Malware Analysis Report

2024-11-30 14:57

Sample ID 241031-x4dacs1lbv
Target 2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader
SHA256 a899e62a8c7ba50eee558ea74ab735499ba057304714ec26d02dcc14adfb3148
Tags
discovery vipkeylogger collection keylogger persistence spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a899e62a8c7ba50eee558ea74ab735499ba057304714ec26d02dcc14adfb3148

Threat Level: Known bad

The file 2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader was found to be: Known bad.

Malicious Activity Summary

discovery vipkeylogger collection keylogger persistence spyware stealer

VIPKeylogger

Vipkeylogger family

Reads user/profile data of web browsers

Checks computer location settings

Reads user/profile data of local email clients

Executes dropped EXE

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Adds Run key to start application

Suspicious use of SetThreadContext

Unsigned PE

Browser Information Discovery

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Enumerates system info in registry

Suspicious use of WriteProcessMemory

Checks processor information in registry

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

outlook_win_path

Modifies registry class

Suspicious use of SetWindowsHookEx

Suspicious behavior: AddClipboardFormatListener

outlook_office_path

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-31 19:24

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-31 19:24

Reported

2024-10-31 19:26

Platform

win7-20240708-en

Max time kernel

121s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe"

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2272 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe
PID 2272 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe
PID 2272 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe
PID 2272 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe
PID 2272 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe
PID 2272 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe
PID 2272 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe
PID 2272 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe
PID 2272 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe
PID 2272 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe
PID 2272 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe
PID 2272 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe
PID 2272 wrote to memory of 2128 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe
PID 2272 wrote to memory of 2128 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe
PID 2272 wrote to memory of 2128 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe
PID 2272 wrote to memory of 2128 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe
PID 2272 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe
PID 2272 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe
PID 2272 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe
PID 2272 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe

"C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe"

C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe

"C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe"

C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe

"C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe"

C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe

"C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe"

C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe

"C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe"

C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe

"C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe"

Network

N/A

Files

memory/2272-0-0x00000000741EE000-0x00000000741EF000-memory.dmp

memory/2272-1-0x00000000000B0000-0x0000000000790000-memory.dmp

memory/2272-2-0x00000000741E0000-0x00000000748CE000-memory.dmp

memory/2272-3-0x00000000061F0000-0x0000000006360000-memory.dmp

memory/2272-4-0x0000000000BA0000-0x0000000000BBE000-memory.dmp

memory/2272-5-0x00000000741EE000-0x00000000741EF000-memory.dmp

memory/2272-6-0x00000000741E0000-0x00000000748CE000-memory.dmp

memory/2272-7-0x000000000B250000-0x000000000B398000-memory.dmp

memory/2272-8-0x00000000741E0000-0x00000000748CE000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-31 19:24

Reported

2024-10-31 19:26

Platform

win10v2004-20241007-en

Max time kernel

139s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe"

Signatures

VIPKeylogger

stealer keylogger vipkeylogger

Vipkeylogger family

vipkeylogger

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation C:\ProgramData\Synaptics\Synaptics.exe N/A

Reads user/profile data of local email clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\._cache_2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\._cache_2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\._cache_2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A checkip.dyndns.org N/A N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\._cache_2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\Synaptics\Synaptics.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\Synaptics\Synaptics.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\ProgramData\Synaptics\Synaptics.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 436 wrote to memory of 1896 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe
PID 436 wrote to memory of 1896 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe
PID 436 wrote to memory of 1896 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe
PID 436 wrote to memory of 1896 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe
PID 436 wrote to memory of 1896 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe
PID 436 wrote to memory of 1896 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe
PID 436 wrote to memory of 1896 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe
PID 436 wrote to memory of 1896 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe
PID 436 wrote to memory of 1896 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe
PID 436 wrote to memory of 1896 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe
PID 436 wrote to memory of 1896 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe
PID 1896 wrote to memory of 4848 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\._cache_2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe
PID 1896 wrote to memory of 4848 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\._cache_2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe
PID 1896 wrote to memory of 4848 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\._cache_2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe
PID 1896 wrote to memory of 5000 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 1896 wrote to memory of 5000 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 1896 wrote to memory of 5000 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 5000 wrote to memory of 716 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 5000 wrote to memory of 716 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 5000 wrote to memory of 716 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 5000 wrote to memory of 2360 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 5000 wrote to memory of 2360 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 5000 wrote to memory of 2360 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 5000 wrote to memory of 2360 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 5000 wrote to memory of 2360 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 5000 wrote to memory of 2360 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 5000 wrote to memory of 2360 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 5000 wrote to memory of 2360 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 5000 wrote to memory of 2360 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 5000 wrote to memory of 2360 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 5000 wrote to memory of 2360 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2360 wrote to memory of 2580 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 2360 wrote to memory of 2580 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 2360 wrote to memory of 2580 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe

"C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe"

C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe

"C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe"

C:\Users\Admin\AppData\Local\Temp\._cache_2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe

"C:\Users\Admin\AppData\Local\Temp\._cache_2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe"

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe"

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe"

C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe

"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE

"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
US 8.8.8.8:53 23.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 70.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 checkip.dyndns.org udp
US 193.122.130.0:80 checkip.dyndns.org tcp
US 8.8.8.8:53 0.130.122.193.in-addr.arpa udp
US 8.8.8.8:53 reallyfreegeoip.org udp
US 104.21.67.152:443 reallyfreegeoip.org tcp
US 8.8.8.8:53 152.67.21.104.in-addr.arpa udp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 220.167.154.149.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 193.122.130.0:80 checkip.dyndns.org tcp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 104.21.67.152:443 reallyfreegeoip.org tcp
US 8.8.8.8:53 240.76.109.52.in-addr.arpa udp
US 8.8.8.8:53 xred.mooo.com udp
US 8.8.8.8:53 freedns.afraid.org udp
US 69.42.215.252:80 freedns.afraid.org tcp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 252.215.42.69.in-addr.arpa udp
US 8.8.8.8:53 104.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 9.179.89.13.in-addr.arpa udp
US 8.8.8.8:53 100.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 docs.google.com udp
GB 172.217.169.78:443 docs.google.com tcp
US 8.8.8.8:53 c.pki.goog udp
GB 142.250.187.227:80 c.pki.goog tcp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 78.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 227.187.250.142.in-addr.arpa udp
GB 142.250.187.227:80 o.pki.goog tcp
US 8.8.8.8:53 drive.usercontent.google.com udp
GB 172.217.16.225:443 drive.usercontent.google.com tcp
US 8.8.8.8:53 225.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp

Files

memory/436-0-0x00000000745DE000-0x00000000745DF000-memory.dmp

memory/436-1-0x0000000000EA0000-0x0000000001580000-memory.dmp

memory/436-2-0x00000000064B0000-0x0000000006A54000-memory.dmp

memory/436-3-0x0000000005F00000-0x0000000005F92000-memory.dmp

memory/436-4-0x0000000005FA0000-0x00000000062F4000-memory.dmp

memory/436-5-0x0000000005E80000-0x0000000005E8A000-memory.dmp

memory/436-6-0x00000000745D0000-0x0000000074D80000-memory.dmp

memory/436-7-0x0000000008FC0000-0x0000000009130000-memory.dmp

memory/436-8-0x0000000009150000-0x000000000916E000-memory.dmp

memory/436-9-0x0000000009210000-0x00000000092AC000-memory.dmp

memory/436-10-0x00000000745DE000-0x00000000745DF000-memory.dmp

memory/436-11-0x00000000745D0000-0x0000000074D80000-memory.dmp

memory/436-12-0x00000000093B0000-0x00000000094F8000-memory.dmp

memory/1896-14-0x0000000000400000-0x0000000000506000-memory.dmp

memory/1896-13-0x0000000000400000-0x0000000000506000-memory.dmp

memory/1896-16-0x0000000000400000-0x0000000000506000-memory.dmp

memory/1896-17-0x0000000000400000-0x0000000000506000-memory.dmp

memory/1896-18-0x0000000001B80000-0x0000000001B81000-memory.dmp

memory/436-19-0x00000000745D0000-0x0000000074D80000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\._cache_2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe

MD5 5446eaf87fe423755a4611cd0ff939e4
SHA1 c4b2153f43659c6b0ff11527a02b0b0dbfe75b11
SHA256 f7f3df09f0759f03d0d3d114caadac597c767ebfeaba7115d2963c732864daff
SHA512 1b82fc09028091ca718ee02853c0a4a3096ac92f2ba707e181c78cccb8ca717deedda3d7605a704112660575ab0d30f556e8317bbc15940c96265b0da2b4a73c

C:\ProgramData\Synaptics\Synaptics.exe

MD5 8d62e700b688c2cd65741c96363fe1e8
SHA1 a2051f1f358c874a603ff25f0fad8f62c08b4595
SHA256 a899e62a8c7ba50eee558ea74ab735499ba057304714ec26d02dcc14adfb3148
SHA512 675a2fbd71ec7203b33fb454cf9b347db8f2adced9de2b4a932013f39f3062674b8d2ec739aa1587f2f457e07085588a776ad9a9880d5d77d3387460ca1e58da

memory/4848-90-0x000000007315E000-0x000000007315F000-memory.dmp

memory/4848-91-0x0000000000900000-0x0000000000948000-memory.dmp

memory/4848-146-0x0000000073150000-0x0000000073900000-memory.dmp

memory/1896-150-0x0000000000400000-0x0000000000506000-memory.dmp

memory/5000-151-0x0000000005FA0000-0x00000000062F4000-memory.dmp

memory/4848-152-0x0000000006810000-0x00000000069D2000-memory.dmp

memory/4848-153-0x0000000006690000-0x00000000066E0000-memory.dmp

memory/4848-154-0x000000007315E000-0x000000007315F000-memory.dmp

memory/4848-155-0x0000000073150000-0x0000000073900000-memory.dmp

memory/2360-160-0x0000000000400000-0x0000000000506000-memory.dmp

memory/1288-222-0x00007FFC50FD0000-0x00007FFC50FE0000-memory.dmp

memory/1288-221-0x00007FFC50FD0000-0x00007FFC50FE0000-memory.dmp

memory/1288-223-0x00007FFC50FD0000-0x00007FFC50FE0000-memory.dmp

memory/1288-224-0x00007FFC50FD0000-0x00007FFC50FE0000-memory.dmp

memory/1288-225-0x00007FFC50FD0000-0x00007FFC50FE0000-memory.dmp

memory/1288-226-0x00007FFC4EF70000-0x00007FFC4EF80000-memory.dmp

memory/1288-227-0x00007FFC4EF70000-0x00007FFC4EF80000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\UvbZiyXP.xlsm

MD5 e566fc53051035e1e6fd0ed1823de0f9
SHA1 00bc96c48b98676ecd67e81a6f1d7754e4156044
SHA256 8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512 a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

C:\Users\Admin\AppData\Local\Temp\11F75E00

MD5 71fbe8f31de15571b89095c160e86228
SHA1 e42989ffcf4769a574b8c4a36f3bffa6579d3018
SHA256 d5546c1adbdf5046a36f4fb3339f017838c889112e56872444c29f505005bcce
SHA512 f62ea3c0886bbd61670c696005967e384f14900d35aaf6d628d69621014eeb2517ca01d8a4805d6f270b52d499c316b2cb2b6f55c8fa7400be986fc426b1901b

memory/2360-271-0x0000000000400000-0x0000000000506000-memory.dmp

memory/2360-272-0x0000000000400000-0x0000000000506000-memory.dmp

memory/2360-276-0x0000000000400000-0x0000000000506000-memory.dmp

memory/2360-300-0x0000000000400000-0x0000000000506000-memory.dmp