hijackloader | 905c7a4a098ad5c0fae3b8f15fa5fa56a06372b7441aede1958ae1171e555b2a

Analysis

max time kernel
141s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
07-05-2024 20:03

Target

905c7a4a098ad5c0fae3b8f15fa5fa56a06372b7441aede1958ae1171e555b2a.exe
Size

1.3MB
MD5

fa854b73b477f55bd2faa482ba8e8fc4
SHA1

056fb1cdf016ac6d510425ae4dc1693f257dc12e
SHA256

905c7a4a098ad5c0fae3b8f15fa5fa56a06372b7441aede1958ae1171e555b2a
SHA512

fe1b5c9c6a709b34687e35745bd7662aaff0bf816aedb4f59a68714c4797034e1472c667611eb10fb687916e899613fbb79d692a11cc5e074fce5a2ba1ee54c5
SSDEEP

24576:ZtnIMSJmXTYznHLtEqzH+qrjQYgkIuIcDH7IueXN5CUaCWyOVyOckiAhUcMkiAhl:ZtIMvE7rtz7+q/QYgkIu3DHkuedz6rVl

Score

10^/10

Detects HijackLoader (aka IDAT Loader) 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2200-0-0x0000000000DA0000-0x0000000000EFA000-memory.dmp	family_hijackloader

HijackLoader
HijackLoader is a multistage loader first seen in 2023.
loader hijackloader
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

905c7a4a098ad5c0fae3b8f15fa5fa56a06372b7441aede1958ae1171e555b2a.exe

pid process

2200 905c7a4a098ad5c0fae3b8f15fa5fa56a06372b7441aede1958ae1171e555b2a.exe

pid	process
2200	905c7a4a098ad5c0fae3b8f15fa5fa56a06372b7441aede1958ae1171e555b2a.exe

C:\Users\Admin\AppData\Local\Temp\905c7a4a098ad5c0fae3b8f15fa5fa56a06372b7441aede1958ae1171e555b2a.exe
"C:\Users\Admin\AppData\Local\Temp\905c7a4a098ad5c0fae3b8f15fa5fa56a06372b7441aede1958ae1171e555b2a.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2200

memory/2200-0-0x0000000000DA0000-0x0000000000EFA000-memory.dmp

Filesize
1.4MB

Download
memory/2200-1-0x0000000074AD0000-0x0000000074C4B000-memory.dmp

Filesize
1.5MB

Download