Analysis
- max time kernel
149s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
- submitted
22/06/2026, 08:10
General
- Target 6bdcd7a0d5c1bb109552844edebdf4b4.exe
- Size 13.6MB
- Sample260622-j2sqdaat2m
- SHA256 574cebd5ea2acb459274679dc5411d805e1a20c4c79c111450befd038819c4c7
Malware Config
Extracted
-
hijackloader
-
directory
%APPDATA%\websystem_v7
-
inject_dll
%windir%\SysWOW64\input.dll
Signatures
- Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
- Detects HijackLoader (aka IDAT Loader) 2 IoCs
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 18 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- Drops file in Windows directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 21 IoCs
- Suspicious behavior: MapViewOfSection 4 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6bdcd7a0d5c1bb109552844edebdf4b4.exe"C:\Users\Admin\AppData\Local\Temp\6bdcd7a0d5c1bb109552844edebdf4b4.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Cont-Opt.exe"C:\Users\Admin\AppData\Local\Temp\Cont-Opt.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\websystem_v7\Cont-Opt.exeC:\ProgramData\websystem_v7\Cont-Opt.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\websystem_v7\MUKHUCUQOSMMQSRRCP\Cont-Opt.exeC:\Users\Admin\AppData\Roaming\websystem_v7\MUKHUCUQOSMMQSRRCP\Cont-Opt.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RipInterface.exeC:\Users\Admin\AppData\Local\Temp\RipInterface.exe5⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Roaming\TerminalConnector_i386\Crisp.exeC:\Users\Admin\AppData\Roaming\TerminalConnector_i386\Crisp.exe5⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Users\Admin\AppData\Local\TuExplorer32.exeC:\Users\Admin\AppData\Local\TuExplorer32.exe4⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Roaming\websystem_v7\Crisp.exeC:\Users\Admin\AppData\Roaming\websystem_v7\Crisp.exe4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
36DC450.tmp
36DC450.tmp
3C26FA5.tmp
8DDFD63.tmp
Cont-Opt.exe
Cont-Opt.exe.config
DebuggerProxy.dll.manifest
FCE4622.tmp
FCE4622.tmp
MSVCP120.dll
MSVCR120.dll
RipInterface.exe
VSDebugEng.dll
git2-a2bde63.dll
msvcp_win.dll
protocol-ctrl.ini
shader.sym
ucrtbase.dll
TuExplorer32.exe
Crisp.exe
shader.sym
memory/1096-112-0x00007FFAD5520000-0x00007FFAD5583000-memory.dmp
memory/1096-130-0x00007FF7C7090000-0x00007FF7C75DF000-memory.dmp
memory/1096-121-0x00007FFAD5520000-0x00007FFAD5583000-memory.dmp
memory/1096-114-0x00007FFAD5520000-0x00007FFAD5583000-memory.dmp
memory/1876-145-0x0000000074E00000-0x0000000074E52000-memory.dmp
memory/1876-142-0x00007FFADD240000-0x00007FFADD4A3000-memory.dmp
memory/3468-117-0x00007FFADD240000-0x00007FFADD4A3000-memory.dmp
memory/4284-129-0x00007FFADD240000-0x00007FFADD4A3000-memory.dmp
memory/4284-123-0x00000000002D0000-0x0000000000679000-memory.dmp
memory/4284-144-0x00000000002D0000-0x0000000000679000-memory.dmp
memory/4284-138-0x00000000002D0000-0x0000000000679000-memory.dmp
memory/4580-52-0x00007FFAD4CFD000-0x00007FFAD4CFF000-memory.dmp
memory/4580-80-0x00007FFAD4CE0000-0x00007FFAD4D43000-memory.dmp
memory/4580-93-0x00007FFAD4CFD000-0x00007FFAD4CFF000-memory.dmp
memory/4580-94-0x00007FFAD4CE0000-0x00007FFAD4D43000-memory.dmp
memory/4580-54-0x00007FFAD4CE0000-0x00007FFAD4D43000-memory.dmp
memory/4580-55-0x00007FFAD4CE0000-0x00007FFAD4D43000-memory.dmp
memory/4580-51-0x00007FFAD4CE0000-0x00007FFAD4D43000-memory.dmp
memory/4580-60-0x00007FFAD4CE0000-0x00007FFAD4D43000-memory.dmp
memory/4580-69-0x00007FFAD4CE0000-0x00007FFAD4D43000-memory.dmp
memory/5272-41-0x00007FFACCAB0000-0x00007FFACCB13000-memory.dmp
memory/5716-104-0x00007FF7CF070000-0x00007FF7CF29E000-memory.dmp
memory/5716-124-0x00007FF7CF070000-0x00007FF7CF29E000-memory.dmp
memory/5716-116-0x00007FF7CF070000-0x00007FF7CF29E000-memory.dmp
memory/5716-120-0x00007FF7CF070000-0x00007FF7CF29E000-memory.dmp