hijackloader | bea1766ca5951cc2e4f2af32f5f7b1455e1905288bd38b6e1ec3f69e1ed322d7

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/06/2026, 14:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmpdf_16oap.exe
Size 4.7MB
Sample260601-rf46aae12z
SHA256 bea1766ca5951cc2e4f2af32f5f7b1455e1905288bd38b6e1ec3f69e1ed322d7
MD5 ef8adce4db4ab4cb544078dbe4e481cb
SHA1 cf30bb084ed84f3d38e44efc9e9e626415569e68
SHA512 00fe194593442d1e103dee105d7500a9eccaee974f5426caf6ed78a30d0f7ad18106d6ae3cc482f768db6c799e61dc87064f0270ac04c106f371dd29f2622d57
SSDEEP 98304:ifUbLJuOVWDMqPbYQFv2+Wsy+rFfuZXR1JetBpoeg4w/y:ifUhuiq7lofYpP7
TLSH
T1E1362332A5A55033E7F102B7FA2C56347E7CD338175488A9E7D4AC1C7AB84826BB7253
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery hijackloader loader

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\managemake
inject_dll
%windir%\SysWOW64\pla.dll

xor.hex

Signatures

Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
loader hijackloader

Detects HijackLoader (aka IDAT Loader) 1 IoCs

resource	yara_rule
behavioral2/files/0x00070000000243a1-30.dat	family_hijackloader

Executes dropped EXE 3 IoCs

pid	Process
1476	tmpdf_16oap.exe
4496	BCobalt.exe
3196	BCobalt.exe

Loads dropped DLL 4 IoCs

pid	Process
1476	tmpdf_16oap.exe
4496	BCobalt.exe
4496	BCobalt.exe
4496	BCobalt.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpdf_16oap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpdf_16oap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BCobalt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BCobalt.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
4496	BCobalt.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3080 wrote to memory of 1476	3080	tmpdf_16oap.exe	84
PID 1476 wrote to memory of 4496	1476	tmpdf_16oap.exe	85
PID 4496 wrote to memory of 3196	4496	BCobalt.exe	102

C:\Users\Admin\AppData\Local\Temp\tmpdf_16oap.exe
"C:\Users\Admin\AppData\Local\Temp\tmpdf_16oap.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3080
- C:\Windows\Temp\{DE736D06-9C1A-4490-B351-0A998D8662E7}\.cr\tmpdf_16oap.exe
  "C:\Windows\Temp\{DE736D06-9C1A-4490-B351-0A998D8662E7}\.cr\tmpdf_16oap.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\tmpdf_16oap.exe" -burn.filehandle.attached=540 -burn.filehandle.self=548
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1476
- - C:\Windows\Temp\{4FAAF9BF-3120-4F2E-B648-8F4E982AF3BE}\.ba\BCobalt.exe
    "C:\Windows\Temp\{4FAAF9BF-3120-4F2E-B648-8F4E982AF3BE}\.ba\BCobalt.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4496
  - - C:\ProgramData\managemake\BCobalt.exe
      C:\ProgramData\managemake\BCobalt.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3196

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BCobalt.exe

Path C:\Windows\Temp\{4FAAF9BF-3120-4F2E-B648-8F4E982AF3BE}\.ba\BCobalt.exe
Size 335KB
SHA256 0f8fce66dfed696d8a39b985036b2932f1157400075293d60e9d1c9c408f3274
MD5 5137d6601d2e51f3954b1161aa0b35bd
SHA1 975c36ce8a5672f0f4400526d920b469fb4c37dc
SHA512 7df638ef72da4947aa5db505b3d74b09856277354e9c18598c3d24ffc8d199ca81bfe871e159d80ad3dc2f5b2e1badc07c96f55b597095592b953820b0fc3f5d
SSDEEP 6144:n+9mDgcrhARZ5e+HG+nIC53gZM3npTmu09jB79BwNq7O:n+mDKLrHpICuZim39jp9BMq7O
TLSH
T14D748D01BEB0847AE6A6863DD4BAA7630EF9BF510B3045D7A3803D69F83C2D15539727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Doonddoskret.lblh

Path C:\Windows\Temp\{4FAAF9BF-3120-4F2E-B648-8F4E982AF3BE}\.ba\Doonddoskret.lblh
Size 32KB
SHA256 adc0ff742374484abc7b5299101a617cad4ea83ae1e4f24e89ef7e8fa63566fb
MD5 48aead284cddb182309ad8023ffce753
SHA1 6e7022451907d0d4515799e1b7b424f2614ebd98
SHA512 7493fc4d0e2daa6d32c04dedc136cd14496c4a22c1c281d3d3cbc69890c38706dff1ae3c8bd1d5d71ff68e1890ff897a030710593d04c9082616876f41a0dfce
SSDEEP 768:Lo20kjxgzB36eQYuSObYh8CsVOtmi/dYySP1jywKRrM6eKUExs/De:LKmxgzHuLpVFi1M1+rhdUna
TLSH
T113E2FB6167AD2E4BF523BD3B86C0B157D946FDA62B66C0D5A9810F1F802DC90CE64B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jeal.mn

Path C:\Windows\Temp\{4FAAF9BF-3120-4F2E-B648-8F4E982AF3BE}\.ba\Jeal.mn
Size 3.1MB
SHA256 d37d08965fca248c7bc167380d338d6621f8a13c05bfbd04aef8e4263bb9d03a
MD5 977e489d0bd8841cc98598ccde9d8582
SHA1 0042bbfe676a2602f0762e2104e1cc6b0b8d8839
SHA512 03f82f44df28ea0b4b23293a3591eb6d4ac6892abaa26f4b374c36db0ea679b6ccc52607a26dd874566dd2ba5387da9b305db52d1acb38fd256aa05f19658dd6
SSDEEP 98304:zE2/2YwHYIIxYhE54b7CXc1HxFteOxw2hihiLYeESot:g2/0Hl2XgXSvQQ
TLSH
T136E53362D4EE2C72E2165EF508F17A9B738424AD9B3F7D6268DC28F95CE838544113B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windscreen.dll

Path C:\Windows\Temp\{4FAAF9BF-3120-4F2E-B648-8F4E982AF3BE}\.ba\Windscreen.dll
Size 1.2MB
SHA256 46f1bc1cdbff04ae30643acebc3f8a6bcb8acd71c045029857f75682485edf09
MD5 e217e020ce91762e4b5965000cee2169
SHA1 27e71536043990cd0f18e3ad1260e6009c28254e
SHA512 6fb4537604c703ad61221b9ec4534bba03655ca89493e36557fce710cb4bf6b3680f3ecbbd797dd5e16fdff38d3737b14018c7b5bc1ba49aa6888e79f87c11b7
SSDEEP 12288:msndR3FgMspJ5aWBeQuO4tvaPWE3cxWf59kSDNF+Nx+X9xvSNb76gQa2HgUkEtK:ms/3Xs1X/WrAf5ZxFIx+/6FQa2A1E
TLSH
T1E34529316AD98434E9FB23707A6CB26692BDF0715B3280CB628427DE9D75AC05E307D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ies_Core.dll

Path C:\Windows\Temp\{4FAAF9BF-3120-4F2E-B648-8F4E982AF3BE}\.ba\ies_Core.dll
Size 1.1MB
SHA256 874dbdf4fa71215b7400e4299eaa87c3c744446c5eeff30245ca9760f1d494cf
MD5 7c84907a9f66d701221be31a26d37ef2
SHA1 0194e103834f019275356b50e234594ba758f761
SHA512 935754cf4b7dde35cc78dab9a204b5fffd30f17247c5cf09ea9524754ac190b5050f407e2707d855dcecc42afa4e739f67cf0afcae09937fd0b6ab7dd2c575e6
SSDEEP 24576:9cFvSHsz+jFmXWrg5S3pB0Lo7ungBXQti/ym39BHM7N:qEHVjFmb5S3pB0U7unOXE+ymc
TLSH
T150456C81BA82A2B1EA6E1DB05125FF97813EBB90D1D4C2F779C40C7A5E03ED643B3651
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ies_Netw.dll

Path C:\Windows\Temp\{4FAAF9BF-3120-4F2E-B648-8F4E982AF3BE}\.ba\ies_Netw.dll
Size 150KB
SHA256 19068d94c8314ddc21e15aa7983c3d4703df14c18eb150d4fff2dd3a70bbad89
MD5 8cb02f24f5d21baaa13a1da980dcec68
SHA1 9b5afc4267266533735b5e3356719a0b14759d1b
SHA512 54f33c5a44a03dfa1cd808aedb499f8205b301afb1c5b9c5a82bd739388ae3a2f2556f05ae74fc9d8f6c869a60851559b0e2d4920b9d49929b254744549e32da
SSDEEP 3072:Ol1ffgnLGR0CzPKf1Gxg47sSz4r/9jBciy27QglBJAglMW7K:OnfgyR0CA134r4BdY279BJND7K
TLSH
T1C3E38D207981D0B2E5BE2D3814A5C7A20F3EB960DF745CE763A4116D4E742E16F39B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpdf_16oap.exe

Path C:\Windows\Temp\{DE736D06-9C1A-4490-B351-0A998D8662E7}\.cr\tmpdf_16oap.exe
Size 4.5MB
SHA256 cb29a0d7f7ffc53f65f26353cb21b226ba2ffab32e51b81578532e73795e1ceb
MD5 ae4ac4441dc1b9cc4538fd278ef307e8
SHA1 1f4728149df76da8ef11e7f7c62ec31fd9be4b2a
SHA512 e74c7b3e52ffdfbc6ca05ee8bb5ccca8ad015c5cfdba7a1c0bb45829bdef5d067ee5eefd1a3df78132305d198ad9951cfdf93bedff2644ec4a4a951db70bce80
SSDEEP 98304:ifUbLJuOVWDMqPbYQFv2+Wsy+rFfuZXR1JetBpoeg4wy:ifUhuiq7lofYpPF
TLSH
T1FF262332A5A55033E3F102B7FA2C56347E7CD738175488A9E7D4AD1C7AB80826BB7253
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4496-31-0x00000000730B0000-0x000000007322B000-memory.dmp

Download

memory/4496-33-0x00007FFB6FF30000-0x00007FFB70125000-memory.dmp

Download