Analysis
- max time kernel
148s - max time network
116s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
19/07/2026, 23:44
General
- Target aee7978dc8889e53d9cbd36ff78c5c26d92e52365591accc0a7ba2afbcc40dbf.exe
- Size 4.7MB
- Sample260719-3rmadsbt81
- SHA256 aee7978dc8889e53d9cbd36ff78c5c26d92e52365591accc0a7ba2afbcc40dbf
Malware Config
Extracted
-
hijackloader
-
directory
%APPDATA%\nethost_amd64
-
inject_dll
%windir%\SysWOW64\rasapi32.dll
Signatures
- Family: DeerStealer
DeerStealer is a sophisticated information stealer written in C++.
- Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
- Detects DeerStealer 9 IoCs
- Detects HijackLoader (aka IDAT Loader) 1 IoCs
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 12 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\aee7978dc8889e53d9cbd36ff78c5c26d92e52365591accc0a7ba2afbcc40dbf.exe"C:\Users\Admin\AppData\Local\Temp\aee7978dc8889e53d9cbd36ff78c5c26d92e52365591accc0a7ba2afbcc40dbf.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PortForge16.exe"C:\Users\Admin\AppData\Local\Temp\PortForge16.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\nethost_amd64\PortForge16.exeC:\ProgramData\nethost_amd64\PortForge16.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MicroEmulat.exeC:\Users\Admin\AppData\Local\Temp\MicroEmulat.exe4⤵
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Roaming\nethost_amd64\tcpvcon.exe"C:\Users\Admin\AppData\Roaming\nethost_amd64\tcpvcon.exe" "C:\Users\Admin\AppData\Roaming\nethost_amd64\tcpvcon.exe" /accepteula4⤵
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
4E2C7FB.tmp
BugSplat64.dll
EA29E59.tmp
Klaert.wrc
MicroEmulat.exe
PortForge16.exe
Stor.kbp
TSLogSDK.dll
lib_TSCommunication_sdk.dll
lib_TSDeviceViewerSDK.dll
memory/4144-47-0x00007FFD38860000-0x00007FFD38968000-memory.dmp
memory/4144-43-0x00007FFD38860000-0x00007FFD38968000-memory.dmp
memory/4144-41-0x00007FFD38860000-0x00007FFD38968000-memory.dmp
memory/4676-33-0x00007FFD38860000-0x00007FFD38968000-memory.dmp
memory/5404-49-0x00007FF695EB0000-0x00007FF69619D000-memory.dmp
memory/5404-55-0x00007FF695EB0000-0x00007FF69619D000-memory.dmp
memory/5404-56-0x00007FF695EB0000-0x00007FF69619D000-memory.dmp
memory/5404-58-0x00007FF695EB0000-0x00007FF69619D000-memory.dmp
memory/5404-59-0x00007FF695EB0000-0x00007FF69619D000-memory.dmp
memory/5404-60-0x00007FF695EB0000-0x00007FF69619D000-memory.dmp
memory/5404-61-0x00007FF695EB0000-0x00007FF69619D000-memory.dmp
memory/5404-62-0x00007FF695EB0000-0x00007FF69619D000-memory.dmp
memory/5404-63-0x00007FF695EB0000-0x00007FF69619D000-memory.dmp