Analysis
-
max time kernel
112s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
30-09-2024 18:10
Behavioral task
behavioral1
Sample
a834be6d2bec10f39019606451b507742b7e87ac8d19dc0643ae58df183f773c.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
a834be6d2bec10f39019606451b507742b7e87ac8d19dc0643ae58df183f773c.exe
Resource
win10v2004-20240802-en
General
-
Target
a834be6d2bec10f39019606451b507742b7e87ac8d19dc0643ae58df183f773c.exe
-
Size
5.6MB
-
MD5
0ba52a085647724ae6b56e29bab4af6e
-
SHA1
1ee26f6cb803f456ba019ebae8eb818f0e48a962
-
SHA256
a834be6d2bec10f39019606451b507742b7e87ac8d19dc0643ae58df183f773c
-
SHA512
3e134ccc89d9c7ad7921cbcce9ff139e2ce0f9cb10471c5410215a331dd7ad4bda365cb8f4369e5a8200c7662a31126b4a8e9de354e1c5df5093a5740f93d645
-
SSDEEP
98304:UUd9YlH/tdi0YUxHs4+b4EmeICxgHxC6qz1loJoYFqQ5dn6uqhAoCVtxnz+oEIW2:5Y51E0YUxM44YCxwxmzLOFfdrq+P/xnF
Malware Config
Signatures
-
Detects HijackLoader (aka IDAT Loader) 1 IoCs
resource yara_rule behavioral2/memory/4848-0-0x0000000000400000-0x0000000000561000-memory.dmp family_hijackloader -
HijackLoader
HijackLoader is a multistage loader first seen in 2023.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a834be6d2bec10f39019606451b507742b7e87ac8d19dc0643ae58df183f773c.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 4848 a834be6d2bec10f39019606451b507742b7e87ac8d19dc0643ae58df183f773c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a834be6d2bec10f39019606451b507742b7e87ac8d19dc0643ae58df183f773c.exe"C:\Users\Admin\AppData\Local\Temp\a834be6d2bec10f39019606451b507742b7e87ac8d19dc0643ae58df183f773c.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4848