Analysis
- max time kernel
149s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
15/07/2026, 10:19
General
- Target aJAF2CVLIdGxZM7fEn.ps1
- Size 5KB
- Sample260715-mcrcssds4t
- SHA256 9cbbf013baf9d740a39159488843691a49dc89cdd79a69858ead44590611ea81
Malware Config
Extracted
-
ps1
-
exe.dropper
http://91.92.43.231/dl-callback/5ktn2wuy-c4davwz4-j9zksmz4-c7tzfua3/14RMreBWS.msi/fa056774f4673cfe4149def14cab18ae
Extracted
-
hijackloader
-
directory
%APPDATA%\kubernetes_buffer
-
inject_dll
%windir%\SysWOW64\rasapi32.dll
Signatures
- Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
- Detects HijackLoader (aka IDAT Loader) 1 IoCs
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 2 IoCs
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in Windows directory 12 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry key 1 TTPs 2 IoCs
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\aJAF2CVLIdGxZM7fEn.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\fetjrd1f.mhx.ps12⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i C:\Users\Admin\AppData\Local\ShellData\14RMreBWS.msi /qn /norestart3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU /va /f3⤵
- Modifies registry key
-
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU /va /f2⤵
- Modifies registry key
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Gout\Smart_Mirro64.exe"C:\Users\Admin\AppData\Local\Gout\Smart_Mirro64.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
e59e7d9.rbs
MSOCF.dll
Smart_Mirro64.exe
cdlmso.dll
process-opt.lock
scannerindex.toml
StartupProfileData-NonInteractive
14RMreBWS.msi
fetjrd1f.mhx.ps1
memory/1112-7-0x00007FFBDBA10000-0x00007FFBDC3B4000-memory.dmp
memory/1112-13-0x00007FFBDBA10000-0x00007FFBDC3B4000-memory.dmp
memory/1112-12-0x00007FFBDBA10000-0x00007FFBDC3B4000-memory.dmp
memory/1112-10-0x00007FFBDBA10000-0x00007FFBDC3B4000-memory.dmp
memory/1112-8-0x00007FFBDBA10000-0x00007FFBDC3B4000-memory.dmp
memory/1112-0-0x00007FFBDBB9F000-0x00007FFBDBBA0000-memory.dmp
memory/1112-6-0x00007FFBDBA10000-0x00007FFBDC3B4000-memory.dmp
memory/1112-5-0x00007FFBDBA10000-0x00007FFBDC3B4000-memory.dmp
memory/1112-4-0x00007FFBDBA10000-0x00007FFBDC3B4000-memory.dmp
memory/1112-3-0x000002E6AE170000-0x000002E6AE192000-memory.dmp
memory/2040-75-0x00007FFBFE3C0000-0x00007FFBFE623000-memory.dmp
memory/2040-74-0x0000000075090000-0x0000000075185000-memory.dmp
memory/5024-22-0x00007FFBDBA10000-0x00007FFBDC3B4000-memory.dmp
memory/5024-29-0x00007FFBDBA10000-0x00007FFBDC3B4000-memory.dmp
memory/5024-30-0x00007FFBDBA10000-0x00007FFBDC3B4000-memory.dmp
memory/5024-31-0x00007FFBDBA10000-0x00007FFBDC3B4000-memory.dmp
memory/5024-28-0x00007FFBDBA10000-0x00007FFBDC3B4000-memory.dmp
memory/5024-26-0x00007FFBDBA10000-0x00007FFBDC3B4000-memory.dmp
memory/5024-24-0x00007FFBDBA10000-0x00007FFBDC3B4000-memory.dmp
memory/5024-23-0x00007FFBDBA10000-0x00007FFBDC3B4000-memory.dmp
memory/5024-20-0x00007FFBDBA10000-0x00007FFBDC3B4000-memory.dmp
memory/5024-71-0x00007FFBDBA10000-0x00007FFBDC3B4000-memory.dmp
memory/5024-19-0x00007FFBDBA10000-0x00007FFBDC3B4000-memory.dmp
memory/5024-16-0x00007FFBDBA10000-0x00007FFBDC3B4000-memory.dmp
memory/5024-15-0x00007FFBDBA10000-0x00007FFBDC3B4000-memory.dmp
memory/5024-14-0x00007FFBDBA10000-0x00007FFBDC3B4000-memory.dmp