Analysis
- max time kernel
148s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
26/07/2026, 14:30
General
- Target 3.exe
- Size 12.7MB
- Sample260726-rvmvjseh65
- SHA256 dbf03ba27ac911cecc5e5f4402a0648d5c2e9544daddbf76fb53408a40b7f982
Malware Config
Extracted
-
hijackloader
-
directory
%APPDATA%\NVI_v4_arm64
-
inject_dll
%windir%\SysWOW64\rasapi32.dll
Extracted
-
needle_stealer
-
http://178.16.52.194:3000
-
api_key
alk_7ad94f29b5dffd7bb3f1c82c54a3032bdacd81e621df476f37edbfd03a1a2d40
-
base_extension
true
-
self_destruct
false
Signatures
- Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
- Family: NeedleStealer
NeedleStealer is a modular stealer written in Golang.
- Detects HijackLoader (aka IDAT Loader) 1 IoCs
- Detects NeedleStealer payload 3 IoCs
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 25 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of SetThreadContext 2 IoCs
- Drops file in Windows directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
- GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
- Kills process with taskkill 3 IoCs
- Suspicious behavior: EnumeratesProcesses 29 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3.exe"C:\Users\Admin\AppData\Local\Temp\3.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-0VUME.tmp\3.tmp"C:\Users\Admin\AppData\Local\Temp\is-0VUME.tmp\3.tmp" /SL5="$401B8,12299460,882176,C:\Users\Admin\AppData\Local\Temp\3.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-RTG3S.tmp\DigitalUnit.exe"C:\Users\Admin\AppData\Local\Temp\is-RTG3S.tmp\DigitalUnit.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\NVI_v4_arm64\DigitalUnit.exeC:\ProgramData\NVI_v4_arm64\DigitalUnit.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\QuantumVer.exeC:\ProgramData\QuantumVer.exe5⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /F /IM msedge.exe /T6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM chrome.exe /T6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM msedgewebview2.exe /T6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\NVI_v4_arm64\Crisp.exeC:\Users\Admin\AppData\Roaming\NVI_v4_arm64\Crisp.exe5⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
QuantumVer.exe
background.js
807D7B9.tmp
807D7B9.tmp
C63572.tmp
3.tmp
Amnet.dll
Comn.dll
DigitalUnit.exe
Microsoft.VC80.CRT.manifest
Microsoft.VC80.MFC.manifest
Microsoft.VC80.OpenMP.manifest
Microsoft.VC90.CRT.manifest
NTHelp.dll
QtCore4.dll
QtGui4.dll
libcrypto-1_1.dll
libssl-1_1.dll
msvcp80.dll
msvcp_win.dll
msvcr80.dll
router.json
ucrtbase.dll
watcher-sec.pdb
Crisp.exe
memory/1404-100-0x0000000075080000-0x0000000075175000-memory.dmp
memory/1404-95-0x0000000075080000-0x0000000075175000-memory.dmp
memory/1404-108-0x0000000000400000-0x0000000000422000-memory.dmp
memory/1404-93-0x00007FF8D6620000-0x00007FF8D6883000-memory.dmp
memory/1404-92-0x0000000075080000-0x0000000075175000-memory.dmp
memory/1404-90-0x0000000000C90000-0x0000000000ECD000-memory.dmp
memory/1404-86-0x0000000000BF0000-0x0000000000C8E000-memory.dmp
memory/1404-83-0x0000000000BD0000-0x0000000000BDD000-memory.dmp
memory/1404-80-0x0000000000B60000-0x0000000000BB8000-memory.dmp
memory/2096-53-0x0000000000CB0000-0x0000000000EED000-memory.dmp
memory/2096-43-0x0000000000BA0000-0x0000000000BF8000-memory.dmp
memory/2096-48-0x0000000000C10000-0x0000000000CAE000-memory.dmp
memory/2096-60-0x00000000749E0000-0x0000000074AD5000-memory.dmp
memory/2096-41-0x0000000000B60000-0x0000000000B87000-memory.dmp
memory/2096-61-0x00007FF8D6620000-0x00007FF8D6883000-memory.dmp
memory/2572-146-0x0000000000C00000-0x0000000001309000-memory.dmp
memory/2572-107-0x0000000000C00000-0x0000000001309000-memory.dmp
memory/2572-102-0x0000000000C00000-0x0000000001309000-memory.dmp
memory/3324-55-0x0000000000470000-0x0000000000557000-memory.dmp
memory/3324-0-0x0000000000470000-0x0000000000557000-memory.dmp
memory/3324-77-0x0000000000470000-0x0000000000557000-memory.dmp
memory/5060-56-0x0000000000110000-0x00000000004BE000-memory.dmp
memory/5060-76-0x0000000000110000-0x00000000004BE000-memory.dmp
memory/5060-57-0x00000000027A0000-0x00000000027A1000-memory.dmp
memory/5060-6-0x00000000027A0000-0x00000000027A1000-memory.dmp
memory/5556-153-0x00007FF8D6620000-0x00007FF8D6883000-memory.dmp
memory/5556-156-0x0000000075080000-0x0000000075175000-memory.dmp