Overview

overview

10

Static

static

3

2024-12-31...er.exe

windows7-x64

8

2024-12-31...er.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    31-12-2024 17:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-12-31_2a81612230b02615315a616e07082069_avoslocker_formbook_hijackloader_luca-stealer.exe

  • Size

    10.3MB

  • MD5

    2a81612230b02615315a616e07082069

  • SHA1

    6b265c4c2e5e501e9b2d4d4ccd1a552346d42c2e

  • SHA256

    8728c59c5bbde231becddfd54466842b04b84cfd28c9813be9eaf27e2b3b27fd

  • SHA512

    0cd17c9880c51ad101287caa4bde261854a1807791042b6171cb1f9e7f360cf86d2234bec45a6e92cb2e81ae392f999e6cc4c8998c6097ba89f70bc20d65a092

  • SSDEEP

    196608:FR668aaELmR668aaELwR668aaELKR668aaEL4R668aaELeFIF0wu:Fp8aaXp8aaxp8aa7p8aaZp8aap

Score
8/10
discoveryexecution

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-12-31_2a81612230b02615315a616e07082069_avoslocker_formbook_hijackloader_luca-stealer.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-12-31_2a81612230b02615315a616e07082069_avoslocker_formbook_hijackloader_luca-stealer.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2932
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\2024-12-31_2a81612230b02615315a616e07082069_avoslocker_formbook_hijackloader_luca-stealer.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2916
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\BLznCuyzwk.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2720
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BLznCuyzwk" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC86D.tmp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:2968
    • C:\Users\Admin\AppData\Local\Temp\2024-12-31_2a81612230b02615315a616e07082069_avoslocker_formbook_hijackloader_luca-stealer.exe
      "C:\Users\Admin\AppData\Local\Temp\2024-12-31_2a81612230b02615315a616e07082069_avoslocker_formbook_hijackloader_luca-stealer.exe"
      2⤵
        PID:2724
      • C:\Users\Admin\AppData\Local\Temp\2024-12-31_2a81612230b02615315a616e07082069_avoslocker_formbook_hijackloader_luca-stealer.exe
        "C:\Users\Admin\AppData\Local\Temp\2024-12-31_2a81612230b02615315a616e07082069_avoslocker_formbook_hijackloader_luca-stealer.exe"
        2⤵
          PID:2284
        • C:\Users\Admin\AppData\Local\Temp\2024-12-31_2a81612230b02615315a616e07082069_avoslocker_formbook_hijackloader_luca-stealer.exe
          "C:\Users\Admin\AppData\Local\Temp\2024-12-31_2a81612230b02615315a616e07082069_avoslocker_formbook_hijackloader_luca-stealer.exe"
          2⤵
            PID:2336
          • C:\Users\Admin\AppData\Local\Temp\2024-12-31_2a81612230b02615315a616e07082069_avoslocker_formbook_hijackloader_luca-stealer.exe
            "C:\Users\Admin\AppData\Local\Temp\2024-12-31_2a81612230b02615315a616e07082069_avoslocker_formbook_hijackloader_luca-stealer.exe"
            2⤵
              PID:2332
            • C:\Users\Admin\AppData\Local\Temp\2024-12-31_2a81612230b02615315a616e07082069_avoslocker_formbook_hijackloader_luca-stealer.exe
              "C:\Users\Admin\AppData\Local\Temp\2024-12-31_2a81612230b02615315a616e07082069_avoslocker_formbook_hijackloader_luca-stealer.exe"
              2⤵
                PID:2924

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\tmpC86D.tmp
              Filesize

              1KB

              MD5

              64c8ed47f25d0b850bf839eb76bf17b3

              SHA1

              9b474653eec233cc68833c3ecb9f8f5343e3225a

              SHA256

              bc5a011951a0ded79b3e04ff338e0eab25f8807ec37a0149f0b3d98e20553912

              SHA512

              2cd409222245a70b19071d162650f068d167827e3a37168fcc5376d97463972305885060096ff75cc53df1037dfa630c12d0911f7f98410778e38e7b518e4510

              Download Submit

            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\QJRX2J6C8SDE6ABSK55X.temp
              Filesize

              7KB

              MD5

              4deb262e17c07040c637d40afc66b9f5

              SHA1

              c7c0f3c1aa31106ba8a8b9686e4abdfc28aebbe5

              SHA256

              0a45b00c7d24877fc34062bdb9f757f19b9dadda9ecb3376f8cccc37bf19a6dd

              SHA512

              273082c119accae6cc2fb50b0d2c747ecbec5b5bfe826ac0222fd8350e0b1cefa654be2712a31ed00c456f8170a864fea59b053d35e73b0cb6124bc9a8fbbdc0

              Download Submit

            • memory/2932-0-0x000000007466E000-0x000000007466F000-memory.dmp

              Filesize

              4KB

              Download

            • memory/2932-1-0x00000000002A0000-0x0000000000D00000-memory.dmp

              Filesize

              10.4MB

              Download

            • memory/2932-2-0x0000000074660000-0x0000000074D4E000-memory.dmp

              Filesize

              6.9MB

              Download

            • memory/2932-3-0x0000000000F50000-0x0000000000F68000-memory.dmp

              Filesize

              96KB

              Download

            • memory/2932-4-0x000000007466E000-0x000000007466F000-memory.dmp

              Filesize

              4KB

              Download

            • memory/2932-5-0x0000000074660000-0x0000000074D4E000-memory.dmp

              Filesize

              6.9MB

              Download

            • memory/2932-6-0x0000000005AB0000-0x0000000005C2E000-memory.dmp

              Filesize

              1.5MB

              Download

            • memory/2932-19-0x0000000074660000-0x0000000074D4E000-memory.dmp

              Filesize

              6.9MB

              Download