326b7306caf8f9037777323b99f7028eb623ce11c1b9aaead5ca7fa637642b20

Analysis

max time kernel
93s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19/01/2025, 19:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2025-01-19_03eb9261bf6a715bcaadaecb0ca8d422_avoslocker_luca-stealer.exe
Size 1.7MB
Sample250119-yhcmdaspfz
SHA256 326b7306caf8f9037777323b99f7028eb623ce11c1b9aaead5ca7fa637642b20
MD5 03eb9261bf6a715bcaadaecb0ca8d422
SHA1 dbed4579d23050935f9144f17d90478e55bca76b
SHA512 1428b3b340c52f17afad9893958640b5260d9cb60008b8c19a01cbf420c3bebaa6305dd9eeba0b45d5f8327852584df7fc9affc95f32e50f74979e4d78bb481c
SSDEEP 24576:XoMOW0n7Ubxk/uRv5qLGJLQ4a56duA/85RkV4l7/ZUsqjnhMgeiCl7G0nehbGZpv:e4i0wGJra0uAUfkVy7/ZwDmg27RnWGj
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-01-19_03eb9261bf6a715bcaadaecb0ca8d422_avoslocker_luca-stealer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3868	javaws.exe
3868	javaws.exe
4076	jp2launcher.exe
4076	jp2launcher.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4284	2025-01-19_03eb9261bf6a715bcaadaecb0ca8d422_avoslocker_luca-stealer.exe
4284	2025-01-19_03eb9261bf6a715bcaadaecb0ca8d422_avoslocker_luca-stealer.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
4284	2025-01-19_03eb9261bf6a715bcaadaecb0ca8d422_avoslocker_luca-stealer.exe
4284	2025-01-19_03eb9261bf6a715bcaadaecb0ca8d422_avoslocker_luca-stealer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4076	jp2launcher.exe
4284	2025-01-19_03eb9261bf6a715bcaadaecb0ca8d422_avoslocker_luca-stealer.exe
4284	2025-01-19_03eb9261bf6a715bcaadaecb0ca8d422_avoslocker_luca-stealer.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4284 wrote to memory of 3868	4284	2025-01-19_03eb9261bf6a715bcaadaecb0ca8d422_avoslocker_luca-stealer.exe	83
PID 4284 wrote to memory of 3868	4284	2025-01-19_03eb9261bf6a715bcaadaecb0ca8d422_avoslocker_luca-stealer.exe	83
PID 3868 wrote to memory of 4076	3868	javaws.exe	84
PID 3868 wrote to memory of 4076	3868	javaws.exe	84

C:\Users\Admin\AppData\Local\Temp\2025-01-19_03eb9261bf6a715bcaadaecb0ca8d422_avoslocker_luca-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2025-01-19_03eb9261bf6a715bcaadaecb0ca8d422_avoslocker_luca-stealer.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4284
- C:\Program Files\Java\jre-1.8\bin\javaws.exe
  "C:\Program Files\Java\jre-1.8\bin\javaws.exe" -J-Djdk.disableLastUsageTracking=true -SSVBaselineUpdate
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3868
- - C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
    "C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files\Java\jre-1.8" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxsaWJcZGVwbG95LmphcgAtRGphdmEuc2VjdXJpdHkucG9saWN5PWZpbGU6QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZS0xLjhcbGliXHNlY3VyaXR5XGphdmF3cy5wb2xpY3kALUR0cnVzdFByb3h5PXRydWUALVh2ZXJpZnk6cmVtb3RlAC1Eam5scHguaG9tZT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxqYXZhd3MuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxkZXBsb3kuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxwbHVnaW4uamFyAC1EamRrLmRpc2FibGVMYXN0VXNhZ2VUcmFja2luZz10cnVlAC1Eam5scHguanZtPUM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGJpblxqYXZhdy5leGUALURqbmxweC52bWFyZ3M9TFVScVpHc3VaR2x6WVdKc1pVeGhjM1JWYzJGblpWUnlZV05yYVc1blBYUnlkV1VB -ma LVNTVkJhc2VsaW5lVXBkYXRlAC1ub3RXZWJKYXZh
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:4076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

deployment.properties

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\deployment.properties
Size 896B
SHA256 21946c9082d254777e841c26f9a6dd0463bb03d46ad7e593f424dad3e6a33f38
MD5 1e5b78d5a201351431f584ee680e3b1f
SHA1 8e3bde406390100db1fd0ae859008e0437f2dd7b
SHA512 690e89e5846b9c0a3a6446ebf1e85b4d5de0d8451278d1ca45b37d52a1cc43ccd2ed68b63ca3a5833afbf0c973096f1963ae823f70179d543be59cf0af9f3ea6
MD5 SHA1 SHA512

Submit Download

securitypack.jar

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\security\securitypack.jar
Size 12KB
SHA256 9771364d53fa9b1bd14cef7e48be1f5df23b11aac9f5cb6763a4934b3190e126
MD5 a66e19c05f3e0b24ac077a37c2b7589e
SHA1 8b9ad1517985c48c0bd11670fabd3648bac9d1ff
SHA512 0876a0072ac19f03818a2e5d77cec638470a09e40cd3794d901f1625c3f701f7b37a5cc6e23057a53e62d6e936f5c90bdd4a2c811c64dcfaa20dca5fdf63565f
SSDEEP 192:xZhyXGXQgyCawxbZzeSdF17Jdf+0Kf8doa+gW13jCbSnYCBoTN3DVjD5IKBsOCBE:gW59aEbdeM1Hf+ox2mbjC2NJ35bBs5E
MD5 SHA1 SHA512 SSDEEP

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 164KB
SHA256 1871a0bb17973d685461dde2a03d70217e35ea8dc74c205f709904f74a676462
MD5 45a00f6cd5579afc52f169bcfd269025
SHA1 fab19a8acf918578e64ce3e179c8d410afe17ccc
SHA512 bbe9ad7af981a09b3ce131543cc28f928ffb219733912ae1b117317f081cb6f0b645292cbfa6b3ba5fa01c59f72217f101aa91da9e3963a7832c07c1762eaf39
SSDEEP 3072:dA3JsxlJnMvoEOXleAFvGn+Uf4uFFrKBDeL+ORdzJ6Z:r+bw
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4076-23-0x000001AD16F10000-0x000001AD17180000-memory.dmp

Download

memory/4076-216-0x000001AD16B20000-0x000001AD16B21000-memory.dmp

Download

memory/4076-321-0x000001AD16B20000-0x000001AD16B21000-memory.dmp

Download

memory/4076-347-0x000001AD16B20000-0x000001AD16B21000-memory.dmp

Download

memory/4076-368-0x000001AD16B20000-0x000001AD16B21000-memory.dmp

Download

memory/4076-369-0x000001AD16F10000-0x000001AD17180000-memory.dmp

Download

memory/4284-0-0x0000000000400000-0x00000000005B8000-memory.dmp

Download

memory/4284-370-0x0000000000400000-0x00000000005B8000-memory.dmp

Download