Malware Analysis Report

2024-11-30 15:01

Sample ID 241031-c1xvdaxfrd
Target 2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader
SHA256 08fd9a22fb21886f26cf8597f8829b34fae7bbed628b9bb2a5dfd7b8031da1e1
Tags
vipkeylogger collection discovery keylogger persistence spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

08fd9a22fb21886f26cf8597f8829b34fae7bbed628b9bb2a5dfd7b8031da1e1

Threat Level: Known bad

The file 2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader was found to be: Known bad.

Malicious Activity Summary

vipkeylogger collection discovery keylogger persistence spyware stealer

VIPKeylogger

Vipkeylogger family

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

Reads user/profile data of web browsers

Reads user/profile data of local email clients

Adds Run key to start application

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Suspicious use of SetThreadContext

Enumerates physical storage devices

Browser Information Discovery

System Location Discovery: System Language Discovery

Unsigned PE

outlook_win_path

Enumerates system info in registry

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: EnumeratesProcesses

outlook_office_path

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

Modifies registry class

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-31 02:33

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-31 02:33

Reported

2024-10-31 02:36

Platform

win7-20241023-en

Max time kernel

123s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe"

Signatures

VIPKeylogger

stealer keylogger vipkeylogger

Vipkeylogger family

vipkeylogger

Reads user/profile data of local email clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\._cache_2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\._cache_2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\._cache_2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" C:\Users\Admin\AppData\Local\Temp\2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A checkip.dyndns.org N/A N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\._cache_2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\Synaptics\Synaptics.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\Synaptics\Synaptics.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1888 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe
PID 1888 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe
PID 1888 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe
PID 1888 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe
PID 1888 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe
PID 1888 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe
PID 1888 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe
PID 1888 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe
PID 1888 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe
PID 1888 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe
PID 1888 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe
PID 1888 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe
PID 1656 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\._cache_2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe
PID 1656 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\._cache_2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe
PID 1656 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\._cache_2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe
PID 1656 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\._cache_2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe
PID 1656 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 1656 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 1656 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 1656 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2716 wrote to memory of 2964 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2716 wrote to memory of 2964 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2716 wrote to memory of 2964 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2716 wrote to memory of 2964 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2716 wrote to memory of 2964 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2716 wrote to memory of 2964 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2716 wrote to memory of 2964 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2716 wrote to memory of 2964 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2716 wrote to memory of 2964 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2716 wrote to memory of 2964 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2716 wrote to memory of 2964 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2716 wrote to memory of 2964 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2964 wrote to memory of 2560 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 2964 wrote to memory of 2560 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 2964 wrote to memory of 2560 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 2964 wrote to memory of 2560 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe

"C:\Users\Admin\AppData\Local\Temp\2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe"

C:\Users\Admin\AppData\Local\Temp\2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe

"C:\Users\Admin\AppData\Local\Temp\2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe"

C:\Users\Admin\AppData\Local\Temp\._cache_2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe

"C:\Users\Admin\AppData\Local\Temp\._cache_2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe"

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe"

C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe

"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 checkip.dyndns.org udp
JP 132.226.8.169:80 checkip.dyndns.org tcp
US 8.8.8.8:53 reallyfreegeoip.org udp
US 104.21.67.152:443 reallyfreegeoip.org tcp
JP 132.226.8.169:80 checkip.dyndns.org tcp
US 8.8.8.8:53 xred.mooo.com udp
US 104.21.67.152:443 reallyfreegeoip.org tcp
US 8.8.8.8:53 freedns.afraid.org udp
US 69.42.215.252:80 freedns.afraid.org tcp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 docs.google.com udp
GB 216.58.204.78:443 docs.google.com tcp
US 8.8.8.8:53 c.pki.goog udp
GB 142.250.180.3:80 c.pki.goog tcp
US 8.8.8.8:53 o.pki.goog udp
GB 142.250.180.3:80 o.pki.goog tcp
US 8.8.8.8:53 drive.usercontent.google.com udp
GB 142.250.187.193:443 drive.usercontent.google.com tcp

Files

memory/1888-0-0x00000000748AE000-0x00000000748AF000-memory.dmp

memory/1888-1-0x00000000009B0000-0x0000000000F04000-memory.dmp

memory/1888-2-0x00000000748A0000-0x0000000074F8E000-memory.dmp

memory/1888-3-0x0000000006000000-0x0000000006170000-memory.dmp

memory/1888-4-0x0000000002340000-0x000000000235E000-memory.dmp

memory/1888-5-0x00000000748AE000-0x00000000748AF000-memory.dmp

memory/1888-6-0x00000000748A0000-0x0000000074F8E000-memory.dmp

memory/1888-7-0x000000000AEB0000-0x000000000AFF8000-memory.dmp

memory/1656-8-0x0000000000400000-0x0000000000506000-memory.dmp

memory/1656-21-0x0000000000400000-0x0000000000506000-memory.dmp

memory/1656-20-0x0000000000400000-0x0000000000506000-memory.dmp

memory/1656-23-0x0000000000180000-0x0000000000181000-memory.dmp

memory/1656-22-0x0000000000400000-0x0000000000506000-memory.dmp

memory/1656-19-0x0000000000400000-0x0000000000506000-memory.dmp

memory/1656-17-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/1888-26-0x00000000748A0000-0x0000000074F8E000-memory.dmp

memory/1656-16-0x0000000000400000-0x0000000000506000-memory.dmp

memory/1656-15-0x0000000000400000-0x0000000000506000-memory.dmp

memory/1656-13-0x0000000000400000-0x0000000000506000-memory.dmp

memory/1656-12-0x0000000000400000-0x0000000000506000-memory.dmp

memory/1656-10-0x0000000000400000-0x0000000000506000-memory.dmp

memory/1656-14-0x0000000000400000-0x0000000000506000-memory.dmp

\Users\Admin\AppData\Local\Temp\._cache_2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe

MD5 5446eaf87fe423755a4611cd0ff939e4
SHA1 c4b2153f43659c6b0ff11527a02b0b0dbfe75b11
SHA256 f7f3df09f0759f03d0d3d114caadac597c767ebfeaba7115d2963c732864daff
SHA512 1b82fc09028091ca718ee02853c0a4a3096ac92f2ba707e181c78cccb8ca717deedda3d7605a704112660575ab0d30f556e8317bbc15940c96265b0da2b4a73c

C:\ProgramData\Synaptics\Synaptics.exe

MD5 e3ad35df252b86660806a6847e9837ba
SHA1 c26298636e80922253c0b6e9cac184ddfe757410
SHA256 08fd9a22fb21886f26cf8597f8829b34fae7bbed628b9bb2a5dfd7b8031da1e1
SHA512 b21f78c48f05bda72e0e54db89b9434a851cdd74cea23d94597145c0a28726e19547b299359b992e82a3a7f892dfd58774dbdcfee0c5f782c1047b877064145c

memory/2912-42-0x0000000000260000-0x00000000002A8000-memory.dmp

memory/1656-47-0x0000000000400000-0x0000000000506000-memory.dmp

memory/2716-50-0x0000000000E70000-0x00000000013C4000-memory.dmp

memory/2964-65-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2964-68-0x0000000000400000-0x0000000000506000-memory.dmp

memory/2560-78-0x0000000000FF0000-0x0000000001038000-memory.dmp

memory/2752-79-0x000000005FFF0000-0x0000000060000000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\BjyTRJLI.xlsm

MD5 e566fc53051035e1e6fd0ed1823de0f9
SHA1 00bc96c48b98676ecd67e81a6f1d7754e4156044
SHA256 8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512 a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

C:\Users\Admin\AppData\Local\Temp\BjyTRJLI.xlsm

MD5 04b72b98881457b6edb75de5184d6092
SHA1 4ba8c91a124b4b0e47bf4a77fcb6a3c32883f598
SHA256 399c56076d2411cd2c433e6cd944e57eca5bc755da49b06f6647443b774b672d
SHA512 ac3335bbb72ef63d20e77036815603644dde86f780d11159490618703416ab7359698d9da0400d7b73355310bf27e0e41ada33cff211d9aada8acf2fb3782a0b

C:\Users\Admin\AppData\Local\Temp\BjyTRJLI.xlsm

MD5 5bdf504e401b97936a46aba5780680fb
SHA1 27782b17b16beeb8a121c3b29211473b6e09c5d3
SHA256 8d258f1318a458679d466eebb7de64c6a6d712beb656566cb9bc450667f33e21
SHA512 f0792ebbd5a2c4db075eb21ae6b05286e248818b95e0016f3aa6b6f5f04ba89be8cee033291522d4226213dce3f7b336119ca48510be1745814562f1bd3f32d2

C:\Users\Admin\AppData\Local\Temp\BjyTRJLI.xlsm

MD5 8207963fb37a2f9f25a6aa18c8e0d43b
SHA1 20b3e1d69d0a8c970f276cb6e025123400aeb296
SHA256 4b0742632b7e09843ac9dc26cf21068d6cd598f51d9e938ebee6fad5bca2df06
SHA512 a124e9d7e61022e0ba35c0a062cc7de3378c7d3eff91893bdf8664ac92945639838fde4591a11e29517cdec69dd524037e6926f6b2452d38889ba5cacb149c7c

C:\Users\Admin\AppData\Local\Temp\BjyTRJLI.xlsm

MD5 5a696de395adcc9bb7c92d0a56c97463
SHA1 7bfbfdf6443ff7fdf3c118d6b3f78e007bf7d43a
SHA256 a8f7ab5f329ec76d9370696de1974431c1558cf71cc4d3c20a1f333a154a5136
SHA512 d99d1eceae50396d5b512b88c5d6d1a5023825fabdc1bbb57c4acb26e043341d65fdb0442a957e841270560d678bf6d7630102e428f52cda1a7382563052a281

C:\Users\Admin\Desktop\~$OpenBackup.xlsx

MD5 ff09371174f7c701e75f357a187c06e8
SHA1 57f9a638fd652922d7eb23236c80055a91724503
SHA256 e4ba04959837c27019a2349015543802439e152ddc4baf4e8c7b9d2b483362a8
SHA512 e4d01e5908e9f80b7732473ec6807bb7faa5425e3154d5642350f44d7220af3cffd277e0b67bcf03f1433ac26a26edb3ddd3707715b61d054b979fbb4b453882

C:\Users\Admin\AppData\Local\Temp\BjyTRJLI.xlsm

MD5 1415d3f9f7d484b4ae3f13118f60b7c3
SHA1 bdf4644e69c692f0c8545671094f742d092d786a
SHA256 a2874277809d71405e1ff02830024ebf0b83df5d6ff04d3ec698d95b05452adb
SHA512 fcdce0f7c29be2997be6605192bdee35c5ee46fc07218057201d81525f71ada8f4aa50abe482c1522c579864e59e496154d8bec6a9d83c7e25363b41b4c73f41

memory/2964-166-0x0000000000400000-0x0000000000506000-memory.dmp

memory/2964-167-0x0000000000400000-0x0000000000506000-memory.dmp

memory/2752-168-0x000000005FFF0000-0x0000000060000000-memory.dmp

memory/2964-169-0x0000000000400000-0x0000000000506000-memory.dmp

memory/2964-197-0x0000000000400000-0x0000000000506000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-31 02:33

Reported

2024-10-31 02:36

Platform

win10v2004-20241007-en

Max time kernel

134s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe"

Signatures

VIPKeylogger

stealer keylogger vipkeylogger

Vipkeylogger family

vipkeylogger

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation C:\ProgramData\Synaptics\Synaptics.exe N/A

Reads user/profile data of local email clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\._cache_2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\._cache_2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\._cache_2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" C:\Users\Admin\AppData\Local\Temp\2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A checkip.dyndns.org N/A N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\._cache_2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\Synaptics\Synaptics.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\Synaptics\Synaptics.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Users\Admin\AppData\Local\Temp\2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\ProgramData\Synaptics\Synaptics.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1164 wrote to memory of 3592 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe
PID 1164 wrote to memory of 3592 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe
PID 1164 wrote to memory of 3592 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe
PID 1164 wrote to memory of 3592 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe
PID 1164 wrote to memory of 3592 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe
PID 1164 wrote to memory of 3592 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe
PID 1164 wrote to memory of 3592 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe
PID 1164 wrote to memory of 3592 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe
PID 1164 wrote to memory of 3592 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe
PID 1164 wrote to memory of 3592 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe
PID 1164 wrote to memory of 3592 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe
PID 3592 wrote to memory of 3872 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\._cache_2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe
PID 3592 wrote to memory of 3872 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\._cache_2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe
PID 3592 wrote to memory of 3872 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\._cache_2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe
PID 3592 wrote to memory of 1572 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 3592 wrote to memory of 1572 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 3592 wrote to memory of 1572 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 1572 wrote to memory of 4408 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 1572 wrote to memory of 4408 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 1572 wrote to memory of 4408 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 1572 wrote to memory of 4408 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 1572 wrote to memory of 4408 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 1572 wrote to memory of 4408 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 1572 wrote to memory of 4408 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 1572 wrote to memory of 4408 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 1572 wrote to memory of 4408 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 1572 wrote to memory of 4408 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 1572 wrote to memory of 4408 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 4408 wrote to memory of 4980 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 4408 wrote to memory of 4980 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 4408 wrote to memory of 4980 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe

"C:\Users\Admin\AppData\Local\Temp\2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe"

C:\Users\Admin\AppData\Local\Temp\2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe

"C:\Users\Admin\AppData\Local\Temp\2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe"

C:\Users\Admin\AppData\Local\Temp\._cache_2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe

"C:\Users\Admin\AppData\Local\Temp\._cache_2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe"

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe"

C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe

"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 checkip.dyndns.org udp
DE 193.122.6.168:80 checkip.dyndns.org tcp
US 8.8.8.8:53 reallyfreegeoip.org udp
US 8.8.8.8:53 168.6.122.193.in-addr.arpa udp
US 172.67.177.134:443 reallyfreegeoip.org tcp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 134.177.67.172.in-addr.arpa udp
US 8.8.8.8:53 220.167.154.149.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
DE 193.122.6.168:80 checkip.dyndns.org tcp
US 172.67.177.134:443 reallyfreegeoip.org tcp
US 8.8.8.8:53 xred.mooo.com udp
US 8.8.8.8:53 freedns.afraid.org udp
US 69.42.215.252:80 freedns.afraid.org tcp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
NL 149.154.167.220:443 api.telegram.org tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 73.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 252.215.42.69.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 docs.google.com udp
GB 216.58.204.78:443 docs.google.com tcp
US 8.8.8.8:53 c.pki.goog udp
GB 142.250.180.3:80 c.pki.goog tcp
US 8.8.8.8:53 o.pki.goog udp
GB 142.250.180.3:80 o.pki.goog tcp
US 8.8.8.8:53 drive.usercontent.google.com udp
GB 142.250.187.193:443 drive.usercontent.google.com tcp
US 8.8.8.8:53 78.204.58.216.in-addr.arpa udp
US 8.8.8.8:53 3.180.250.142.in-addr.arpa udp
US 8.8.8.8:53 193.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp

Files

memory/1164-0-0x00000000752CE000-0x00000000752CF000-memory.dmp

memory/1164-1-0x00000000004A0000-0x00000000009F4000-memory.dmp

memory/1164-2-0x00000000059A0000-0x0000000005F44000-memory.dmp

memory/1164-3-0x00000000053F0000-0x0000000005482000-memory.dmp

memory/1164-4-0x0000000005490000-0x00000000057E4000-memory.dmp

memory/1164-5-0x0000000005950000-0x000000000595A000-memory.dmp

memory/1164-6-0x00000000752C0000-0x0000000075A70000-memory.dmp

memory/1164-7-0x0000000008580000-0x00000000086F0000-memory.dmp

memory/1164-8-0x0000000008710000-0x000000000872E000-memory.dmp

memory/1164-9-0x00000000087D0000-0x000000000886C000-memory.dmp

memory/1164-10-0x00000000752CE000-0x00000000752CF000-memory.dmp

memory/1164-11-0x00000000752C0000-0x0000000075A70000-memory.dmp

memory/1164-12-0x0000000008970000-0x0000000008AB8000-memory.dmp

memory/3592-13-0x0000000000400000-0x0000000000506000-memory.dmp

memory/3592-14-0x0000000000400000-0x0000000000506000-memory.dmp

memory/3592-16-0x0000000000400000-0x0000000000506000-memory.dmp

memory/3592-17-0x0000000000400000-0x0000000000506000-memory.dmp

memory/1164-18-0x00000000752C0000-0x0000000075A70000-memory.dmp

memory/3592-19-0x0000000001A90000-0x0000000001A91000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\._cache_2024-10-31_e3ad35df252b86660806a6847e9837ba_avoslocker_hijackloader.exe

MD5 5446eaf87fe423755a4611cd0ff939e4
SHA1 c4b2153f43659c6b0ff11527a02b0b0dbfe75b11
SHA256 f7f3df09f0759f03d0d3d114caadac597c767ebfeaba7115d2963c732864daff
SHA512 1b82fc09028091ca718ee02853c0a4a3096ac92f2ba707e181c78cccb8ca717deedda3d7605a704112660575ab0d30f556e8317bbc15940c96265b0da2b4a73c

C:\ProgramData\Synaptics\Synaptics.exe

MD5 e3ad35df252b86660806a6847e9837ba
SHA1 c26298636e80922253c0b6e9cac184ddfe757410
SHA256 08fd9a22fb21886f26cf8597f8829b34fae7bbed628b9bb2a5dfd7b8031da1e1
SHA512 b21f78c48f05bda72e0e54db89b9434a851cdd74cea23d94597145c0a28726e19547b299359b992e82a3a7f892dfd58774dbdcfee0c5f782c1047b877064145c

memory/3872-90-0x000000007320E000-0x000000007320F000-memory.dmp

memory/3872-100-0x0000000000630000-0x0000000000678000-memory.dmp

memory/3592-149-0x0000000000400000-0x0000000000506000-memory.dmp

memory/1572-150-0x0000000005740000-0x0000000005A94000-memory.dmp

memory/3872-151-0x0000000006520000-0x00000000066E2000-memory.dmp

memory/3872-152-0x00000000063A0000-0x00000000063F0000-memory.dmp

memory/3872-153-0x000000007320E000-0x000000007320F000-memory.dmp

memory/4408-157-0x0000000000400000-0x0000000000506000-memory.dmp

memory/4408-219-0x0000000000400000-0x0000000000506000-memory.dmp

memory/4408-218-0x0000000000400000-0x0000000000506000-memory.dmp

memory/4408-220-0x0000000000400000-0x0000000000506000-memory.dmp

memory/4408-240-0x0000000000400000-0x0000000000506000-memory.dmp