Overview

overview

10

Static

static

10

Microsoft....NI.dll

windows10-2004-x64

1

Microsoft....NI.dll

windows11-ltsc_2024-x64

1

SupMesh.exe

windows10-2004-x64

10

SupMesh.exe

windows11-ltsc_2024-x64

10

WebView2Loader.dll

windows10-2004-x64

1

WebView2Loader.dll

windows11-ltsc_2024-x64

1

mfc140u.dll

windows10-2004-x64

1

mfc140u.dll

windows11-ltsc_2024-x64

1

msvcp140.dll

windows10-2004-x64

1

msvcp140.dll

windows11-ltsc_2024-x64

1

msvcp_win.dll

windows10-2004-x64

1

ucrtbase.dll

windows10-2004-x64

1

vcruntime140.dll

windows10-2004-x64

1

vcruntime140.dll

windows11-ltsc_2024-x64

1

vcruntime140_1.dll

windows10-2004-x64

1

vcruntime140_1.dll

windows11-ltsc_2024-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    eurebu.zip
  • Size 15.2MB
  • Sample260912-slzneszapd
  • SHA256 f0710dbb4fe2f9062dd1fadd47b4699aebbd19a62abb39e86bb6215fa4ea1c9b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
hijackloadersectopratdiscoveryloaderrattrojan

Malware Config

Extracted

Family

  • hijackloader

Attributes
  • directory

    %APPDATA%\com_ext_orchestrator_64

  • inject_dll

    %windir%\SysWOW64\input.dll

xor.hex

Targets

    • Target
      Microsoft.Data.SqlClient.SNI.dll
    • Size 491KB
    • SHA256 b99da433d42a9ac546868b3b5fca27439a9d99d7981369e74557547be87b7542
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral1behavioral2
    • Target
      SupMesh.exe
    • Size 5.4MB
    • SHA256 d2c9299134e112bae225c56f2c09626da2999a765202b16abb56a8d4376e5848
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    discoveryhijackloadersectopratloaderrattrojan

    • Detects HijackLoader (aka IDAT Loader)

    • Family: HijackLoader, IDAT loader, Ghostulse,

      HijackLoader is a multi-stage loader, first seen in 2023.

      loaderhijackloader

    • Family: SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    • Suspicious use of SetThreadContext

    behavioral3behavioral4
    • Target
      WebView2Loader.dll
    • Size 145KB
    • SHA256 348a783350d6310bd63ba215b1e065f3d46f80bfd3373219b7c496372b596969
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral5behavioral6
    • Target
      mfc140u.dll
    • Size 5.4MB
    • SHA256 8d97422cb84fd123deafce190fce6f34d868f7e692593fe1ed7d91ee7161ac27
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral7behavioral8
    • Target
      msvcp140.dll
    • Size 544KB
    • SHA256 1e2e2bcb916931f0ee6d0a567212511244e7442da574757c331c1b91087f2a0f
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral10behavioral9
    • Target
      msvcp_win.dll
    • Size 621KB
    • SHA256 2a7825c2925347e0cb767a0dcb611f3eb80d0f71cbec981069b227bdc7cb871a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral11
    • Target
      ucrtbase.dll
    • Size 1021KB
    • SHA256 3c60056371f82e4744185b6f2fa0c69042b1e78804685944132974dd13f3b6d9
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral12
    • Target
      vcruntime140.dll
    • Size 121KB
    • SHA256 60b813f8b87ff4fa344f081c163c1a2234b5e3e41f748721c28fbdecbcfecb8a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral13behavioral14
    • Target
      vcruntime140_1.dll
    • Size 48KB
    • SHA256 e30b3f4979b63b50438d061858c9cde962f4494e585c627a11c98b6c5b7b2592
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral15behavioral16

MITRE ATT&CK Enterprise v16

Tasks