Analysis
- user interaction
yes - max time kernel
80s - max time network
74s - platform
windows11-21h2_x64 - resource
win11-20260911-en - resource tags
- submitted
19/09/2026, 16:07
General
- Target CelSu16.exe
- Size 188KB
- Sample260919-tk599adn2w
- SHA256 fcbed331413cf92f2944d284bc52e96c08945de239bc92bcb6d2b14f4846128a
Malware Config
Extracted
-
hijackloader
-
directory
%APPDATA%\int_oracle_terminal
-
inject_dll
%windir%\SysWOW64\input.dll
Signatures
- Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
- Family: SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
- Detects HijackLoader (aka IDAT Loader) 1 IoCs
- SectopRAT payload 1 IoCs
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 3 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 17 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\CelSu16.exe"C:\Users\Admin\AppData\Local\Temp\CelSu16.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\int_oracle_terminal\CelSu16.exeC:\ProgramData\int_oracle_terminal\CelSu16.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\SVerifier.exeC:\Users\Admin\SVerifier.exe3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\int_oracle_terminal\XPFix.exe"C:\Users\Admin\AppData\Roaming\int_oracle_terminal\XPFix.exe" "C:\Users\Admin\AppData\Roaming\int_oracle_terminal\XPFix.exe" /u3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 756 -s 7004⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 756 -ip 7561⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CelSu16.exe
TenioDL_core.dll
dispatchreg.bin
monitor16.xml
B71C08C.tmp
B71C08C.tmp
F15E6C3.tmp
XPFix.exe
SVerifier.exe
memory/756-48-0x00007FFED9D40000-0x00007FFED9F49000-memory.dmp
memory/756-51-0x0000000074A60000-0x0000000074AAF000-memory.dmp
memory/1060-0-0x0000000074A60000-0x0000000074AAF000-memory.dmp
memory/1060-1-0x00007FFED9D40000-0x00007FFED9F49000-memory.dmp
memory/2324-28-0x00007FF64BF80000-0x00007FF64C01A000-memory.dmp
memory/2324-36-0x00007FFED8580000-0x00007FFED8581000-memory.dmp
memory/2324-52-0x00007FFED8580000-0x00007FFED8581000-memory.dmp
memory/2324-53-0x000000001D670000-0x000000001D680000-memory.dmp
memory/2324-54-0x000000001D670000-0x000000001D680000-memory.dmp
memory/2324-55-0x000000001D670000-0x000000001D680000-memory.dmp
memory/2324-34-0x00007FF64BF80000-0x00007FF64C01A000-memory.dmp
memory/2324-50-0x00007FF64BF80000-0x00007FF64C01A000-memory.dmp
memory/2324-37-0x000000001D670000-0x000000001D680000-memory.dmp
memory/2324-38-0x0000000002A90000-0x0000000002AFC000-memory.dmp
memory/2324-40-0x000000001D670000-0x000000001D680000-memory.dmp
memory/2324-39-0x000000001D670000-0x000000001D680000-memory.dmp
memory/2324-41-0x000000001D850000-0x000000001DA12000-memory.dmp
memory/2324-42-0x0000000003830000-0x0000000003880000-memory.dmp
memory/2324-57-0x000000001EB50000-0x000000001F078000-memory.dmp
memory/5012-17-0x0000000074A80000-0x0000000074A81000-memory.dmp
memory/5012-33-0x0000000000400000-0x0000000000430000-memory.dmp
memory/5012-26-0x0000000074A60000-0x0000000074AAF000-memory.dmp
memory/5012-24-0x0000000074A60000-0x0000000074AAF000-memory.dmp
memory/5012-23-0x0000000074A60000-0x0000000074AAF000-memory.dmp
memory/5012-20-0x0000000074A60000-0x0000000074AAF000-memory.dmp
memory/5012-18-0x0000000074A60000-0x0000000074AAF000-memory.dmp
memory/5012-16-0x00007FFED9D40000-0x00007FFED9F49000-memory.dmp
memory/5012-15-0x0000000074A60000-0x0000000074AAF000-memory.dmp