hijackloader | b94ecfae3b5514ba1dc5c10faf595527159a535b5c326b39cb42185e6ef6d477 | Triage

Resubmissions

13-02-2025 14:36

250213-ryptbazlcy 10

13-02-2025 12:03

250213-n75dksyjat 10

Sharing

General

Target

b94ecfae3b5514ba1dc5c10faf595527159a535b5c326b39cb42185e6ef6d477.exe
Size

10.9MB
Sample

250213-n75dksyjat
MD5

c836c14219ca56536439cc008608740f
SHA1

a4e237dbd668e757595084872a921746edbcd418
SHA256

b94ecfae3b5514ba1dc5c10faf595527159a535b5c326b39cb42185e6ef6d477
SHA512

d03cf84096cf6b34be6fa15f18a0e8b721b2f9400d1dd95f7e584b27c938c6b4f3ec72dd424c4f81d9af5917c607d8ae3c00c2e321b571d2ace024110a6a66d6
SSDEEP

196608:JrH67uot0SW/ZA9SL3oSzC1/OxwnIBSnCITfLb8MAFGrCaPiqXpAo83jVolDN/+K:Jvo2nZA9SMSzCl7YSnC8fLbUGr0UAH34

Score

10^/10

hijackloader defense_evasion discovery loader persistence privilege_escalation

Malware Config

Targets

- Target
  
  b94ecfae3b5514ba1dc5c10faf595527159a535b5c326b39cb42185e6ef6d477.exe
- Size
  
  10.9MB
- MD5
  
  c836c14219ca56536439cc008608740f
- SHA1
  
  a4e237dbd668e757595084872a921746edbcd418
- SHA256
  
  b94ecfae3b5514ba1dc5c10faf595527159a535b5c326b39cb42185e6ef6d477
- SHA512
  
  d03cf84096cf6b34be6fa15f18a0e8b721b2f9400d1dd95f7e584b27c938c6b4f3ec72dd424c4f81d9af5917c607d8ae3c00c2e321b571d2ace024110a6a66d6
- SSDEEP
  
  196608:JrH67uot0SW/ZA9SL3oSzC1/OxwnIBSnCITfLb8MAFGrCaPiqXpAo83jVolDN/+K:Jvo2nZA9SMSzCl7YSnC8fLbUGr0UAH34
Score

10^/10

hijackloader defense_evasion discovery loader persistence privilege_escalation
- Detects HijackLoader (aka IDAT Loader)
- HijackLoader
  HijackLoader is a multistage loader first seen in 2023.
  loader hijackloader
- Hijackloader family
  hijackloader
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Indicator Removal

File Deletion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

hijackloaderdefense_evasiondiscoveryloaderpersistenceprivilege_escalation

behavioral2

hijackloaderdefense_evasiondiscoveryloaderpersistenceprivilege_escalation