hijackloader | 294e7740b29b6752803a6cffb86677472b72fcb96e3011f02e25ae80af5a2695

General

Target

0x000b00000001e4ef-846.exe
Size

5.6MB
MD5

f659a0d8ebd02ee8ee6eb70cef397cd7
SHA1

78c4038cd147d6e14cb0255e7ff170d477e9eca4
SHA256

307abb12c62dd8421cedfe6a11475e742caaae82faf9cb14d9812772edefe8d7
SHA512

ae5275a56c782960d7d3efdd32d8458300b763114d040723b363f51dbd77ae6e371ef3d4081745feac202890284c77ddf8e796289a473eb43b998172b6eaddb9
SSDEEP

98304:AUd98EKniqMUs8RVe0jHs4+b4EmeICxgHxC6qz1loJoYFqQ5dn6uqhAoCVtxnz+C:F8sn+RVJM44YCxwxmzLOFfdrq+P/xnCC

Score

10^/10

hijackloader stealc benjiworld29 discovery loader stealer

Malware Config

Extracted

Family

stealc

Botnet

benjiworld29

C2

http://45.159.208.21

Attributes

url_path
/e24f48bbd86dab7e.php

Signatures

Detects HijackLoader (aka IDAT Loader) 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2892-0-0x0000000000400000-0x0000000000561000-memory.dmp	family_hijackloader

HijackLoader
HijackLoader is a multistage loader first seen in 2023.
loader hijackloader
Hijackloader family
hijackloader
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2792 cmd.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

0x000b00000001e4ef-846.exe

description pid process target process

PID 2892 set thread context of 2792 2892 0x000b00000001e4ef-846.exe cmd.exe

pid	process
2792	cmd.exe

description	pid	process	target process
PID 2892 set thread context of 2792	2892	0x000b00000001e4ef-846.exe	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

cmd.exeexplorer.exe0x000b00000001e4ef-846.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0x000b00000001e4ef-846.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

0x000b00000001e4ef-846.execmd.exe

pid process

2892 0x000b00000001e4ef-846.exe
2892 0x000b00000001e4ef-846.exe
2792 cmd.exe
2792 cmd.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

0x000b00000001e4ef-846.execmd.exe

pid process

2892 0x000b00000001e4ef-846.exe
2792 cmd.exe

pid	process
2892	0x000b00000001e4ef-846.exe
2892	0x000b00000001e4ef-846.exe
2792	cmd.exe
2792	cmd.exe

pid	process
2892	0x000b00000001e4ef-846.exe
2792	cmd.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

0x000b00000001e4ef-846.execmd.exe

description	pid	process	target process
PID 2892 wrote to memory of 2792	2892	0x000b00000001e4ef-846.exe	cmd.exe
PID 2892 wrote to memory of 2792	2892	0x000b00000001e4ef-846.exe	cmd.exe
PID 2892 wrote to memory of 2792	2892	0x000b00000001e4ef-846.exe	cmd.exe
PID 2892 wrote to memory of 2792	2892	0x000b00000001e4ef-846.exe	cmd.exe
PID 2892 wrote to memory of 2792	2892	0x000b00000001e4ef-846.exe	cmd.exe
PID 2792 wrote to memory of 436	2792	cmd.exe	explorer.exe
PID 2792 wrote to memory of 436	2792	cmd.exe	explorer.exe
PID 2792 wrote to memory of 436	2792	cmd.exe	explorer.exe
PID 2792 wrote to memory of 436	2792	cmd.exe	explorer.exe
PID 2792 wrote to memory of 436	2792	cmd.exe	explorer.exe

C:\Users\Admin\AppData\Local\Temp\0x000b00000001e4ef-846.exe
"C:\Users\Admin\AppData\Local\Temp\0x000b00000001e4ef-846.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2892
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\SysWOW64\cmd.exe
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2792
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\241ffb63

Filesize
1.0MB

MD5
c75ae98538d18a00c43e477062f68979

SHA1
b3b208827b91e10e47c9fd911f4801d1ce2cdf3d

SHA256
ca09d09fa9350db8504636004e1e2c931f28e4d26169462a837f1602e701ba4d

SHA512
8b8cd8573585727cac06c06ac2a7de10f6d8a37d20e6af27fef65e434e81ceb702bedf333eebf0eefba76612e2015faaa99314cf926ad5bd5825062b994d1de8

Download Submit
memory/436-22-0x0000000000400000-0x0000000000663000-memory.dmp

Filesize
2.4MB

Download
memory/436-21-0x0000000000DB0000-0x0000000001031000-memory.dmp

Filesize
2.5MB

Download
memory/436-20-0x0000000000DE0000-0x0000000000DE8000-memory.dmp

Filesize
32KB

Download
memory/436-18-0x0000000000400000-0x0000000000663000-memory.dmp

Filesize
2.4MB

Download
memory/436-17-0x0000000076E40000-0x0000000076FE9000-memory.dmp

Filesize
1.7MB

Download
memory/436-16-0x0000000000400000-0x0000000000663000-memory.dmp

Filesize
2.4MB

Download
memory/2792-15-0x0000000073FF0000-0x0000000074164000-memory.dmp

Filesize
1.5MB

Download
memory/2792-8-0x0000000073FF0000-0x0000000074164000-memory.dmp

Filesize
1.5MB

Download
memory/2792-10-0x0000000076E40000-0x0000000076FE9000-memory.dmp

Filesize
1.7MB

Download
memory/2792-13-0x0000000073FF0000-0x0000000074164000-memory.dmp

Filesize
1.5MB

Download
memory/2792-12-0x0000000073FF0000-0x0000000074164000-memory.dmp

Filesize
1.5MB

Download
memory/2892-0-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/2892-6-0x0000000073FF0000-0x0000000074164000-memory.dmp

Filesize
1.5MB

Download
memory/2892-5-0x0000000074003000-0x0000000074005000-memory.dmp

Filesize
8KB

Download
memory/2892-4-0x0000000073FF0000-0x0000000074164000-memory.dmp

Filesize
1.5MB

Download
memory/2892-3-0x0000000074003000-0x0000000074005000-memory.dmp

Filesize
8KB

Download
memory/2892-2-0x0000000076E40000-0x0000000076FE9000-memory.dmp

Filesize
1.7MB

Download
memory/2892-1-0x0000000073FF0000-0x0000000074164000-memory.dmp

Filesize
1.5MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads