hijackloader | 29dd77f0013ecbb29bd195d3b35b41d8e684e9044aff886373babf5b8f70fc9b

Analysis

max time kernel
137s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
26-10-2024 02:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-10-26_d5c8e02ae89291f7124be813136aafeb_magniber.exe
Size

13.0MB
MD5

d5c8e02ae89291f7124be813136aafeb
SHA1

01c7c9edab95208062cb018fda5ac2bf0483bdef
SHA256

29dd77f0013ecbb29bd195d3b35b41d8e684e9044aff886373babf5b8f70fc9b
SHA512

be18a14f6d2615ae25640e52e961986810d0c135db3a27dfbf894dd78b5d34583eded9d90f9f26d322143860ce3bd597054c122126c9b2d39e73bc24a0df9a55
SSDEEP

196608:7ppYohz43D+vplN8OrfaV+1PbmKaqPQw0uLEW1:7ppYYz43DcC8VbiqIw0uIW1

Score

10^/10

hijackloader discovery loader

Malware Config

Signatures

Detects HijackLoader (aka IDAT Loader) 1 IoCs

resource	yara_rule
behavioral2/memory/1356-17-0x00000000008D0000-0x00000000015D9000-memory.dmp	family_hijackloader

HijackLoader
HijackLoader is a multistage loader first seen in 2023.
loader hijackloader
Hijackloader family
hijackloader

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1356	2024-10-26_d5c8e02ae89291f7124be813136aafeb_magniber.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-26_d5c8e02ae89291f7124be813136aafeb_magniber.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1356	2024-10-26_d5c8e02ae89291f7124be813136aafeb_magniber.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1356	2024-10-26_d5c8e02ae89291f7124be813136aafeb_magniber.exe

C:\Users\Admin\AppData\Local\Temp\2024-10-26_d5c8e02ae89291f7124be813136aafeb_magniber.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-26_d5c8e02ae89291f7124be813136aafeb_magniber.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\System-G\settings.ini

Filesize
144B

MD5
08b14bd8d0f13e0fdd41c584a18f761e

SHA1
08d864c414c4d58c20a3cf12c21f69d03ae09c41

SHA256
15bcfff27846412c206acbc9de771e7d870870a47ca7589ed0a94bce9734ea36

SHA512
d6e3b21051367f20f6bbacfb0da028927f7d80adefd54855e348fec33315268df9a6903468d495f91dde7ca3ef1fdf71aa51b718302d03711d97a74f96274b6a

Download Submit
C:\Users\Admin\AppData\Roaming\System-G\settings.ini

Filesize
113B

MD5
d424b79f0f6e7578130bde9717418b68

SHA1
d3b19ade5da4a77fdab6521f7f9082731541be68

SHA256
aab5bbf6ef513f929ff13e12ea591dfbb2d619abaa24ed0dc02a91c0bc6922a5

SHA512
1d97d78db575153e7fa4761f90a01f8a01f9316a631f0d810cf05847ab81773fba31ab02c87be930a90ecbcbb286eb1aaee7846eaf0af28f37ed16c7c3f8ed34

Download Submit
memory/1356-17-0x00000000008D0000-0x00000000015D9000-memory.dmp

Filesize
13.0MB

Download
memory/1356-18-0x0000000073AF0000-0x0000000073C6B000-memory.dmp

Filesize
1.5MB

Download