Malware Analysis Report

2024-11-30 14:56

Sample ID 241031-ybxzqs1lg1
Target 2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader
SHA256 a899e62a8c7ba50eee558ea74ab735499ba057304714ec26d02dcc14adfb3148
Tags
vipkeylogger collection discovery keylogger persistence spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a899e62a8c7ba50eee558ea74ab735499ba057304714ec26d02dcc14adfb3148

Threat Level: Known bad

The file 2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader was found to be: Known bad.

Malicious Activity Summary

vipkeylogger collection discovery keylogger persistence spyware stealer

Vipkeylogger family

VIPKeylogger

Executes dropped EXE

Reads user/profile data of local email clients

Checks computer location settings

Reads user/profile data of web browsers

Loads dropped DLL

Looks up external IP address via web service

Adds Run key to start application

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

Unsigned PE

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Browser Information Discovery

outlook_win_path

Checks processor information in registry

outlook_office_path

Modifies registry class

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: AddClipboardFormatListener

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-31 19:37

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-31 19:37

Reported

2024-10-31 19:39

Platform

win10v2004-20241007-en

Max time kernel

135s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe"

Signatures

VIPKeylogger

stealer keylogger vipkeylogger

Vipkeylogger family

vipkeylogger

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation C:\ProgramData\Synaptics\Synaptics.exe N/A

Reads user/profile data of local email clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\._cache_2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\._cache_2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\._cache_2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A checkip.dyndns.org N/A N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\Synaptics\Synaptics.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\._cache_2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\Synaptics\Synaptics.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\ProgramData\Synaptics\Synaptics.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2156 wrote to memory of 4396 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe
PID 2156 wrote to memory of 4396 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe
PID 2156 wrote to memory of 4396 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe
PID 2156 wrote to memory of 4396 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe
PID 2156 wrote to memory of 4396 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe
PID 2156 wrote to memory of 4396 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe
PID 2156 wrote to memory of 4396 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe
PID 2156 wrote to memory of 4396 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe
PID 2156 wrote to memory of 4396 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe
PID 2156 wrote to memory of 4396 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe
PID 2156 wrote to memory of 4396 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe
PID 4396 wrote to memory of 224 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\._cache_2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe
PID 4396 wrote to memory of 224 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\._cache_2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe
PID 4396 wrote to memory of 224 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\._cache_2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe
PID 4396 wrote to memory of 5024 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 4396 wrote to memory of 5024 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 4396 wrote to memory of 5024 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 5024 wrote to memory of 1144 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 5024 wrote to memory of 1144 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 5024 wrote to memory of 1144 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 5024 wrote to memory of 1144 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 5024 wrote to memory of 1144 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 5024 wrote to memory of 1144 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 5024 wrote to memory of 1144 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 5024 wrote to memory of 1144 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 5024 wrote to memory of 1144 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 5024 wrote to memory of 1144 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 5024 wrote to memory of 1144 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 1144 wrote to memory of 2308 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 1144 wrote to memory of 2308 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 1144 wrote to memory of 2308 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe

"C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe"

C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe

"C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe"

C:\Users\Admin\AppData\Local\Temp\._cache_2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe

"C:\Users\Admin\AppData\Local\Temp\._cache_2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe"

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe"

C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe

"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE

"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 150.171.27.10:443 g.bing.com tcp
US 8.8.8.8:53 140.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp
US 8.8.8.8:53 checkip.dyndns.org udp
DE 193.122.6.168:80 checkip.dyndns.org tcp
US 8.8.8.8:53 reallyfreegeoip.org udp
US 104.21.67.152:443 reallyfreegeoip.org tcp
US 8.8.8.8:53 168.6.122.193.in-addr.arpa udp
US 8.8.8.8:53 152.67.21.104.in-addr.arpa udp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 220.167.154.149.in-addr.arpa udp
DE 193.122.6.168:80 checkip.dyndns.org tcp
US 104.21.67.152:443 reallyfreegeoip.org tcp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 xred.mooo.com udp
US 8.8.8.8:53 freedns.afraid.org udp
US 69.42.215.252:80 freedns.afraid.org tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 252.215.42.69.in-addr.arpa udp
US 8.8.8.8:53 58.189.79.40.in-addr.arpa udp
US 8.8.8.8:53 69.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 docs.google.com udp
GB 172.217.169.78:443 docs.google.com tcp
US 8.8.8.8:53 c.pki.goog udp
GB 142.250.187.195:80 c.pki.goog tcp
US 8.8.8.8:53 o.pki.goog udp
GB 142.250.187.227:80 o.pki.goog tcp
US 8.8.8.8:53 drive.usercontent.google.com udp
US 8.8.8.8:53 78.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 227.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 195.187.250.142.in-addr.arpa udp
GB 172.217.16.225:443 drive.usercontent.google.com tcp
US 8.8.8.8:53 225.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp

Files

memory/2156-0-0x0000000074DCE000-0x0000000074DCF000-memory.dmp

memory/2156-1-0x0000000000660000-0x0000000000D40000-memory.dmp

memory/2156-2-0x0000000005D50000-0x00000000062F4000-memory.dmp

memory/2156-3-0x00000000057A0000-0x0000000005832000-memory.dmp

memory/2156-4-0x0000000005840000-0x0000000005B94000-memory.dmp

memory/2156-5-0x0000000074DC0000-0x0000000075570000-memory.dmp

memory/2156-6-0x0000000005780000-0x000000000578A000-memory.dmp

memory/2156-7-0x00000000070D0000-0x0000000007240000-memory.dmp

memory/2156-8-0x0000000007260000-0x000000000727E000-memory.dmp

memory/2156-9-0x00000000087F0000-0x000000000888C000-memory.dmp

memory/2156-10-0x0000000074DCE000-0x0000000074DCF000-memory.dmp

memory/2156-11-0x0000000074DC0000-0x0000000075570000-memory.dmp

memory/2156-12-0x0000000008990000-0x0000000008AD8000-memory.dmp

memory/4396-14-0x0000000000400000-0x0000000000506000-memory.dmp

memory/4396-13-0x0000000000400000-0x0000000000506000-memory.dmp

memory/4396-15-0x0000000000400000-0x0000000000506000-memory.dmp

memory/4396-17-0x0000000000400000-0x0000000000506000-memory.dmp

memory/4396-18-0x0000000002ED0000-0x0000000002ED1000-memory.dmp

memory/2156-21-0x0000000074DC0000-0x0000000075570000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\._cache_2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe

MD5 5446eaf87fe423755a4611cd0ff939e4
SHA1 c4b2153f43659c6b0ff11527a02b0b0dbfe75b11
SHA256 f7f3df09f0759f03d0d3d114caadac597c767ebfeaba7115d2963c732864daff
SHA512 1b82fc09028091ca718ee02853c0a4a3096ac92f2ba707e181c78cccb8ca717deedda3d7605a704112660575ab0d30f556e8317bbc15940c96265b0da2b4a73c

C:\ProgramData\Synaptics\Synaptics.exe

MD5 8d62e700b688c2cd65741c96363fe1e8
SHA1 a2051f1f358c874a603ff25f0fad8f62c08b4595
SHA256 a899e62a8c7ba50eee558ea74ab735499ba057304714ec26d02dcc14adfb3148
SHA512 675a2fbd71ec7203b33fb454cf9b347db8f2adced9de2b4a932013f39f3062674b8d2ec739aa1587f2f457e07085588a776ad9a9880d5d77d3387460ca1e58da

memory/224-89-0x0000000073BAE000-0x0000000073BAF000-memory.dmp

memory/224-90-0x0000000000E80000-0x0000000000EC8000-memory.dmp

memory/224-146-0x0000000073BA0000-0x0000000074350000-memory.dmp

memory/4396-150-0x0000000000400000-0x0000000000506000-memory.dmp

memory/5024-151-0x0000000005740000-0x0000000005A94000-memory.dmp

memory/224-152-0x0000000006D90000-0x0000000006F52000-memory.dmp

memory/224-153-0x0000000006C10000-0x0000000006C60000-memory.dmp

memory/224-154-0x0000000073BAE000-0x0000000073BAF000-memory.dmp

memory/224-155-0x0000000073BA0000-0x0000000074350000-memory.dmp

memory/1144-158-0x0000000000400000-0x0000000000506000-memory.dmp

memory/512-222-0x00007FF7FCEF0000-0x00007FF7FCF00000-memory.dmp

memory/512-221-0x00007FF7FCEF0000-0x00007FF7FCF00000-memory.dmp

memory/512-220-0x00007FF7FCEF0000-0x00007FF7FCF00000-memory.dmp

memory/512-223-0x00007FF7FCEF0000-0x00007FF7FCF00000-memory.dmp

memory/512-224-0x00007FF7FCEF0000-0x00007FF7FCF00000-memory.dmp

memory/512-225-0x00007FF7FAA00000-0x00007FF7FAA10000-memory.dmp

memory/512-226-0x00007FF7FAA00000-0x00007FF7FAA10000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\CWnEID6X.xlsm

MD5 e566fc53051035e1e6fd0ed1823de0f9
SHA1 00bc96c48b98676ecd67e81a6f1d7754e4156044
SHA256 8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512 a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

C:\Users\Admin\AppData\Local\Temp\00285E00

MD5 ec3382d2faf44380a60f8645f21c40f5
SHA1 d9559ea7cba0bea9617dd493cdb3d249a744c791
SHA256 9c0cacd88afdb14cf06ec0e59ffb46532d97e94897527cd834deff2c65e84fac
SHA512 21e70943d21f85f43e58236b9d0d060e9ec6417a63bc7d70966747fce8fe09141616140beb30e86297c9f440eca0fae0f3700e13f1b7448f5537566a04fe6234

memory/1144-273-0x0000000000400000-0x0000000000506000-memory.dmp

memory/1144-274-0x0000000000400000-0x0000000000506000-memory.dmp

memory/1144-275-0x0000000000400000-0x0000000000506000-memory.dmp

memory/1144-299-0x0000000000400000-0x0000000000506000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-31 19:37

Reported

2024-10-31 19:39

Platform

win7-20240903-en

Max time kernel

124s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe"

Signatures

VIPKeylogger

stealer keylogger vipkeylogger

Vipkeylogger family

vipkeylogger

Reads user/profile data of local email clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\._cache_2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\._cache_2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\._cache_2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A checkip.dyndns.org N/A N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\._cache_2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\Synaptics\Synaptics.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\Synaptics\Synaptics.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 340 wrote to memory of 2108 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe
PID 340 wrote to memory of 2108 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe
PID 340 wrote to memory of 2108 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe
PID 340 wrote to memory of 2108 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe
PID 340 wrote to memory of 2108 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe
PID 340 wrote to memory of 2108 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe
PID 340 wrote to memory of 2108 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe
PID 340 wrote to memory of 2108 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe
PID 340 wrote to memory of 2108 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe
PID 340 wrote to memory of 2108 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe
PID 340 wrote to memory of 2108 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe
PID 340 wrote to memory of 2108 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe
PID 2108 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\._cache_2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe
PID 2108 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\._cache_2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe
PID 2108 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\._cache_2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe
PID 2108 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe C:\Users\Admin\AppData\Local\Temp\._cache_2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe
PID 2108 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2108 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2108 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2108 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2656 wrote to memory of 3008 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2656 wrote to memory of 3008 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2656 wrote to memory of 3008 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2656 wrote to memory of 3008 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2656 wrote to memory of 3008 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2656 wrote to memory of 3008 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2656 wrote to memory of 3008 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2656 wrote to memory of 3008 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2656 wrote to memory of 3008 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2656 wrote to memory of 3008 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2656 wrote to memory of 3008 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2656 wrote to memory of 3008 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 3008 wrote to memory of 1864 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 3008 wrote to memory of 1864 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 3008 wrote to memory of 1864 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 3008 wrote to memory of 1864 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe

"C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe"

C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe

"C:\Users\Admin\AppData\Local\Temp\2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe"

C:\Users\Admin\AppData\Local\Temp\._cache_2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe

"C:\Users\Admin\AppData\Local\Temp\._cache_2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe"

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe"

C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe

"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 checkip.dyndns.org udp
US 193.122.130.0:80 checkip.dyndns.org tcp
US 8.8.8.8:53 reallyfreegeoip.org udp
US 172.67.177.134:443 reallyfreegeoip.org tcp
US 193.122.130.0:80 checkip.dyndns.org tcp
US 8.8.8.8:53 xred.mooo.com udp
US 172.67.177.134:443 reallyfreegeoip.org tcp
US 8.8.8.8:53 freedns.afraid.org udp
US 69.42.215.252:80 freedns.afraid.org tcp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 docs.google.com udp
GB 172.217.169.78:443 docs.google.com tcp
US 8.8.8.8:53 c.pki.goog udp
GB 142.250.187.227:80 c.pki.goog tcp
US 8.8.8.8:53 o.pki.goog udp
GB 142.250.187.227:80 o.pki.goog tcp
US 8.8.8.8:53 drive.usercontent.google.com udp
GB 172.217.16.225:443 drive.usercontent.google.com tcp
US 8.8.8.8:53 crl.microsoft.com udp
GB 2.19.252.157:80 crl.microsoft.com tcp

Files

memory/340-0-0x000000007463E000-0x000000007463F000-memory.dmp

memory/340-1-0x00000000010D0000-0x00000000017B0000-memory.dmp

memory/340-2-0x0000000074630000-0x0000000074D1E000-memory.dmp

memory/340-3-0x00000000060F0000-0x0000000006260000-memory.dmp

memory/340-4-0x0000000000750000-0x000000000076E000-memory.dmp

memory/340-5-0x000000007463E000-0x000000007463F000-memory.dmp

memory/340-6-0x0000000074630000-0x0000000074D1E000-memory.dmp

memory/340-7-0x000000000B0F0000-0x000000000B238000-memory.dmp

memory/2108-8-0x0000000000400000-0x0000000000506000-memory.dmp

memory/2108-28-0x0000000000080000-0x0000000000081000-memory.dmp

memory/2108-27-0x0000000000400000-0x0000000000506000-memory.dmp

memory/2108-26-0x0000000000400000-0x0000000000506000-memory.dmp

memory/2108-25-0x0000000000400000-0x0000000000506000-memory.dmp

memory/2108-24-0x0000000000400000-0x0000000000506000-memory.dmp

memory/2108-22-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2108-20-0x0000000000400000-0x0000000000506000-memory.dmp

memory/340-31-0x0000000074630000-0x0000000074D1E000-memory.dmp

memory/2108-18-0x0000000000400000-0x0000000000506000-memory.dmp

memory/2108-16-0x0000000000400000-0x0000000000506000-memory.dmp

memory/2108-14-0x0000000000400000-0x0000000000506000-memory.dmp

memory/2108-12-0x0000000000400000-0x0000000000506000-memory.dmp

memory/2108-10-0x0000000000400000-0x0000000000506000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\._cache_2024-10-31_8d62e700b688c2cd65741c96363fe1e8_avoslocker_hijackloader.exe

MD5 5446eaf87fe423755a4611cd0ff939e4
SHA1 c4b2153f43659c6b0ff11527a02b0b0dbfe75b11
SHA256 f7f3df09f0759f03d0d3d114caadac597c767ebfeaba7115d2963c732864daff
SHA512 1b82fc09028091ca718ee02853c0a4a3096ac92f2ba707e181c78cccb8ca717deedda3d7605a704112660575ab0d30f556e8317bbc15940c96265b0da2b4a73c

C:\ProgramData\Synaptics\Synaptics.exe

MD5 8d62e700b688c2cd65741c96363fe1e8
SHA1 a2051f1f358c874a603ff25f0fad8f62c08b4595
SHA256 a899e62a8c7ba50eee558ea74ab735499ba057304714ec26d02dcc14adfb3148
SHA512 675a2fbd71ec7203b33fb454cf9b347db8f2adced9de2b4a932013f39f3062674b8d2ec739aa1587f2f457e07085588a776ad9a9880d5d77d3387460ca1e58da

memory/2744-47-0x0000000000EA0000-0x0000000000EE8000-memory.dmp

memory/2108-52-0x0000000000400000-0x0000000000506000-memory.dmp

memory/2656-55-0x0000000000870000-0x0000000000F50000-memory.dmp

memory/3008-73-0x0000000000400000-0x0000000000506000-memory.dmp

memory/3008-70-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/1864-83-0x0000000001380000-0x00000000013C8000-memory.dmp

memory/1796-84-0x000000005FFF0000-0x0000000060000000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\hQImLqB9.xlsm

MD5 e566fc53051035e1e6fd0ed1823de0f9
SHA1 00bc96c48b98676ecd67e81a6f1d7754e4156044
SHA256 8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512 a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

C:\Users\Admin\AppData\Local\Temp\hQImLqB9.xlsm

MD5 4249c23a6516ef3dc9ae3748d7bfd0cc
SHA1 e69ebd8b6481fd658fc2e6f3d160b59f08cd9757
SHA256 d58243706cf3d80f42847e3cf88d5cdff1f74dc9c3573e0857d936a5053d05eb
SHA512 4a7371eed9c340c952436299a8d0ecbe61a295ec5d78a04b5b75267b4ccb35fd8f1a31b0f1efefa6f25b43f50421b49bbbd81ed4b769dc324dd0bc609254e947

memory/3008-128-0x0000000000400000-0x0000000000506000-memory.dmp

memory/3008-127-0x0000000000400000-0x0000000000506000-memory.dmp

memory/3008-129-0x0000000000400000-0x0000000000506000-memory.dmp

memory/3008-157-0x0000000000400000-0x0000000000506000-memory.dmp