344e55c645da14c2c5e9_avoslocker_hijackloader.exe

MD5 5446eaf87fe423755a4611cd0ff939e4
SHA1 c4b2153f43659c6b0ff11527a02b0b0dbfe75b11
SHA256 f7f3df09f0759f03d0d3d114caadac597c767ebfeaba7115d2963c732864daff
SHA512 1b82fc09028091ca718ee02853c0a4a3096ac92f2ba707e181c78cccb8ca717deedda3d7605a704112660575ab0d30f556e8317bbc15940c96265b0da2b4a73c

C:\ProgramData\Synaptics\Synaptics.exe

MD5 b38044c85c61344e55c645da14c2c5e9
SHA1 3c7234f791f2da542d318965f6868b909a4b6c3e
SHA256 20592cd3af7ef4fc50bf5df5ad426ff7ee6094239422ae1eec91467927e7170a
SHA512 ae2a94a1b3be245e9226d39b81301dbc17e82815547343ac7c222f1d2e89038efb160a44699eb13abc41a53ef78b484bb31110a402457d22f931286ab5e927ad

memory/4572-89-0x0000000072B3E000-0x0000000072B3F000-memory.dmp

memory/4572-91-0x0000000000D30000-0x0000000000D78000-memory.dmp

memory/4772-149-0x0000000000400000-0x0000000000506000-memory.dmp

memory/832-150-0x0000000005710000-0x0000000005A64000-memory.dmp

memory/4572-151-0x0000000006C00000-0x0000000006DC2000-memory.dmp

memory/4572-152-0x0000000006A90000-0x0000000006AE0000-memory.dmp

memory/4572-153-0x0000000072B3E000-0x0000000072B3F000-memory.dmp

memory/64-157-0x0000000000400000-0x0000000000506000-memory.dmp

memory/236-219-0x00007FF7F4AB0000-0x00007FF7F4AC0000-memory.dmp

memory/236-218-0x00007FF7F4AB0000-0x00007FF7F4AC0000-memory.dmp

memory/236-220-0x00007FF7F4AB0000-0x00007FF7F4AC0000-memory.dmp

memory/236-221-0x00007FF7F4AB0000-0x00007FF7F4AC0000-memory.dmp

memory/236-222-0x00007FF7F4AB0000-0x00007FF7F4AC0000-memory.dmp

memory/236-223-0x00007FF7F22A0000-0x00007FF7F22B0000-memory.dmp

memory/236-224-0x00007FF7F22A0000-0x00007FF7F22B0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\bRbY6ASw.xlsm

MD5 e566fc53051035e1e6fd0ed1823de0f9
SHA1 00bc96c48b98676ecd67e81a6f1d7754e4156044
SHA256 8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512 a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

C:\Users\Admin\AppData\Local\Temp\D9285E00

MD5 2bf48d3384043857eda5de4fdc25eb4a
SHA1 cafcd9fe121553d8fe0f52572e4c67b34e8954ab
SHA256 1d7c73c860764dda8f0f8e1b68c55ce4571fd6f800e9e28e0057d0cb05a5bcce
SHA512 0ecfa20f64d13527adbb5c46cd9af340e430cf6fc9b51590cc9fdca49341b7363c0663aeb417f29f94bfa72f59fbf082a72c203f315864024cf3dd79fb7ebe9a

memory/64-271-0x0000000000400000-0x0000000000506000-memory.dmp

memory/64-272-0x0000000000400000-0x0000000000506000-memory.dmp

memory/64-273-0x0000000000400000-0x0000000000506000-memory.dmp

memory/64-297-0x0000000000400000-0x0000000000506000-memory.dmp