Overview

overview

10

Static

static

10

process_ru...ap.dll

windows10-2004-x64

3

process_ru...ap.dll

windows11-ltsc_2024-x64

3

process_ru...32.exe

windows10-2004-x64

10

process_ru...32.exe

windows11-ltsc_2024-x64

10

process_ru...in.dll

windows10-2004-x64

3

process_ru...se.dll

windows10-2004-x64

3

process_ru...40.dll

windows10-2004-x64

3

process_ru...40.dll

windows11-ltsc_2024-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    process_runtime_v8.rar
  • Size 2.4MB
  • Sample261001-q356esxt3l
  • SHA256 45c632a020fa69dd302b43d538cd8b924e4b2b9dce62dd327cff56da73c9240b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
hijackloadersectopratdefense_evasiondiscoveryloaderprivilege_escalationrattrojan

Malware Config

Extracted

Family

  • hijackloader

Attributes
  • directory

    %APPDATA%\process_runtime_v8

  • inject_dll

    %windir%\SysWOW64\input.dll

xor.hex

Targets

    • Target
      process_runtime_v8/Microsoft.WindowsAppRuntime.Bootstrap.dll
    • Size 325KB
    • SHA256 42595649057812fa4d3890c302b1c0f0ca838de0192f70c1a116d9bec28ec58a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral1behavioral2
    • Target
      process_runtime_v8/Too_Hashrate32.exe
    • Size 307KB
    • SHA256 5245d28163e7e36c1a103708c19699066546113a72581fd524314e1b805347b1
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    defense_evasiondiscoveryhijackloadersectopratloaderprivilege_escalationrattrojan

    • Detects HijackLoader (aka IDAT Loader)

    • Detects SectopRAT aka Arechclient2

    • Family: HijackLoader, IDAT loader, Ghostulse,

      HijackLoader is a multi-stage loader, first seen in 2023.

      loaderhijackloader

    • Family: SectopRAT

      SectopRAT also known as Arechclient2 is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • Suspicious use of SetThreadContext

    behavioral3behavioral4
    • Target
      process_runtime_v8/msvcp_win.dll
    • Size 485KB
    • SHA256 55043a5dbe9b4bfe50e2e6be0bdf77a69a075becc520700dcaffb1d9f7686138
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral5
    • Target
      process_runtime_v8/ucrtbase.dll
    • Size 1.1MB
    • SHA256 71358d729b01bdf38dbe5440705ea68ea9225f93c834f45c5687b0ea2b417c4e
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral6
    • Target
      process_runtime_v8/vcomp140.dll
    • Size 159KB
    • SHA256 cdb4973c96b5efd058d75146d73adc935f2574587061fa7fa8411bf353288d84
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral7behavioral8

MITRE ATT&CK Enterprise v16

Tasks