Overview

overview

10

Static

static

3

2025-02-28...er.exe

windows7-x64

8

2025-02-28...er.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    28/02/2025, 22:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-02-28_6f52824ad6e9272e8e856765ccf2039f_agent-tesla_avoslocker_formbook_hijackloader_luca-stealer.exe

  • Size

    7.1MB

  • MD5

    6f52824ad6e9272e8e856765ccf2039f

  • SHA1

    d6dc08171366deda9887c16859d1b1641b499bf6

  • SHA256

    68b9b268b7b16975e754826efd470e405b5e199e379a8da0a7fae188d5877253

  • SHA512

    19a5ffbf4015ad4153490aae19bf2f687f5c375c74fbdf32a464cb8449522cf05162858dce92f52f2ac94ed816fce13af98bb778ba484e9f09699b46bbf0d564

  • SSDEEP

    196608:lR668aaELKR668aaEL4R668aaELeFIF0wuW:lp8aa7p8aaZp8aapW

Score
8/10
discoveryexecution

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-02-28_6f52824ad6e9272e8e856765ccf2039f_agent-tesla_avoslocker_formbook_hijackloader_luca-stealer.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-02-28_6f52824ad6e9272e8e856765ccf2039f_agent-tesla_avoslocker_formbook_hijackloader_luca-stealer.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2228
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\2025-02-28_6f52824ad6e9272e8e856765ccf2039f_agent-tesla_avoslocker_formbook_hijackloader_luca-stealer.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2872
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\BLznCuyzwk.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2564
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BLznCuyzwk" /XML "C:\Users\Admin\AppData\Local\Temp\tmp907D.tmp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:2756
    • C:\Users\Admin\AppData\Local\Temp\2025-02-28_6f52824ad6e9272e8e856765ccf2039f_agent-tesla_avoslocker_formbook_hijackloader_luca-stealer.exe
      "C:\Users\Admin\AppData\Local\Temp\2025-02-28_6f52824ad6e9272e8e856765ccf2039f_agent-tesla_avoslocker_formbook_hijackloader_luca-stealer.exe"
      2⤵
        PID:2036
      • C:\Users\Admin\AppData\Local\Temp\2025-02-28_6f52824ad6e9272e8e856765ccf2039f_agent-tesla_avoslocker_formbook_hijackloader_luca-stealer.exe
        "C:\Users\Admin\AppData\Local\Temp\2025-02-28_6f52824ad6e9272e8e856765ccf2039f_agent-tesla_avoslocker_formbook_hijackloader_luca-stealer.exe"
        2⤵
          PID:1876
        • C:\Users\Admin\AppData\Local\Temp\2025-02-28_6f52824ad6e9272e8e856765ccf2039f_agent-tesla_avoslocker_formbook_hijackloader_luca-stealer.exe
          "C:\Users\Admin\AppData\Local\Temp\2025-02-28_6f52824ad6e9272e8e856765ccf2039f_agent-tesla_avoslocker_formbook_hijackloader_luca-stealer.exe"
          2⤵
            PID:2920
          • C:\Users\Admin\AppData\Local\Temp\2025-02-28_6f52824ad6e9272e8e856765ccf2039f_agent-tesla_avoslocker_formbook_hijackloader_luca-stealer.exe
            "C:\Users\Admin\AppData\Local\Temp\2025-02-28_6f52824ad6e9272e8e856765ccf2039f_agent-tesla_avoslocker_formbook_hijackloader_luca-stealer.exe"
            2⤵
              PID:2928
            • C:\Users\Admin\AppData\Local\Temp\2025-02-28_6f52824ad6e9272e8e856765ccf2039f_agent-tesla_avoslocker_formbook_hijackloader_luca-stealer.exe
              "C:\Users\Admin\AppData\Local\Temp\2025-02-28_6f52824ad6e9272e8e856765ccf2039f_agent-tesla_avoslocker_formbook_hijackloader_luca-stealer.exe"
              2⤵
                PID:2936

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\tmp907D.tmp
              Filesize

              1KB

              MD5

              c02bab54d99e6381bb4415ec365f32f7

              SHA1

              9f08ed8acf6b36bf54a9e2543778f42224639d92

              SHA256

              4f024e3e656c73eec61b267282e43d899ab7688042cab55d123fa5a8532132e5

              SHA512

              dddf248ac04ccbc57396bd2b53617c2770868eb702a0d10dd9929fa8aec74108db0ab86f931eafa382d30015e02e931629016d0f3c93832dd9560e662287a78d

              Download Submit

            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\LY5R6YW9LN83QW9YQXN7.temp
              Filesize

              7KB

              MD5

              f102640c633aadbb2b211c5859411171

              SHA1

              055cd67d03935ddc6aafdc64d7e9a4d7eece4360

              SHA256

              6bcf09283d22dd69a36df528e69c5481eb85fd9de6c3dff6216ce3693fde8653

              SHA512

              e88f829be47a4495d20cac7f311c780c1090358457f1c146e930ef8ae7c2d0da59f9e0be63aa8f94ac883e89d7bca5464be27b092cb1fef9c52d8142061c097c

              Download Submit

            • memory/2228-0-0x000000007417E000-0x000000007417F000-memory.dmp

              Filesize

              4KB

              Download

            • memory/2228-1-0x00000000002C0000-0x00000000009E0000-memory.dmp

              Filesize

              7.1MB

              Download

            • memory/2228-2-0x0000000074170000-0x000000007485E000-memory.dmp

              Filesize

              6.9MB

              Download

            • memory/2228-3-0x0000000000CD0000-0x0000000000CE8000-memory.dmp

              Filesize

              96KB

              Download

            • memory/2228-4-0x000000007417E000-0x000000007417F000-memory.dmp

              Filesize

              4KB

              Download

            • memory/2228-5-0x0000000074170000-0x000000007485E000-memory.dmp

              Filesize

              6.9MB

              Download

            • memory/2228-6-0x0000000005720000-0x000000000589E000-memory.dmp

              Filesize

              1.5MB

              Download

            • memory/2228-19-0x0000000074170000-0x000000007485E000-memory.dmp

              Filesize

              6.9MB

              Download