hijackloader | c35bb19ea8c10d9bdf35de591a4113ce2e26442a9e670784546c8b5209b53fed

General

Target
DirtyGames.exe
Size 11.4MB
Sample260511-xcskzacs8m
SHA256 c35bb19ea8c10d9bdf35de591a4113ce2e26442a9e670784546c8b5209b53fed
MD5 10ddfa8127cf1d32e3843de2506c4480
SHA1 3acd79ebcbb76ab1975361bc11f432e9dd46faad
SHA512 b7ff6f368e278ba06d6f1951ee18da3cb92b9b1bdedbeaed11e1977e778f091cca75e6a3186096b37d70ff51f29343288158f2c657a0be93af295e7869dad622
SSDEEP 196608:Jp3Ob744vdieLOihhv5+ZLZe3t4b+G5PoUc7AQ9tKiy1r0hgAXwO/FxZs1rF8l:Jp3844VYiDUQ3t4bvBq/n0AXwO/FPs1k
TLSH
T118C63383E8E8C6F6E1FC577160BE241100FAA57B8186049A35C5AF4D0FFB54FA636A53
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\foundation_engine_v7
inject_dll
%windir%\SysWOW64\input.dll

xor.hex

Targets

- Target
  DirtyGames.exe
- Size 11.4MB
- SHA256 c35bb19ea8c10d9bdf35de591a4113ce2e26442a9e670784546c8b5209b53fed
- MD5 10ddfa8127cf1d32e3843de2506c4480
- SHA1 3acd79ebcbb76ab1975361bc11f432e9dd46faad
- SHA512 b7ff6f368e278ba06d6f1951ee18da3cb92b9b1bdedbeaed11e1977e778f091cca75e6a3186096b37d70ff51f29343288158f2c657a0be93af295e7869dad622
- SSDEEP 196608:Jp3Ob744vdieLOihhv5+ZLZe3t4b+G5PoUc7AQ9tKiy1r0hgAXwO/FxZs1rF8l:Jp3844VYiDUQ3t4bvBq/n0AXwO/FPs1k
- TLSH
  T118C63383E8E8C6F6E1FC577160BE241100FAA57B8186049A35C5AF4D0FFB54FA636A53
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery hijackloader loader
- Detects HijackLoader (aka IDAT Loader)
- Family: HijackLoader, IDAT loader, Ghostulse,
  HijackLoader is a multi-stage loader, first seen in 2023.
  loader hijackloader
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Extracted

Targets

Detects HijackLoader (aka IDAT Loader)

Family: HijackLoader, IDAT loader, Ghostulse,

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3