hijackloader | 844e22dd38a08217c64322ee018ea293ede53e660b79e841417b78ec8a28d0e9

General

Target

59d0282fcb01a6735aca82dfaf1098c6.exe
Size

4.3MB
MD5

59d0282fcb01a6735aca82dfaf1098c6
SHA1

affbbb62e498264858f37b6b540e952371a17831
SHA256

844e22dd38a08217c64322ee018ea293ede53e660b79e841417b78ec8a28d0e9
SHA512

4449b3b6408fe112197f7b9405ba24eaaab294d13c661f3386b97fb0332c8bfba6c2daec8ec023a24732f55b330fc46b9ec93585a074e64bbb2aecd1e539f510
SSDEEP

98304:lfgl8Ig4nttHq4oaU/7jigBljWiqSmhJQ62W/ok6f/R4H6:l4KIJtaFBwiqhJSW/le/u6

Score

10^/10

hijackloader stealc loader stealer

Malware Config

Extracted

Family

stealc

C2

http://193.163.7.88

Attributes

url_path
/a69d09b357e06b52.php

Signatures

Detects HijackLoader (aka IDAT Loader) 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/384-1-0x0000000000400000-0x000000000085D000-memory.dmp	family_hijackloader

HijackLoader
HijackLoader is a multistage loader first seen in 2023.
loader hijackloader
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Downloads MZ/PE file
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2408 cmd.exe
Executes dropped EXE 2 IoCs

Processes:

ptInst.exeptInst.exe

pid process

1948 ptInst.exe
2876 ptInst.exe
Loads dropped DLL 8 IoCs

Processes:

59d0282fcb01a6735aca82dfaf1098c6.exeptInst.exeptInst.exe

pid process

384 59d0282fcb01a6735aca82dfaf1098c6.exe
1948 ptInst.exe
1948 ptInst.exe
1948 ptInst.exe
1948 ptInst.exe
2876 ptInst.exe
2876 ptInst.exe
2876 ptInst.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

ptInst.exe

description pid process target process

PID 2876 set thread context of 2408 2876 ptInst.exe cmd.exe

pid	process
2408	cmd.exe

pid	process
1948	ptInst.exe
2876	ptInst.exe

description	pid	process	target process
PID 2876 set thread context of 2408	2876	ptInst.exe	cmd.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	explorer.exe

Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

1036 timeout.exe

pid	process
1036	timeout.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

59d0282fcb01a6735aca82dfaf1098c6.exeptInst.exeptInst.execmd.exeexplorer.exe

pid	process
384	59d0282fcb01a6735aca82dfaf1098c6.exe
384	59d0282fcb01a6735aca82dfaf1098c6.exe
1948	ptInst.exe
2876	ptInst.exe
2876	ptInst.exe
2408	cmd.exe
2408	cmd.exe
2528	explorer.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

ptInst.execmd.exe

pid process

2876 ptInst.exe
2408 cmd.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

59d0282fcb01a6735aca82dfaf1098c6.exe

pid process

384 59d0282fcb01a6735aca82dfaf1098c6.exe
384 59d0282fcb01a6735aca82dfaf1098c6.exe

pid	process
2876	ptInst.exe
2408	cmd.exe

Suspicious use of WriteProcessMemory 26 IoCs

Processes:

59d0282fcb01a6735aca82dfaf1098c6.exeptInst.exeptInst.execmd.exeexplorer.execmd.exe

description	pid	process	target process
PID 384 wrote to memory of 1948	384	59d0282fcb01a6735aca82dfaf1098c6.exe	ptInst.exe
PID 384 wrote to memory of 1948	384	59d0282fcb01a6735aca82dfaf1098c6.exe	ptInst.exe
PID 384 wrote to memory of 1948	384	59d0282fcb01a6735aca82dfaf1098c6.exe	ptInst.exe
PID 384 wrote to memory of 1948	384	59d0282fcb01a6735aca82dfaf1098c6.exe	ptInst.exe
PID 1948 wrote to memory of 2876	1948	ptInst.exe	ptInst.exe
PID 1948 wrote to memory of 2876	1948	ptInst.exe	ptInst.exe
PID 1948 wrote to memory of 2876	1948	ptInst.exe	ptInst.exe
PID 1948 wrote to memory of 2876	1948	ptInst.exe	ptInst.exe
PID 2876 wrote to memory of 2408	2876	ptInst.exe	cmd.exe
PID 2876 wrote to memory of 2408	2876	ptInst.exe	cmd.exe
PID 2876 wrote to memory of 2408	2876	ptInst.exe	cmd.exe
PID 2876 wrote to memory of 2408	2876	ptInst.exe	cmd.exe
PID 2876 wrote to memory of 2408	2876	ptInst.exe	cmd.exe
PID 2408 wrote to memory of 2528	2408	cmd.exe	explorer.exe
PID 2408 wrote to memory of 2528	2408	cmd.exe	explorer.exe
PID 2408 wrote to memory of 2528	2408	cmd.exe	explorer.exe
PID 2408 wrote to memory of 2528	2408	cmd.exe	explorer.exe
PID 2408 wrote to memory of 2528	2408	cmd.exe	explorer.exe
PID 2528 wrote to memory of 1432	2528	explorer.exe	cmd.exe
PID 2528 wrote to memory of 1432	2528	explorer.exe	cmd.exe
PID 2528 wrote to memory of 1432	2528	explorer.exe	cmd.exe
PID 2528 wrote to memory of 1432	2528	explorer.exe	cmd.exe
PID 1432 wrote to memory of 1036	1432	cmd.exe	timeout.exe
PID 1432 wrote to memory of 1036	1432	cmd.exe	timeout.exe
PID 1432 wrote to memory of 1036	1432	cmd.exe	timeout.exe
PID 1432 wrote to memory of 1036	1432	cmd.exe	timeout.exe

C:\Users\Admin\AppData\Local\Temp\59d0282fcb01a6735aca82dfaf1098c6.exe
"C:\Users\Admin\AppData\Local\Temp\59d0282fcb01a6735aca82dfaf1098c6.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:384

C:\Users\Admin\AppData\Local\Temp\ClientAdvanced\ptInst.exe
C:\Users\Admin\AppData\Local\Temp\ClientAdvanced\ptInst.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1948

C:\Users\Admin\AppData\Roaming\ClientAdvanced\ptInst.exe
C:\Users\Admin\AppData\Roaming\ClientAdvanced\ptInst.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2876

C:\Windows\SysWOW64\cmd.exe
C:\Windows\SysWOW64\cmd.exe
4⤵
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2408

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
5⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2528

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "" & del "C:\ProgramData\*.dll"" & exit
6⤵
- Suspicious use of WriteProcessMemory
PID:1432

C:\Windows\SysWOW64\timeout.exe
timeout /t 5
7⤵
- Delays execution with timeout.exe
PID:1036

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\9c925f49
Filesize
861KB

MD5
f2660840b7f8381ca212a53f17c576c6

SHA1
e2130ba1b6569d12bf3c8389be8587455677fca6

SHA256
a42cede511e8c40c0f956321d1b2d4a800a87b2984767ebde4e735f2bb7a4ac9

SHA512
8c57c025223247c30d9adf4b82eccf4cf049f3e66481f5b52894dd78dc38128f1dd08d0bc124d933fb5aaa9926e2cd2f38f9b2ad5ef215f24ebd70fcae662bd7

Download Submit
C:\Users\Admin\AppData\Local\Temp\ClientAdvanced\MSVCP140.dll
Filesize
427KB

MD5
71a0aa2d05e9174cefd568347bd9c70f

SHA1
cb9247a0fa59e47f72df7d1752424b33a903bbb2

SHA256
fdb3d86c512adff90967cb860d02a4682850ab96727f0376e4d4836504c50e47

SHA512
6e65520528facaa4058720eb16d6bfdcc7bb36923b7e8e6551f3526709f0fabafab123999e618438e6abe7efed4a1332547cfc988f2b24b0e3d91198b95a911a

Download Submit
C:\Users\Admin\AppData\Local\Temp\ClientAdvanced\WCLDll.dll
Filesize
590KB

MD5
a9ae0aaf4c69050690dafe14483ad700

SHA1
8a9891a8bb735df5ccd6a015095bcfd9ca354f5c

SHA256
f5264200774c76d2d2010c7bc942e5cc9343fc4ab13acbace033941b25a0a7d5

SHA512
1e53f0affc4e63e137c70d1607ed3212f49bbbb26313c0e490399e71546f72bfe79d5652088fcdfadb312cc791b8227756a238e9248b6fca869f3081a702497c

Download Submit
C:\Users\Admin\AppData\Local\Temp\ClientAdvanced\malacia.mpeg
Filesize
21KB

MD5
29f6c4f91ce2b44f486bbce6def932cb

SHA1
95ebce2fe07a1b06a06629f0802e7446018aa27b

SHA256
e3dffe5b2a016857b8c88c5ff26de88407abddd4798f88a471fbefdfa78dc444

SHA512
a64e8af53fa14c214ddfc3c1f99afc2c85d05f81600bfdc5fcdb9ce6020b424e6bf13e691bead156e1d8dfd06ceb64fe84eaa2d5e99c4864990c0818d4a1756f

Download Submit
C:\Users\Admin\AppData\Local\Temp\ClientAdvanced\ptInst.exe
Filesize
938KB

MD5
b15bac961f62448c872e1dc6d3931016

SHA1
1dcb61babb08fe5db711e379cb67335357a5db82

SHA256
bf1a0c67b433f52ebd304553f022baa34bfbca258c932d2b4b8b956b1467bfa5

SHA512
932119f7dc6710239481c80ad8baaed5c14a2085fcc514b6522671b1a4ebbaf488e43453f11d5aaf6dcef7a245db8de44d93ff255f7cf8385b7d00f31f2cc370

Download Submit
C:\Users\Admin\AppData\Local\Temp\ClientAdvanced\statoscope.mpg
Filesize
728KB

MD5
4a7346dd4450e84537d71a470b338de7

SHA1
9ab5865860693f8b28838a5cdfd014eb349fe493

SHA256
98aab00d5269d87dd59eb99f260b83d0fa629f90ef9d4ec7403b2ddccffe849e

SHA512
8e184133efcc0d778e06be362f94fd29a7cc83d925b25388608640e35e860ee40041e035fbb0a9b6966c11e52898eab1e86f471d11da5ab92fb5e70353c0c365

Download Submit
\Users\Admin\AppData\Local\Temp\ClientAdvanced\vcruntime140.dll
Filesize
81KB

MD5
16b26bc43943531d7d7e379632ed4e63

SHA1
565287de39649e59e653a3612478c2186096d70a

SHA256
346f72c9a7584c2ab6ce65cd38a616c77ebddc0bbab2274c4e89dd5e62237517

SHA512
b5b7b4b8c5ab4276a34956e43f586272b1803ec3609253fee1bcc0a549aed7ba11d47404b023f7b67af701726bab95cca55738e7bd5bca272eca5ac71bb418cc

Download Submit
memory/384-5-0x0000000074D30000-0x0000000074EA4000-memory.dmp

Filesize
1.5MB

Download
memory/384-17-0x0000000074D30000-0x0000000074EA4000-memory.dmp

Filesize
1.5MB

Download
memory/384-54-0x0000000074D30000-0x0000000074EA4000-memory.dmp

Filesize
1.5MB

Download
memory/384-10-0x0000000074D30000-0x0000000074EA4000-memory.dmp

Filesize
1.5MB

Download
memory/384-3-0x00000000779B0000-0x0000000077B59000-memory.dmp

Filesize
1.7MB

Download
memory/384-1-0x0000000000400000-0x000000000085D000-memory.dmp

Filesize
4.4MB

Download
memory/384-2-0x0000000074D30000-0x0000000074EA4000-memory.dmp

Filesize
1.5MB

Download
memory/1948-30-0x0000000074D30000-0x0000000074EA4000-memory.dmp

Filesize
1.5MB

Download
memory/1948-31-0x00000000779B0000-0x0000000077B59000-memory.dmp

Filesize
1.7MB

Download
memory/2408-59-0x00000000779B0000-0x0000000077B59000-memory.dmp

Filesize
1.7MB

Download
memory/2408-57-0x0000000074D30000-0x0000000074EA4000-memory.dmp

Filesize
1.5MB

Download
memory/2408-60-0x0000000074D30000-0x0000000074EA4000-memory.dmp

Filesize
1.5MB

Download
memory/2408-63-0x0000000074D30000-0x0000000074EA4000-memory.dmp

Filesize
1.5MB

Download
memory/2528-62-0x0000000000670000-0x00000000008AC000-memory.dmp

Filesize
2.2MB

Download
memory/2528-64-0x00000000779B0000-0x0000000077B59000-memory.dmp

Filesize
1.7MB

Download
memory/2528-65-0x0000000000670000-0x00000000008AC000-memory.dmp

Filesize
2.2MB

Download
memory/2528-68-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/2528-81-0x0000000000670000-0x00000000008AC000-memory.dmp

Filesize
2.2MB

Download
memory/2876-53-0x0000000074D30000-0x0000000074EA4000-memory.dmp

Filesize
1.5MB

Download
memory/2876-55-0x0000000074D30000-0x0000000074EA4000-memory.dmp

Filesize
1.5MB

Download
memory/2876-52-0x00000000779B0000-0x0000000077B59000-memory.dmp

Filesize
1.7MB

Download
memory/2876-51-0x0000000074D30000-0x0000000074EA4000-memory.dmp

Filesize
1.5MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads