hijackloader | 84cb265ff3b5bd7774b1c513247a24c13162965eaa79d0856ca04050c24767bb

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
06-08-2024 00:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

snss2.exe
Size

4.1MB
MD5

8f3ada84646389b58a1d56563590e15d
SHA1

2230612bc79af9cf5d3f9a90dec4e25e1e6bd337
SHA256

0eb210de184746374c86e743311787898f2df55c03e0ea5466b3a07a4db7325b
SHA512

fb536028de46484c2b2e751c21a03eb1db6022d88d9cc0d800c580bd3696b79b4d769f5c9bfcf911149f875319b1f0dfaa656ce471b59b6db05e5475a0a01a60
SSDEEP

98304:ZvMOJ+qABAVZvTrFbpKyXTp/8zf8R9Mr4/Eof:Z0ONk2ZPqyN/8zUs6d

Score

10^/10

hijackloader discovery loader

Malware Config

Signatures

Detects HijackLoader (aka IDAT Loader) 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2752-0-0x0000000000400000-0x0000000000578000-memory.dmp	family_hijackloader

HijackLoader
HijackLoader is a multistage loader first seen in 2023.
loader hijackloader

Deletes itself 1 IoCs

Processes:

cmd.exe

pid	Process
2836	cmd.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

snss2.exe

description	pid	Process	procid_target
PID 2752 set thread context of 2836	2752	snss2.exe	30

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

cmd.exeexplorer.exesnss2.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snss2.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

snss2.execmd.exe

pid	Process
2752	snss2.exe
2752	snss2.exe
2836	cmd.exe
2836	cmd.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

snss2.execmd.exe

pid	Process
2752	snss2.exe
2836	cmd.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

snss2.execmd.exe

description	pid	Process	procid_target
PID 2752 wrote to memory of 2836	2752	snss2.exe	30
PID 2752 wrote to memory of 2836	2752	snss2.exe	30
PID 2752 wrote to memory of 2836	2752	snss2.exe	30
PID 2752 wrote to memory of 2836	2752	snss2.exe	30
PID 2752 wrote to memory of 2836	2752	snss2.exe	30
PID 2836 wrote to memory of 2732	2836	cmd.exe	32
PID 2836 wrote to memory of 2732	2836	cmd.exe	32
PID 2836 wrote to memory of 2732	2836	cmd.exe	32
PID 2836 wrote to memory of 2732	2836	cmd.exe	32
PID 2836 wrote to memory of 2732	2836	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\snss2.exe
"C:\Users\Admin\AppData\Local\Temp\snss2.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\SysWOW64\cmd.exe
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2836
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1a30fd00

Filesize
1.1MB

MD5
025c9f91332e5c15983b7fa15cc95d17

SHA1
e32b4443fd5530527bbb6b70bb28a83dbaf5a021

SHA256
3c65930df63bd0d65942c83953473c2e1ebb11c4bbdd1cedadafa5a4ab0b481b

SHA512
231bd9a928e5ad9d2e1a89a7c4f3f4696cf9226266b804a15559a5bedca16061a276719f1fca039cf4a0b3509f4db1a2fe46e8b916ecf1a564f81eed2cbebd28

Download Submit
memory/2732-12-0x0000000000080000-0x0000000000100000-memory.dmp

Filesize
512KB

Download
memory/2732-17-0x0000000000080000-0x0000000000100000-memory.dmp

Filesize
512KB

Download
memory/2732-15-0x0000000000080000-0x0000000000100000-memory.dmp

Filesize
512KB

Download
memory/2732-14-0x00000000776F0000-0x0000000077899000-memory.dmp

Filesize
1.7MB

Download
memory/2752-1-0x0000000074850000-0x00000000749C4000-memory.dmp

Filesize
1.5MB

Download
memory/2752-2-0x00000000776F0000-0x0000000077899000-memory.dmp

Filesize
1.7MB

Download
memory/2752-3-0x0000000074850000-0x00000000749C4000-memory.dmp

Filesize
1.5MB

Download
memory/2752-0-0x0000000000400000-0x0000000000578000-memory.dmp

Filesize
1.5MB

Download
memory/2836-7-0x00000000776F0000-0x0000000077899000-memory.dmp

Filesize
1.7MB

Download
memory/2836-11-0x0000000074850000-0x00000000749C4000-memory.dmp

Filesize
1.5MB

Download
memory/2836-13-0x0000000074851000-0x000000007485F000-memory.dmp

Filesize
56KB

Download
memory/2836-9-0x0000000074850000-0x00000000749C4000-memory.dmp

Filesize
1.5MB

Download
memory/2836-8-0x0000000074850000-0x00000000749C4000-memory.dmp

Filesize
1.5MB

Download
memory/2836-5-0x0000000074851000-0x000000007485F000-memory.dmp

Filesize
56KB

Download