hijackloader | 84cb265ff3b5bd7774b1c513247a24c13162965eaa79d0856ca04050c24767bb

Analysis

max time kernel
45s
max time network
18s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
06-08-2024 00:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

snss2.exe
Size

4.1MB
MD5

8f3ada84646389b58a1d56563590e15d
SHA1

2230612bc79af9cf5d3f9a90dec4e25e1e6bd337
SHA256

0eb210de184746374c86e743311787898f2df55c03e0ea5466b3a07a4db7325b
SHA512

fb536028de46484c2b2e751c21a03eb1db6022d88d9cc0d800c580bd3696b79b4d769f5c9bfcf911149f875319b1f0dfaa656ce471b59b6db05e5475a0a01a60
SSDEEP

98304:ZvMOJ+qABAVZvTrFbpKyXTp/8zf8R9Mr4/Eof:Z0ONk2ZPqyN/8zUs6d

Score

10^/10

hijackloader discovery loader

Malware Config

Signatures

Detects HijackLoader (aka IDAT Loader) 1 IoCs

resource	yara_rule
behavioral1/memory/2508-0-0x0000000000400000-0x0000000000578000-memory.dmp	family_hijackloader

HijackLoader
HijackLoader is a multistage loader first seen in 2023.
loader hijackloader

Deletes itself 1 IoCs

pid	Process
2316	cmd.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2508 set thread context of 2316	2508	snss2.exe	29

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snss2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2508	snss2.exe
2508	snss2.exe
2316	cmd.exe
2316	cmd.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2508	snss2.exe
2316	cmd.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 2316	2508	snss2.exe	29
PID 2508 wrote to memory of 2316	2508	snss2.exe	29
PID 2508 wrote to memory of 2316	2508	snss2.exe	29
PID 2508 wrote to memory of 2316	2508	snss2.exe	29
PID 2508 wrote to memory of 2316	2508	snss2.exe	29
PID 2316 wrote to memory of 2200	2316	cmd.exe	31
PID 2316 wrote to memory of 2200	2316	cmd.exe	31
PID 2316 wrote to memory of 2200	2316	cmd.exe	31
PID 2316 wrote to memory of 2200	2316	cmd.exe	31
PID 2316 wrote to memory of 2200	2316	cmd.exe	31

C:\Users\Admin\AppData\Local\Temp\snss2.exe
"C:\Users\Admin\AppData\Local\Temp\snss2.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\SysWOW64\cmd.exe
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2316
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1b54f884

Filesize
1.1MB

MD5
3f8f2ed496ac108a32ffe53d754e2046

SHA1
021ac6da858ba8860917ad8951ba25f4e2011435

SHA256
795796fd225cd9e56113ad7b6f81ccb780f0a8ca3345b4ca0e04c478f1cdb2a9

SHA512
f006b61a41481fe4b3b86ba9856e9bb97ea746dcb87d32bfc4884566196b6cff588e8fb52d164a234ed95d93fdee0b2276a9df717738d9b66a056f92a4c1345a

Download Submit
memory/2200-18-0x0000000000380000-0x0000000000400000-memory.dmp

Filesize
512KB

Download
memory/2200-16-0x0000000000380000-0x0000000000400000-memory.dmp

Filesize
512KB

Download
memory/2200-15-0x0000000077950000-0x0000000077AF9000-memory.dmp

Filesize
1.7MB

Download
memory/2200-14-0x0000000000380000-0x0000000000400000-memory.dmp

Filesize
512KB

Download
memory/2316-9-0x0000000077950000-0x0000000077AF9000-memory.dmp

Filesize
1.7MB

Download
memory/2316-7-0x0000000074AD0000-0x0000000074C44000-memory.dmp

Filesize
1.5MB

Download
memory/2316-10-0x0000000074AD0000-0x0000000074C44000-memory.dmp

Filesize
1.5MB

Download
memory/2316-11-0x0000000074AD0000-0x0000000074C44000-memory.dmp

Filesize
1.5MB

Download
memory/2316-13-0x0000000074AD0000-0x0000000074C44000-memory.dmp

Filesize
1.5MB

Download
memory/2508-5-0x0000000074AD0000-0x0000000074C44000-memory.dmp

Filesize
1.5MB

Download
memory/2508-0-0x0000000000400000-0x0000000000578000-memory.dmp

Filesize
1.5MB

Download
memory/2508-3-0x0000000074AE3000-0x0000000074AE5000-memory.dmp

Filesize
8KB

Download
memory/2508-4-0x0000000074AD0000-0x0000000074C44000-memory.dmp

Filesize
1.5MB

Download
memory/2508-2-0x0000000077950000-0x0000000077AF9000-memory.dmp

Filesize
1.7MB

Download
memory/2508-1-0x0000000074AD0000-0x0000000074C44000-memory.dmp

Filesize
1.5MB

Download