Overview

overview

10

Static

static

10

neroAacEnc.exe

windows7-x64

10

neroAacEnc.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    neroAacEnc.exe

  • Size

    15.2MB

  • Sample

    240727-ys84bsyelb

  • MD5

    9bf782afcc591d031b253116ac34051b

  • SHA1

    901764258a8f7322c9a4155f70e48e9676c7691e

  • SHA256

    318a4e426669f90ff9b6107f56f0ed47616d9da1335473c8f9f41073ca2d694d

  • SHA512

    dacc38e7d1fd9d60b6700ed5d28d2aa3283766157e84399f9e6b98161d399b32a8c8ea6846ec932b4c8a13e3690c7b2bc6db17d62f47d9ac22f74cf8dc59400c

  • SSDEEP

    393216:Lwi3tIkSzBOms76P5jAkCQBIVO3JDps+ziMlbMhrC+lFaiNFjU7AWt:BtuOu5AFQ+0ps++MlAn61

Score
10/10
hijackloaderdiscoveryexecutionloaderpersistence

Malware Config

Targets

    • Target

      neroAacEnc.exe

    • Size

      15.2MB

    • MD5

      9bf782afcc591d031b253116ac34051b

    • SHA1

      901764258a8f7322c9a4155f70e48e9676c7691e

    • SHA256

      318a4e426669f90ff9b6107f56f0ed47616d9da1335473c8f9f41073ca2d694d

    • SHA512

      dacc38e7d1fd9d60b6700ed5d28d2aa3283766157e84399f9e6b98161d399b32a8c8ea6846ec932b4c8a13e3690c7b2bc6db17d62f47d9ac22f74cf8dc59400c

    • SSDEEP

      393216:Lwi3tIkSzBOms76P5jAkCQBIVO3JDps+ziMlbMhrC+lFaiNFjU7AWt:BtuOu5AFQ+0ps++MlAn61

    Score
    10/10
    hijackloaderdiscoveryloaderexecutionpersistence

    • Detects HijackLoader (aka IDAT Loader)

    • HijackLoader

      HijackLoader is a multistage loader first seen in 2023.

      loaderhijackloader

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Sets service image path in registry

      persistence

    • Deletes itself

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks