Analysis
- max time kernel
119s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/07/2026, 10:32
Static task
static1
Behavioral task
behavioral1
Sample
stage2.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
13 signatures
120 seconds
Behavioral task
behavioral2
Sample
stage2.ps1
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
120 seconds
General
- Target stage2.ps1
- Size 2KB
- Sample260716-mlafmsaw5j
- SHA256 b349df8915305231b06c50f1d7ddba61ac0fbe87d208f613d6bf038e2fd3ebe7
- MD5 1a4578b8e923d8d7b5afc9f28328859c
- SHA1 b885f8f3c635b35b2195fb95323177b824e53f6e
- SHA512 57c93250b0413eebd8f9ffed5ca57df7efad55239df8943e2390adc41374e59a75533012ca4467fc15290ff0d2ad53ee0f0e262978cc46adec46bb4c0626ccd3
- TLSH T13451B887393930558182526AC69C1B58DA57980F0A0F1F54B3BF61C29F72BFCCED8E89
- MD5 SHA1 SHA512 TLSH
Score
10/10
Malware Config
Extracted
Family
-
hijackloader
Attributes
-
directory
%APPDATA%\kubernetes_buffer
-
inject_dll
%windir%\SysWOW64\rasapi32.dll
xor.hex
Signatures
- Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
- Detects HijackLoader (aka IDAT Loader) 1 IoCs
resource yara_rule behavioral2/files/0x000d00000001c494-59.dat family_hijackloader - Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 1 3440 PowerShell.exe 3 3440 PowerShell.exe - Executes dropped EXE 1 IoCs
pid Process 5012 Smart_Mirro64.exe - Loads dropped DLL 2 IoCs
pid Process 5012 Smart_Mirro64.exe 5012 Smart_Mirro64.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\Installer\e5994c4.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DFEA7AACCA35B6807E.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFE06D61C8B60D7A60.TMP msiexec.exe File created C:\Windows\Installer\e5994c8.msi msiexec.exe File created C:\Windows\SystemTemp\~DF1415C7104838CDEC.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF85700FD3A7DF5A7D.TMP msiexec.exe File opened for modification C:\Windows\Installer\e5994c4.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\SourceHash{E0682B78-DC08-450F-8897-4673C0BF7524} msiexec.exe File opened for modification C:\Windows\Installer\MSI96B8.tmp msiexec.exe -
pid Process 3440 PowerShell.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Smart_Mirro64.exe - Modifies registry key 1 TTPs 1 IoCs
pid Process 1520 reg.exe - Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 3440 PowerShell.exe 3440 PowerShell.exe 5292 msiexec.exe 5292 msiexec.exe 5012 Smart_Mirro64.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3440 PowerShell.exe Token: SeShutdownPrivilege 5912 msiexec.exe Token: SeIncreaseQuotaPrivilege 5912 msiexec.exe Token: SeSecurityPrivilege 5292 msiexec.exe Token: SeCreateTokenPrivilege 5912 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5912 msiexec.exe Token: SeLockMemoryPrivilege 5912 msiexec.exe Token: SeIncreaseQuotaPrivilege 5912 msiexec.exe Token: SeMachineAccountPrivilege 5912 msiexec.exe Token: SeTcbPrivilege 5912 msiexec.exe Token: SeSecurityPrivilege 5912 msiexec.exe Token: SeTakeOwnershipPrivilege 5912 msiexec.exe Token: SeLoadDriverPrivilege 5912 msiexec.exe Token: SeSystemProfilePrivilege 5912 msiexec.exe Token: SeSystemtimePrivilege 5912 msiexec.exe Token: SeProfSingleProcessPrivilege 5912 msiexec.exe Token: SeIncBasePriorityPrivilege 5912 msiexec.exe Token: SeCreatePagefilePrivilege 5912 msiexec.exe Token: SeCreatePermanentPrivilege 5912 msiexec.exe Token: SeBackupPrivilege 5912 msiexec.exe Token: SeRestorePrivilege 5912 msiexec.exe Token: SeShutdownPrivilege 5912 msiexec.exe Token: SeDebugPrivilege 5912 msiexec.exe Token: SeAuditPrivilege 5912 msiexec.exe Token: SeSystemEnvironmentPrivilege 5912 msiexec.exe Token: SeChangeNotifyPrivilege 5912 msiexec.exe Token: SeRemoteShutdownPrivilege 5912 msiexec.exe Token: SeUndockPrivilege 5912 msiexec.exe Token: SeSyncAgentPrivilege 5912 msiexec.exe Token: SeEnableDelegationPrivilege 5912 msiexec.exe Token: SeManageVolumePrivilege 5912 msiexec.exe Token: SeImpersonatePrivilege 5912 msiexec.exe Token: SeCreateGlobalPrivilege 5912 msiexec.exe Token: SeRestorePrivilege 5292 msiexec.exe Token: SeTakeOwnershipPrivilege 5292 msiexec.exe Token: SeRestorePrivilege 5292 msiexec.exe Token: SeTakeOwnershipPrivilege 5292 msiexec.exe Token: SeRestorePrivilege 5292 msiexec.exe Token: SeTakeOwnershipPrivilege 5292 msiexec.exe Token: SeRestorePrivilege 5292 msiexec.exe Token: SeTakeOwnershipPrivilege 5292 msiexec.exe Token: SeRestorePrivilege 5292 msiexec.exe Token: SeTakeOwnershipPrivilege 5292 msiexec.exe Token: SeRestorePrivilege 5292 msiexec.exe Token: SeTakeOwnershipPrivilege 5292 msiexec.exe Token: SeRestorePrivilege 5292 msiexec.exe Token: SeTakeOwnershipPrivilege 5292 msiexec.exe Token: SeRestorePrivilege 5292 msiexec.exe Token: SeTakeOwnershipPrivilege 5292 msiexec.exe Token: SeRestorePrivilege 5292 msiexec.exe Token: SeTakeOwnershipPrivilege 5292 msiexec.exe Token: SeRestorePrivilege 5292 msiexec.exe Token: SeTakeOwnershipPrivilege 5292 msiexec.exe Token: SeRestorePrivilege 5292 msiexec.exe Token: SeTakeOwnershipPrivilege 5292 msiexec.exe Token: SeRestorePrivilege 5292 msiexec.exe Token: SeTakeOwnershipPrivilege 5292 msiexec.exe Token: SeRestorePrivilege 5292 msiexec.exe Token: SeTakeOwnershipPrivilege 5292 msiexec.exe Token: SeRestorePrivilege 5292 msiexec.exe Token: SeTakeOwnershipPrivilege 5292 msiexec.exe Token: SeRestorePrivilege 5292 msiexec.exe Token: SeTakeOwnershipPrivilege 5292 msiexec.exe Token: SeRestorePrivilege 5292 msiexec.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5912 msiexec.exe 5292 msiexec.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3440 wrote to memory of 5912 3440 PowerShell.exe 90 PID 5292 wrote to memory of 5012 5292 msiexec.exe 92 PID 3440 wrote to memory of 1520 3440 PowerShell.exe 93
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\stage2.ps11⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i C:\Users\Admin\AppData\Local\ShellData\14RMreBWS.msi /qn /norestart2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5912
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU /va /f2⤵
- Modifies registry key
PID:1520
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5292 -
C:\Users\Admin\AppData\Local\Gout\Smart_Mirro64.exe"C:\Users\Admin\AppData\Local\Gout\Smart_Mirro64.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5012
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e5994c7.rbs
- Size 10KB
- SHA256 8f161fac7f3771cbd530363adf61a618bcd0da547acddf1706335dcfd857af4e
- MD5 929503d07e877acd0f71d88a4bb27cf4
- SHA1 f7ad4fe47c402a21e69bb74fc87137572a2f51a5
- SHA512 bcdba9f64f8415a57df1daee1b0ef6ad0007b3ad8a28644f18cc1ce51da0dbf6f313872e5e612ec9815f0e464e1bcc34efe26128046ea2f48439c6087dde69e1
- SSDEEP 96:pgUom2rrjTZJHBbTT+L8eHL2av+6+8+aYuCQFdVU+PpLCsThqs+U+PpLC6jDD4bE:pg31jothCYuAp2I1Ap2tddZgLpuO
- TLSH T14F2273417B68D3C2D09B66759F122B48777BC2968706230E084E86652F83ACDBB9F15E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Gout\MSOCF.dll
- Size 149KB
- SHA256 908b5342a8f643ede2af3b1d5f0bbab4182d3cbaa7b28431373d0c0e0fb1bb6b
- MD5 55ddcd0a60c20ca988a6f3880f0d18f6
- SHA1 1b01c3c15ebbe43b1167af3a5f826ed17dac895b
- SHA512 7e32ae5645e9f68977772763ce8cbab3bcc8d06916048a8341f1b1d26254b0257c8d16da603bfa5b048c8b4622e1e0e5f9223f8bddd880a061d0dc9d5b914bf7
- SSDEEP 3072:CPlL92embbEybwNc9XFp/AYKn9nOJeeWFjY95p:Ut9YbbJwuF/K9nOJeeQ4P
- TLSH T14BE34B133BD0DCF4D26323745EE9F676A1BDFA619935A70B26C847091BBA580E638313
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Gout\Smart_Mirro64.exe
- Size 1.7MB
- SHA256 343883df0625d9ab21c3de31c2c5fbcc24c6d0c151d2dcacd2ba1f04e6a40ad6
- MD5 e7667239fc311cbbc86e84c7d4ed1f23
- SHA1 ba55b9c8d2edca3483d600616cb1a9114d4f625f
- SHA512 7a8423e2d236f1ded8b51779519dfb9cce45bcb5d92503b35651278a0108e3b3e7b35fd266201e14bcaca76be99218481e9037d95394ea1442c204e66439aa7a
- SSDEEP 24576:e71UQW/4N7AR5PFEjmKG0gFRKa8Wr0oVf3Zh:eOBdzsNeQAZ
- TLSH T1DE858E0277D1E932CDAB0338D9E5B31477B6ED3A0262938616D4BB297E32142DE35B47
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Gout\cdlmso.dll
- Size 388KB
- SHA256 1b3cee775445bb6e290406ac361c6735ea0eca841bf63493e198a07a2b26f21a
- MD5 d223128aa053dbde88205fd53bbbebce
- SHA1 2cdeb860ed59b7a88c28762bab73ededd347df54
- SHA512 25006a35c59823a1b68550d189e349b1e77bac2c1568fb702b88640fbd72f3c2002f6eb537bd27d2b08f01af0236ec49a98e345f765644047a81f64a63b2a35b
- SSDEEP 6144:l676/FSXncuBI5mvuk/J1+HXa0/zoOx15kTSNiL7Jm/vqVXfsOQWSVZAOtBPBfqc:lwpJ1+HX7/EOFksifJm/+XfsFWSVpw8
- TLSH T12D844A2BF9F16DF9CBDFD3324E34B224E5ECF265417257179D9D0A4A1AA0D80C84A11B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Gout\process-opt.lock
- Size 34KB
- SHA256 201457c25d599b216dddd3573c46d3a28b986558e2781f5ff7c92a01a21e4602
- MD5 5ea6fb021ef3e233e1d5b9183d58b950
- SHA1 e55d5cff0ad5cc30d206157ffacde04e849b4c02
- SHA512 b170d1f27086f20e45aba2e17c96ba17e06385644401b6c319ff0f65eda5b99732eae0c686f43e9a27dc2f22e0d180516e6faa629d7e10aa82106f909b26a24d
- SSDEEP 768:mVCAZtZ4l0P3Cd+EwAbPlsrHzXw107+fA2ibU+YejGRY:m0A7Z4evRAbCnq0hUqGRY
- TLSH T1CCF28EE6D95F5797D809682BA828F0A3C254F975792F01F2B8DC1C16742618EDB12FC3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Gout\scannerindex.toml
- Size 4.6MB
- SHA256 216950f6c91eb74c29d8272c37e89b76f41784f9ee9cfcdf75f915ea8dcdf605
- MD5 51d2c0a8f13522cb193f7ab73b33a8a4
- SHA1 4db3a47363ceb4b658dfd4488449d04552adfbfd
- SHA512 6738a91aa617b08e82bcaea767bed00ee2e3a57967c85ed3d138ebc4273aaee017f41165098583d32a6b954f25d854a4f5cea0ff0f50227100aad5edc3a4c6d9
- SSDEEP 98304:xoLfRfziQY4ivwFPym7Ju+3rerZGcFGggl5o2qgZrad+WHNbZZ/3yyZL:xozRGQYzWttu+yrZGcSTo2qgZO9ttUyV
- TLSH T1FE2633EAC7EC51F4F1085FB2D40D4AF641952F3246BC91EA708A41DB8986F87C12BF99
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\ShellData\14RMreBWS.msi
- Size 5.8MB
- SHA256 108d5bc2024134624ebfd2f221e636e9d2fd8e4505fa1817387e543cddc76d58
- MD5 9ed904fcd4482052d2af6532c1cfcb34
- SHA1 4c0991e789666a6719a7eaaac17bfeda53cbb5f6
- SHA512 779e2b8d0294a8f21c5bef677cb525b469245b218163eb6dffcd0b0782bd39ebc2a474283114bc539b1cdbbc724eaac8350fdaf789abba3a1e6482aceb16417a
- SSDEEP 98304:phoSHqr/ks6PQ3pxlN1K6M9jpwLntzfh7yQbNx3Xdq3jFKZ25KNjVorSQfw:RqrslO51g6nZl1Nx3Nq3EZ2ANjVoOt
- TLSH T173563371758F69B2EA3383B8608603DCACDC9C1817B7B1276E4877955CF5DA102E8EB1
- MD5 SHA1 SHA512 SSDEEP TLSH