Overview

overview

10

Static

static

3

2024-11-22...er.exe

windows7-x64

8

2024-11-22...er.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    122s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    22-11-2024 20:09

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-11-22_651569dc38ce166968498029ecb14ce0_avoslocker_formbook_hijackloader_luca-stealer.exe

  • Size

    12.0MB

  • MD5

    651569dc38ce166968498029ecb14ce0

  • SHA1

    4de86e0e48d5722556f0c20da781ed2a814bf784

  • SHA256

    c21d62b3032b34622a925a5a6ac44c52264c1e7bdaf12597874c637c50d06943

  • SHA512

    96510f33536638ef86ba695cdbaf5a4fb6ba40266b7abb433813b4a541d8440da3933e315f20eefee22ffb952a92de5060233ea6b1f5a8eb027fa42c8be70b85

  • SSDEEP

    196608:lR668aaELMR668aaELmR668aaELwR668aaELKR668aaEL4R668aaELeFIF0wu:lp8aatp8aaXp8aaxp8aa7p8aaZp8aap

Score
8/10
discoveryexecution

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-11-22_651569dc38ce166968498029ecb14ce0_avoslocker_formbook_hijackloader_luca-stealer.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-11-22_651569dc38ce166968498029ecb14ce0_avoslocker_formbook_hijackloader_luca-stealer.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2708
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\2024-11-22_651569dc38ce166968498029ecb14ce0_avoslocker_formbook_hijackloader_luca-stealer.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2904
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\BLznCuyzwk.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2724
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BLznCuyzwk" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA7E3.tmp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:2556
    • C:\Users\Admin\AppData\Local\Temp\2024-11-22_651569dc38ce166968498029ecb14ce0_avoslocker_formbook_hijackloader_luca-stealer.exe
      "C:\Users\Admin\AppData\Local\Temp\2024-11-22_651569dc38ce166968498029ecb14ce0_avoslocker_formbook_hijackloader_luca-stealer.exe"
      2⤵
        PID:588
      • C:\Users\Admin\AppData\Local\Temp\2024-11-22_651569dc38ce166968498029ecb14ce0_avoslocker_formbook_hijackloader_luca-stealer.exe
        "C:\Users\Admin\AppData\Local\Temp\2024-11-22_651569dc38ce166968498029ecb14ce0_avoslocker_formbook_hijackloader_luca-stealer.exe"
        2⤵
          PID:800
        • C:\Users\Admin\AppData\Local\Temp\2024-11-22_651569dc38ce166968498029ecb14ce0_avoslocker_formbook_hijackloader_luca-stealer.exe
          "C:\Users\Admin\AppData\Local\Temp\2024-11-22_651569dc38ce166968498029ecb14ce0_avoslocker_formbook_hijackloader_luca-stealer.exe"
          2⤵
            PID:480
          • C:\Users\Admin\AppData\Local\Temp\2024-11-22_651569dc38ce166968498029ecb14ce0_avoslocker_formbook_hijackloader_luca-stealer.exe
            "C:\Users\Admin\AppData\Local\Temp\2024-11-22_651569dc38ce166968498029ecb14ce0_avoslocker_formbook_hijackloader_luca-stealer.exe"
            2⤵
              PID:1028
            • C:\Users\Admin\AppData\Local\Temp\2024-11-22_651569dc38ce166968498029ecb14ce0_avoslocker_formbook_hijackloader_luca-stealer.exe
              "C:\Users\Admin\AppData\Local\Temp\2024-11-22_651569dc38ce166968498029ecb14ce0_avoslocker_formbook_hijackloader_luca-stealer.exe"
              2⤵
                PID:1492

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\tmpA7E3.tmp
              Filesize

              1KB

              MD5

              7daa0e3c6f21a9f3adbbe29b2692c23f

              SHA1

              52b57abdd1d42e34ebf28fa2f2320e4789770e16

              SHA256

              06d73eb702e143cda4be2bd2a2d84482d3982dcf9f143fb6373cca16b8ab35d2

              SHA512

              5d81a3a9bfbfe5a2761b2bfe334e3b5545cd347654e00f8ec8b9a3e5d1f2b127daaa71bf02785274165f3653c7f9a03dc1f2616b02290195fd1642b16f7ee475

              Download Submit

            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\KT6O793UXSXDMCGI20ED.temp
              Filesize

              7KB

              MD5

              55a40a0b435bab841028068d16978c0e

              SHA1

              94a07c9beda3845b02c514ce3defb1e55fa6f86c

              SHA256

              bf8e8acffa22871c0a13dc747892790d5002e3582ed15f0a3cccb4da36ed87c8

              SHA512

              f1999fb3e823129c491198a18cf0442ae7ec7bcc6385545d8b5c15d381b3305c9f14ff22fd46c3e5aceff027506d45b5b3a66f81b43de7edc9aae7bbd3fbfbaf

              Download Submit

            • memory/2708-0-0x000000007475E000-0x000000007475F000-memory.dmp

              Filesize

              4KB

              Download

            • memory/2708-1-0x0000000000070000-0x0000000000C70000-memory.dmp

              Filesize

              12.0MB

              Download

            • memory/2708-2-0x0000000074750000-0x0000000074E3E000-memory.dmp

              Filesize

              6.9MB

              Download

            • memory/2708-3-0x00000000010D0000-0x00000000010E8000-memory.dmp

              Filesize

              96KB

              Download

            • memory/2708-4-0x000000007475E000-0x000000007475F000-memory.dmp

              Filesize

              4KB

              Download

            • memory/2708-5-0x0000000074750000-0x0000000074E3E000-memory.dmp

              Filesize

              6.9MB

              Download

            • memory/2708-6-0x0000000005990000-0x0000000005B0E000-memory.dmp

              Filesize

              1.5MB

              Download

            • memory/2708-19-0x0000000074750000-0x0000000074E3E000-memory.dmp

              Filesize

              6.9MB

              Download