Analysis
- max time kernel
150s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
06/07/2026, 08:15
General
- Target 772b547b8e01d86b2d4a32e308a42388f298ca4faedb0d6a3b78fb0d4dce8826.exe
- Size 8.7MB
- Sample260706-j5pg5ab16t
- SHA256 772b547b8e01d86b2d4a32e308a42388f298ca4faedb0d6a3b78fb0d4dce8826
Malware Config
Extracted
-
hijackloader
-
directory
%APPDATA%\ToolWriter
-
inject_dll
%windir%\SysWOW64\pla.dll
Signatures
- Family: DeerStealer
DeerStealer is a sophisticated information stealer written in C++.
- Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
- Detects DeerStealer 7 IoCs
- Detects HijackLoader (aka IDAT Loader) 1 IoCs
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 43 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\772b547b8e01d86b2d4a32e308a42388f298ca4faedb0d6a3b78fb0d4dce8826.exe"C:\Users\Admin\AppData\Local\Temp\772b547b8e01d86b2d4a32e308a42388f298ca4faedb0d6a3b78fb0d4dce8826.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\CubQ32.exe"C:\Users\Admin\AppData\Local\Temp\CubQ32.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\ToolWriter\CubQ32.exeC:\ProgramData\ToolWriter\CubQ32.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\BridgeHa32.exeC:\Users\Admin\BridgeHa32.exe4⤵
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Roaming\ToolWriter\XPFix.exe"C:\Users\Admin\AppData\Roaming\ToolWriter\XPFix.exe" "C:\Users\Admin\AppData\Roaming\ToolWriter\XPFix.exe" /u4⤵
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Crungpoorlies.xkey
CubQ32.exe
HardwareLib.dll
Neldung.gip
PluginHelper.dll
PowerMgr.dll
Register.dll
Scan.dll
Temperature.dll
dataexchange.dll
datastate.dll
libcrypto-1_1.dll
libssl-1_1.dll
madBasic_.bpl
madDisAsm_.bpl
madExcept_.bpl
rtl120.bpl
sdassist.dll
sqlite3.dll
vcl120.bpl
vclx120.bpl
memory/1136-227-0x00007FF7F4CA0000-0x00007FF7F50A9000-memory.dmp
memory/1136-267-0x00007FF7F4CA0000-0x00007FF7F50A9000-memory.dmp
memory/1136-217-0x00007FF7F4CA0000-0x00007FF7F50A9000-memory.dmp
memory/1136-177-0x00007FF7F4CA0000-0x00007FF7F50A9000-memory.dmp
memory/1136-175-0x00007FF7F4CA0000-0x00007FF7F50A9000-memory.dmp
memory/1136-165-0x00007FF7F4CA0000-0x00007FF7F50A9000-memory.dmp
memory/1136-162-0x00007FF7F4CA0000-0x00007FF7F50A9000-memory.dmp
memory/5552-137-0x0000000050310000-0x0000000050349000-memory.dmp
memory/5552-151-0x0000000074610000-0x0000000074798000-memory.dmp
memory/5552-131-0x0000000059800000-0x000000005986E000-memory.dmp
memory/5552-132-0x0000000050000000-0x0000000050117000-memory.dmp
memory/5552-125-0x0000000074610000-0x0000000074798000-memory.dmp
memory/5552-130-0x0000000000400000-0x00000000009E2000-memory.dmp
memory/5552-126-0x00007FFE08240000-0x00007FFE084A3000-memory.dmp
memory/5552-128-0x0000000074610000-0x0000000074798000-memory.dmp
memory/5552-135-0x0000000057000000-0x000000005703F000-memory.dmp
memory/5552-134-0x0000000050120000-0x000000005030E000-memory.dmp
memory/5552-138-0x0000000001140000-0x0000000001242000-memory.dmp
memory/5552-136-0x0000000061E00000-0x0000000061ECA000-memory.dmp
memory/5904-101-0x0000000050000000-0x0000000050117000-memory.dmp
memory/5904-98-0x0000000059800000-0x000000005986E000-memory.dmp
memory/5904-99-0x0000000057000000-0x000000005703F000-memory.dmp
memory/5904-100-0x0000000057800000-0x0000000057812000-memory.dmp
memory/5904-97-0x0000000000400000-0x00000000009E2000-memory.dmp
memory/5904-102-0x0000000050120000-0x000000005030E000-memory.dmp
memory/5904-104-0x0000000061E00000-0x0000000061ECA000-memory.dmp
memory/5904-105-0x0000000001140000-0x0000000001242000-memory.dmp
memory/5904-103-0x0000000050310000-0x0000000050349000-memory.dmp
memory/5904-91-0x00007FFE08240000-0x00007FFE084A3000-memory.dmp
memory/5904-89-0x0000000073A00000-0x0000000073B88000-memory.dmp
memory/5904-84-0x0000000001140000-0x0000000001242000-memory.dmp