hijackloader | 905c7a4a098ad5c0fae3b8f15fa5fa56a06372b7441aede1958ae1171e555b2a

Analysis

max time kernel
93s
max time network
95s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
07-05-2024 20:03

Target

905c7a4a098ad5c0fae3b8f15fa5fa56a06372b7441aede1958ae1171e555b2a.exe
Size

1.3MB
MD5

fa854b73b477f55bd2faa482ba8e8fc4
SHA1

056fb1cdf016ac6d510425ae4dc1693f257dc12e
SHA256

905c7a4a098ad5c0fae3b8f15fa5fa56a06372b7441aede1958ae1171e555b2a
SHA512

fe1b5c9c6a709b34687e35745bd7662aaff0bf816aedb4f59a68714c4797034e1472c667611eb10fb687916e899613fbb79d692a11cc5e074fce5a2ba1ee54c5
SSDEEP

24576:ZtnIMSJmXTYznHLtEqzH+qrjQYgkIuIcDH7IueXN5CUaCWyOVyOckiAhUcMkiAhl:ZtIMvE7rtz7+q/QYgkIu3DHkuedz6rVl

Score

10^/10

Detects HijackLoader (aka IDAT Loader) 1 IoCs

resource	yara_rule
behavioral2/memory/3876-0-0x0000000000D20000-0x0000000000E7A000-memory.dmp	family_hijackloader

HijackLoader
HijackLoader is a multistage loader first seen in 2023.
loader hijackloader

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3876	905c7a4a098ad5c0fae3b8f15fa5fa56a06372b7441aede1958ae1171e555b2a.exe

C:\Users\Admin\AppData\Local\Temp\905c7a4a098ad5c0fae3b8f15fa5fa56a06372b7441aede1958ae1171e555b2a.exe
"C:\Users\Admin\AppData\Local\Temp\905c7a4a098ad5c0fae3b8f15fa5fa56a06372b7441aede1958ae1171e555b2a.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3876

memory/3876-0-0x0000000000D20000-0x0000000000E7A000-memory.dmp

Filesize
1.4MB

Download
memory/3876-1-0x00000000751C0000-0x000000007533D000-memory.dmp

Filesize
1.5MB

Download