Analysis
- user interaction
yes - max time kernel
900s - max time network
479s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
27/07/2026, 16:41
General
- Target AVLpilot-Velopack-Setup-1.2.8.exe
- Size 49.7MB
- Sample260727-t657daxbnf
- SHA256 d322265c012dcf97710c268e826c4442f6af8e61f710c99777f381f50c9ac01d
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 2 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\AVLpilot-Velopack-Setup-1.2.8.exe"C:\Users\Admin\AppData\Local\Temp\AVLpilot-Velopack-Setup-1.2.8.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\com.aviation-lounge.avlpilot\current\AVLpilot.exe"C:\Users\Admin\AppData\Local\com.aviation-lounge.avlpilot\current\AVLpilot.exe" --veloapp-install 1.2.82⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\com.aviation-lounge.avlpilot\current\AVLpilot.exe"C:\Users\Admin\AppData\Local\com.aviation-lounge.avlpilot\current\AVLpilot.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
.preferences.json.6bd4fae514ea4e2c80d108c333c99da7.tmp
AVLpilot.exe
AVLpilot.exe
avlpilot.settings.json
libHarfBuzzSharp.DLL
libSkiaSharp.DLL
sq.version
com.aviation-lounge.avlpilot-1.2.8-full.nupkg
velopack_com.aviation-lounge.avlpilot.log
AVLpilot.lnk
AVLpilot.lnk
memory/1952-30-0x0000023393F50000-0x0000023393FA0000-memory.dmp
memory/1952-80-0x0000023395660000-0x00000233958FE000-memory.dmp
memory/1952-67-0x0000023398430000-0x0000023398BA0000-memory.dmp
memory/1952-71-0x00000233979D0000-0x0000023397A10000-memory.dmp
memory/1952-38-0x0000023393FA0000-0x0000023393FF0000-memory.dmp
memory/1952-42-0x0000023397720000-0x0000023397740000-memory.dmp
memory/1952-46-0x0000023397760000-0x0000023397780000-memory.dmp
memory/1952-34-0x00000233953B0000-0x0000023395460000-memory.dmp
memory/1952-54-0x0000023397810000-0x0000023397840000-memory.dmp
memory/1952-63-0x0000023397900000-0x0000023397960000-memory.dmp
memory/1952-58-0x00000233977C0000-0x00000233977E0000-memory.dmp
memory/1952-50-0x00000233977A0000-0x00000233977C0000-memory.dmp
memory/1952-26-0x0000023392F60000-0x0000023392F80000-memory.dmp
memory/1952-22-0x00000233940D0000-0x0000023395020000-memory.dmp
memory/2776-183-0x0000018117C90000-0x0000018117CB0000-memory.dmp
memory/2776-151-0x0000018117B30000-0x0000018117B50000-memory.dmp
memory/2776-163-0x0000018117C50000-0x0000018117C90000-memory.dmp
memory/2776-169-0x00000181196A0000-0x0000018119720000-memory.dmp
memory/2776-179-0x00000181195D0000-0x0000018119610000-memory.dmp
memory/2776-191-0x00000181198F0000-0x0000018119910000-memory.dmp
memory/2776-187-0x0000018119ED0000-0x0000018119F50000-memory.dmp
memory/2776-140-0x00000181190A0000-0x0000018119270000-memory.dmp
memory/2776-171-0x0000018119830000-0x00000181198D0000-memory.dmp
memory/2776-155-0x0000018117BD0000-0x0000018117BE0000-memory.dmp
memory/2776-159-0x0000018119420000-0x00000181195D0000-memory.dmp
memory/2776-199-0x0000018117A10000-0x0000018117A30000-memory.dmp
memory/2776-195-0x0000018119F80000-0x0000018119FB0000-memory.dmp
memory/2776-203-0x000001811A3E0000-0x000001811A400000-memory.dmp
memory/2776-208-0x000001811A5B0000-0x000001811A6B0000-memory.dmp
memory/2776-175-0x0000018119C60000-0x0000018119ED0000-memory.dmp
memory/2776-214-0x0000018119FB0000-0x0000018119FC0000-memory.dmp
memory/2776-218-0x000001811B960000-0x000001811BA20000-memory.dmp
memory/2776-223-0x000001811D300000-0x000001811D320000-memory.dmp
memory/2776-235-0x000001811D4B0000-0x000001811D510000-memory.dmp
memory/2776-231-0x000001811A820000-0x000001811A830000-memory.dmp
memory/2776-239-0x000001811D9C0000-0x000001811DD40000-memory.dmp
memory/2776-227-0x000001811D400000-0x000001811D420000-memory.dmp
memory/2776-243-0x000001811E140000-0x000001811E3F0000-memory.dmp
memory/2776-249-0x000001811DE00000-0x000001811DE30000-memory.dmp
memory/2776-253-0x000001811DE30000-0x000001811DE70000-memory.dmp
memory/2776-145-0x0000018117B80000-0x0000018117BB0000-memory.dmp
memory/2776-263-0x000001811E8B0000-0x000001811E8F0000-memory.dmp
memory/2776-259-0x000001811DDB0000-0x000001811DDD0000-memory.dmp
memory/2776-267-0x00000181155F0000-0x000001811588E000-memory.dmp
memory/2776-135-0x0000018117AC0000-0x0000018117B30000-memory.dmp