Analysis
- max time kernel
149s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
06/07/2026, 08:16
General
- Target 7f99bcecc41ac0eb9c6d765aa88ec35a164d80451be4c1cffc9771c92ab6a733.exe
- Size 6.4MB
- Sample260706-j6byesf14m
- SHA256 7f99bcecc41ac0eb9c6d765aa88ec35a164d80451be4c1cffc9771c92ab6a733
Malware Config
Extracted
-
hijackloader
-
directory
%APPDATA%\demohost_std
-
inject_dll
%windir%\SysWOW64\rasapi32.dll
Signatures
- Family: DeerStealer
DeerStealer is a sophisticated information stealer written in C++.
- Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
- Detects DeerStealer 11 IoCs
- Detects HijackLoader (aka IDAT Loader) 1 IoCs
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 5 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 2 IoCs
Inno Setup installer
- Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7f99bcecc41ac0eb9c6d765aa88ec35a164d80451be4c1cffc9771c92ab6a733.exe"C:\Users\Admin\AppData\Local\Temp\7f99bcecc41ac0eb9c6d765aa88ec35a164d80451be4c1cffc9771c92ab6a733.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-O213G.tmp\7f99bcecc41ac0eb9c6d765aa88ec35a164d80451be4c1cffc9771c92ab6a733.tmp"C:\Users\Admin\AppData\Local\Temp\is-O213G.tmp\7f99bcecc41ac0eb9c6d765aa88ec35a164d80451be4c1cffc9771c92ab6a733.tmp" /SL5="$90070,5629294,882176,C:\Users\Admin\AppData\Local\Temp\7f99bcecc41ac0eb9c6d765aa88ec35a164d80451be4c1cffc9771c92ab6a733.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-N1CLJ.tmp\TransmitteD.exe"C:\Users\Admin\AppData\Local\Temp\is-N1CLJ.tmp\TransmitteD.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\demohost_std\TransmitteD.exeC:\ProgramData\demohost_std\TransmitteD.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\ElevateMoni.exeC:\Users\Admin\AppData\Local\ElevateMoni.exe5⤵
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Roaming\demohost_std\XPFix.exe"C:\Users\Admin\AppData\Roaming\demohost_std\XPFix.exe" "C:\Users\Admin\AppData\Roaming\demohost_std\XPFix.exe" /u5⤵
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ElevateMoni.exe
5816A4E.tmp
983944E.tmp
Jenkrookmot.rgu
Raid.iiy
TransmitteD.exe
cmdres.DLL
vulkan-1.dll
7f99bcecc41ac0eb9c6d765aa88ec35a164d80451be4c1cffc9771c92ab6a733.tmp
memory/1084-0-0x00000000005B0000-0x0000000000697000-memory.dmp
memory/1084-34-0x00000000005B0000-0x0000000000697000-memory.dmp
memory/1640-33-0x0000000000300000-0x00000000006AE000-memory.dmp
memory/1640-5-0x0000000000B00000-0x0000000000B01000-memory.dmp
memory/3232-45-0x00007FF790870000-0x00007FF790B68000-memory.dmp
memory/3232-57-0x00007FF790870000-0x00007FF790B68000-memory.dmp
memory/3232-62-0x00007FF790870000-0x00007FF790B68000-memory.dmp
memory/3232-61-0x00007FF790870000-0x00007FF790B68000-memory.dmp
memory/3232-59-0x00007FF790870000-0x00007FF790B68000-memory.dmp
memory/3232-50-0x00007FF790870000-0x00007FF790B68000-memory.dmp
memory/3232-52-0x00007FF790870000-0x00007FF790B68000-memory.dmp
memory/3232-54-0x00007FF790870000-0x00007FF790B68000-memory.dmp
memory/3232-55-0x00007FF790870000-0x00007FF790B68000-memory.dmp
memory/3232-56-0x00007FF790870000-0x00007FF790B68000-memory.dmp
memory/3232-58-0x00007FF790870000-0x00007FF790B68000-memory.dmp
memory/4044-20-0x00007FFCD7C40000-0x00007FFCD7D42000-memory.dmp
memory/4628-43-0x00007FFCD7C40000-0x00007FFCD7D42000-memory.dmp
memory/4628-37-0x00007FFCD7C40000-0x00007FFCD7D42000-memory.dmp
memory/4628-39-0x00007FFCD7C40000-0x00007FFCD7D42000-memory.dmp