Analysis
-
max time kernel
77s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
07-10-2024 19:56
Behavioral task
behavioral1
Sample
63826a55c4068856273858fd7537d57543df7d713426866d9b8df566ccbe8f35.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
63826a55c4068856273858fd7537d57543df7d713426866d9b8df566ccbe8f35.exe
Resource
win10v2004-20241007-en
General
-
Target
63826a55c4068856273858fd7537d57543df7d713426866d9b8df566ccbe8f35.exe
-
Size
5.6MB
-
MD5
4d93ef870fb716fc1b3e05548d41d528
-
SHA1
ae2d44dfb6ad8a7d1e38d7b7f368ffa4763265c9
-
SHA256
63826a55c4068856273858fd7537d57543df7d713426866d9b8df566ccbe8f35
-
SHA512
b00184c4fa30d6d9ae8e7365925ecfa2d87c22e21ef609bc2ce135d998668da79671d2839508674ad638859b35af38f14d3752ec767b5cbc4a8c292e011c57fe
-
SSDEEP
98304:UUd9FTuBYxHs4+b4EmeICxgHxC6qz1loJoYFqQ5dn6uqhAoCVtxnz+oEIWoJd:5FTnM44YCxwxmzLOFfdrq+P/xnCoEIW2
Malware Config
Signatures
-
Detects HijackLoader (aka IDAT Loader) 1 IoCs
resource yara_rule behavioral1/memory/320-0-0x0000000000400000-0x0000000000561000-memory.dmp family_hijackloader -
HijackLoader
HijackLoader is a multistage loader first seen in 2023.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 63826a55c4068856273858fd7537d57543df7d713426866d9b8df566ccbe8f35.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 320 63826a55c4068856273858fd7537d57543df7d713426866d9b8df566ccbe8f35.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\63826a55c4068856273858fd7537d57543df7d713426866d9b8df566ccbe8f35.exe"C:\Users\Admin\AppData\Local\Temp\63826a55c4068856273858fd7537d57543df7d713426866d9b8df566ccbe8f35.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:320