Overview

overview

10

Static

static

10

com_web_re...SO.dll

windows10-2004-x64

1

com_web_re...SO.dll

windows11-ltsc_2024-x64

1

com_web_re...CF.dll

windows10-2004-x64

1

com_web_re...CF.dll

windows11-ltsc_2024-x64

1

com_web_re...32.exe

windows10-2004-x64

10

com_web_re...32.exe

windows11-ltsc_2024-x64

8

com_web_re...00.dll

windows10-2004-x64

1

com_web_re...00.dll

windows11-ltsc_2024-x64

1

com_web_re...in.dll

windows10-2004-x64

1

com_web_re...00.dll

windows10-2004-x64

1

com_web_re...00.dll

windows11-ltsc_2024-x64

1

com_web_re...se.dll

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    fa825e8d570241192f3616523d3ab32c3e232193455898ba29c75cfa0f257703
  • Size 5.6MB
  • Sample260916-t4zltashrc
  • SHA256 fa825e8d570241192f3616523d3ab32c3e232193455898ba29c75cfa0f257703
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
hijackloaderdiscoveryexecutionloader

Malware Config

Extracted

Family

  • hijackloader

Attributes
  • directory

    %APPDATA%\com_web_relay_32

  • inject_dll

    %windir%\SysWOW64\input.dll

xor.hex

Targets

    • Target
      com_web_relay_32/CDLMSO.DLL
    • Size 527KB
    • SHA256 5c25e3d00fec39a70696d565fc0ed5381fee5ad7d67fbf468e85e889dc2e3550
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral1behavioral2
    • Target
      com_web_relay_32/MSOCF.DLL
    • Size 235KB
    • SHA256 13ad4a772af1acf1a385eb7179bf926821a56956fd44172cd9614f796b7a7d7b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral3behavioral4
    • Target
      com_web_relay_32/Transactor_M32.exe
    • Size 2.5MB
    • SHA256 0e87b92e67b8356eb8453b1a1c4fdada8b3c5c8e4372d6305ca14728b6c85137
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    discoveryexecutionhijackloaderloader

    • Detects HijackLoader (aka IDAT Loader)

    • Family: HijackLoader, IDAT loader, Ghostulse,

      HijackLoader is a multi-stage loader, first seen in 2023.

      loaderhijackloader

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Suspicious use of SetThreadContext

    behavioral5behavioral6
    • Target
      com_web_relay_32/msvcp100.dll
    • Size 594KB
    • SHA256 c31219a2f67f5c5440349541d089f21f605d437869a1ccf8915ff2c395df1121
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral7behavioral8
    • Target
      com_web_relay_32/msvcp_win.dll
    • Size 621KB
    • SHA256 2a7825c2925347e0cb767a0dcb611f3eb80d0f71cbec981069b227bdc7cb871a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral9
    • Target
      com_web_relay_32/msvcr100.dll
    • Size 811KB
    • SHA256 2b7ab898b2f64f4cd1ae651c93d7eb9556208fd8d8d40d425e856c83d86d2346
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral10behavioral11
    • Target
      com_web_relay_32/ucrtbase.dll
    • Size 1021KB
    • SHA256 3c60056371f82e4744185b6f2fa0c69042b1e78804685944132974dd13f3b6d9
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral12

MITRE ATT&CK Enterprise v16

Tasks