hijackloader | 5e1d6ad789a0eb935612cdafd0f9621d925e611f47ba1befb72de0491edcd36f

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2024 03:34

Target

905c7a4a098ad5c0fae3b8f15fa5fa56a06372b7441aede1958ae1171e555b2a.exe
Size

1.3MB
MD5

fa854b73b477f55bd2faa482ba8e8fc4
SHA1

056fb1cdf016ac6d510425ae4dc1693f257dc12e
SHA256

905c7a4a098ad5c0fae3b8f15fa5fa56a06372b7441aede1958ae1171e555b2a
SHA512

fe1b5c9c6a709b34687e35745bd7662aaff0bf816aedb4f59a68714c4797034e1472c667611eb10fb687916e899613fbb79d692a11cc5e074fce5a2ba1ee54c5
SSDEEP

24576:ZtnIMSJmXTYznHLtEqzH+qrjQYgkIuIcDH7IueXN5CUaCWyOVyOckiAhUcMkiAhl:ZtIMvE7rtz7+q/QYgkIu3DHkuedz6rVl

Score

10^/10

Detects HijackLoader (aka IDAT Loader) 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2288-0-0x00000000000B0000-0x000000000020A000-memory.dmp	family_hijackloader

HijackLoader
HijackLoader is a multistage loader first seen in 2023.
loader hijackloader
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

905c7a4a098ad5c0fae3b8f15fa5fa56a06372b7441aede1958ae1171e555b2a.exe

pid process

2288 905c7a4a098ad5c0fae3b8f15fa5fa56a06372b7441aede1958ae1171e555b2a.exe

pid	process
2288	905c7a4a098ad5c0fae3b8f15fa5fa56a06372b7441aede1958ae1171e555b2a.exe

C:\Users\Admin\AppData\Local\Temp\905c7a4a098ad5c0fae3b8f15fa5fa56a06372b7441aede1958ae1171e555b2a.exe
"C:\Users\Admin\AppData\Local\Temp\905c7a4a098ad5c0fae3b8f15fa5fa56a06372b7441aede1958ae1171e555b2a.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2288

memory/2288-0-0x00000000000B0000-0x000000000020A000-memory.dmp

Filesize
1.4MB

Download
memory/2288-1-0x00000000754A0000-0x000000007561B000-memory.dmp

Filesize
1.5MB

Download