hijackloader | 049e835c0ebafb4d0a636ff89f341c9280ed79ad993af8e14b608b5b73b4e891

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
31-08-2024 07:05

Target

049e835c0ebafb4d0a636ff89f341c9280ed79ad993af8e14b608b5b73b4e891.exe
Size

10.5MB
MD5

0c42621d23abebc027c444fce80ca13f
SHA1

6db176310107a0da4f959a6fb20a43aff482c0b2
SHA256

049e835c0ebafb4d0a636ff89f341c9280ed79ad993af8e14b608b5b73b4e891
SHA512

89c94009e5c4bad7a273f4668a5fe4b1cba061cbb07bbfc7fd3fed1e506985e03d80dd043f4593c7973e7a6aa5edfd950bd36102e7396b042138201a0768567e
SSDEEP

196608:R6jhaH4kFlbog8JldaO47cf+hJnVk71ykTFj23OcTt9xUNye+GlFkFv:R6Nq8J7aOOcmzO74+Fj2+Mre+wFkFv

Score

10^/10

Detects HijackLoader (aka IDAT Loader) 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1908-0-0x000000013F7A0000-0x000000014021D000-memory.dmp	family_hijackloader

HijackLoader
HijackLoader is a multistage loader first seen in 2023.
loader hijackloader
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

049e835c0ebafb4d0a636ff89f341c9280ed79ad993af8e14b608b5b73b4e891.exe

pid process

1908 049e835c0ebafb4d0a636ff89f341c9280ed79ad993af8e14b608b5b73b4e891.exe

pid	process
1908	049e835c0ebafb4d0a636ff89f341c9280ed79ad993af8e14b608b5b73b4e891.exe

C:\Users\Admin\AppData\Local\Temp\049e835c0ebafb4d0a636ff89f341c9280ed79ad993af8e14b608b5b73b4e891.exe
"C:\Users\Admin\AppData\Local\Temp\049e835c0ebafb4d0a636ff89f341c9280ed79ad993af8e14b608b5b73b4e891.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1908

memory/1908-0-0x000000013F7A0000-0x000000014021D000-memory.dmp

Filesize
10.5MB

Download
memory/1908-1-0x000007FEF6680000-0x000007FEF67D8000-memory.dmp

Filesize
1.3MB

Download