hijackloader | 2895f26ebeb8334731591ac868e9ab554a3568632e3c62e802739e5d0fc38d88

Analysis

max time kernel
97s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
02-05-2024 01:12

Target

2895f26ebeb8334731591ac868e9ab554a3568632e3c62e802739e5d0fc38d88.exe
Size

922KB
MD5

807675a50ee7545e02daeac9822842b7
SHA1

967094e1ef9155a031687396ba99855e54870612
SHA256

2895f26ebeb8334731591ac868e9ab554a3568632e3c62e802739e5d0fc38d88
SHA512

12a928dc23e7fd03996e5d41d8fce1d091b0fa979d379e63e6e89d58440f8a21a809a646e1c6431eda68d71515e1aed06219c4f3d8c0c86e25724b1d6e5af5b4
SSDEEP

24576:e8inPEBCZN5hoVlnJXzJ/SEVSoMAALia4:Dg5BuxF/SRF4

Score

10^/10

Detects HijackLoader (aka IDAT Loader) 1 IoCs

resource	yara_rule
behavioral2/memory/2388-0-0x0000000000E30000-0x0000000000F18000-memory.dmp	family_hijackloader

HijackLoader
HijackLoader is a multistage loader first seen in 2023.
loader hijackloader

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2388	2895f26ebeb8334731591ac868e9ab554a3568632e3c62e802739e5d0fc38d88.exe

C:\Users\Admin\AppData\Local\Temp\2895f26ebeb8334731591ac868e9ab554a3568632e3c62e802739e5d0fc38d88.exe
"C:\Users\Admin\AppData\Local\Temp\2895f26ebeb8334731591ac868e9ab554a3568632e3c62e802739e5d0fc38d88.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2388

memory/2388-0-0x0000000000E30000-0x0000000000F18000-memory.dmp

Filesize
928KB

Download
memory/2388-1-0x00000000754A0000-0x000000007561B000-memory.dmp

Filesize
1.5MB

Download