hijackloader | 6f08d25994d6b37a4c711033e6b949ab66c15914952eb4c86efa504f727af635

Resubmissions

13-06-2024 03:14

240613-drjrtswcqk 10

12-06-2024 14:43

240612-r3q7yayelh 10

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
12-06-2024 14:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

mp.exe
Size

9.2MB
MD5

bbc886e8c9dde33980c382263b7ce8b8
SHA1

a5953c53277cfb3db60f8060fe6d69ca87dc8ee4
SHA256

6f08d25994d6b37a4c711033e6b949ab66c15914952eb4c86efa504f727af635
SHA512

f247523b095cd3259a18ec2866491385326d8ae92b4cba0f068822b06730c9b7a15b9773ac0cd043a7b06655b0fe29d9cca7d6559c4ce0f9241f0abfab592bee
SSDEEP

196608:wssBSXxz17OxBaQR5MetJ05SuN1qpJ1pRONksJp:wssBSXxzIBaQR525do1pRbkp

Score

10^/10

hijackloader stealc xprivate4 loader stealer

Malware Config

Extracted

Family

stealc

Botnet

xprivate4

http://45.88.77.186

Attributes

url_path
/93fc676dbd45174b.php

Signatures

Detects HijackLoader (aka IDAT Loader) 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2884-0-0x0000000140000000-0x0000000140943000-memory.dmp	family_hijackloader

HijackLoader
HijackLoader is a multistage loader first seen in 2023.
loader hijackloader
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2768 cmd.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

mp.exe

description pid process target process

PID 2884 set thread context of 2768 2884 mp.exe cmd.exe

pid	process
2768	cmd.exe

description	pid	process	target process
PID 2884 set thread context of 2768	2884	mp.exe	cmd.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	explorer.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

mp.execmd.exeexplorer.exe

pid process

2884 mp.exe
2884 mp.exe
2768 cmd.exe
2768 cmd.exe
2704 explorer.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

mp.execmd.exe

pid process

2884 mp.exe
2768 cmd.exe

pid	process
2884	mp.exe
2884	mp.exe
2768	cmd.exe
2768	cmd.exe
2704	explorer.exe

pid	process
2884	mp.exe
2768	cmd.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

mp.execmd.exe

description	pid	process	target process
PID 2884 wrote to memory of 2768	2884	mp.exe	cmd.exe
PID 2884 wrote to memory of 2768	2884	mp.exe	cmd.exe
PID 2884 wrote to memory of 2768	2884	mp.exe	cmd.exe
PID 2884 wrote to memory of 2768	2884	mp.exe	cmd.exe
PID 2884 wrote to memory of 2768	2884	mp.exe	cmd.exe
PID 2768 wrote to memory of 2704	2768	cmd.exe	explorer.exe
PID 2768 wrote to memory of 2704	2768	cmd.exe	explorer.exe
PID 2768 wrote to memory of 2704	2768	cmd.exe	explorer.exe
PID 2768 wrote to memory of 2704	2768	cmd.exe	explorer.exe
PID 2768 wrote to memory of 2704	2768	cmd.exe	explorer.exe
PID 2768 wrote to memory of 2704	2768	cmd.exe	explorer.exe

C:\Users\Admin\AppData\Local\Temp\mp.exe
"C:\Users\Admin\AppData\Local\Temp\mp.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2884

C:\Windows\SysWOW64\cmd.exe
C:\Windows\SysWOW64\cmd.exe
2⤵
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2768

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\8d347edf

Filesize
860KB

MD5
dcfe64d299f3c1a462064aaf9e266d43

SHA1
4d69a872084bc95c75e827fe3a99803da256365e

SHA256
ca996df2419ba74a8902e582b6445aac6dbac8ce3443f986edc37ee4f899aed3

SHA512
d7326902e80567725a6ae1f8fe9b12109a3823329d5a6dcaa1ab61908b9cb64ad7a08ce970fbde4a9edc8f3077991d938f0d9749a7a49cefd4fe6d53e5441f85

Download Submit
memory/2704-19-0x0000000000140000-0x0000000000148000-memory.dmp

Filesize
32KB

Download
memory/2704-20-0x0000000000110000-0x0000000000391000-memory.dmp

Filesize
2.5MB

Download
memory/2704-23-0x0000000000540000-0x000000000077C000-memory.dmp

Filesize
2.2MB

Download
memory/2704-21-0x0000000000540000-0x000000000077C000-memory.dmp

Filesize
2.2MB

Download
memory/2704-16-0x0000000000540000-0x000000000077C000-memory.dmp

Filesize
2.2MB

Download
memory/2704-14-0x0000000000540000-0x000000000077C000-memory.dmp

Filesize
2.2MB

Download
memory/2704-15-0x0000000077920000-0x0000000077AC9000-memory.dmp

Filesize
1.7MB

Download
memory/2704-24-0x0000000000540000-0x000000000077C000-memory.dmp

Filesize
2.2MB

Download
memory/2768-11-0x0000000075160000-0x00000000752D4000-memory.dmp

Filesize
1.5MB

Download
memory/2768-9-0x0000000075160000-0x00000000752D4000-memory.dmp

Filesize
1.5MB

Download
memory/2768-8-0x0000000077920000-0x0000000077AC9000-memory.dmp

Filesize
1.7MB

Download
memory/2768-22-0x000000007516E000-0x0000000075170000-memory.dmp

Filesize
8KB

Download
memory/2768-10-0x000000007516E000-0x0000000075170000-memory.dmp

Filesize
8KB

Download
memory/2768-13-0x0000000075160000-0x00000000752D4000-memory.dmp

Filesize
1.5MB

Download
memory/2884-3-0x000007FEF6FF0000-0x000007FEF7148000-memory.dmp

Filesize
1.3MB

Download
memory/2884-1-0x000007FEF6FF0000-0x000007FEF7148000-memory.dmp

Filesize
1.3MB

Download
memory/2884-2-0x000007FEF7008000-0x000007FEF7009000-memory.dmp

Filesize
4KB

Download
memory/2884-0-0x0000000140000000-0x0000000140943000-memory.dmp

Filesize
9.3MB

Download
memory/2884-6-0x000007FEF6FF0000-0x000007FEF7148000-memory.dmp

Filesize
1.3MB

Download