Analysis
- max time kernel
39s - max time network
33s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
03/10/2026, 01:40
General
- Target f663aaab15536ac4bf5b2f7547470c256faf171149d3ede5dd0199e762bf2792.exe
- Size 10.3MB
- Sample261003-b31tdaaf53
- SHA256 f663aaab15536ac4bf5b2f7547470c256faf171149d3ede5dd0199e762bf2792
Malware Config
Extracted
-
hijackloader
-
directory
%APPDATA%\adv_tracer_profiler_dev
-
inject_dll
%windir%\SysWOW64\input.dll
Signatures
- Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
- Detects HijackLoader (aka IDAT Loader) 1 IoCs
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 24 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 2 IoCs
Inno Setup installer
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious behavior: MapViewOfSection 1 TTPs 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f663aaab15536ac4bf5b2f7547470c256faf171149d3ede5dd0199e762bf2792.exe"C:\Users\Admin\AppData\Local\Temp\f663aaab15536ac4bf5b2f7547470c256faf171149d3ede5dd0199e762bf2792.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-CPLEO.tmp\f663aaab15536ac4bf5b2f7547470c256faf171149d3ede5dd0199e762bf2792.tmp"C:\Users\Admin\AppData\Local\Temp\is-CPLEO.tmp\f663aaab15536ac4bf5b2f7547470c256faf171149d3ede5dd0199e762bf2792.tmp" /SL5="$400A6,10380891,121344,C:\Users\Admin\AppData\Local\Temp\f663aaab15536ac4bf5b2f7547470c256faf171149d3ede5dd0199e762bf2792.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-V9OLT.tmp\Pee_Analyzer16.exe"C:\Users\Admin\AppData\Local\Temp\is-V9OLT.tmp\Pee_Analyzer16.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\adv_tracer_profiler_dev\Pee_Analyzer16.exeC:\ProgramData\adv_tracer_profiler_dev\Pee_Analyzer16.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\AdaptiveHandle.exeC:\Users\Admin\AppData\Local\AdaptiveHandle.exe5⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
AdaptiveHandle.exe
71EFD32.tmp
AC3236A.tmp
f663aaab15536ac4bf5b2f7547470c256faf171149d3ede5dd0199e762bf2792.tmp
DownloaderMgr.dll
MSVCP140.dll
MSVCP140_1.dll
Microsoft.VC90.CRT.manifest
Pee_Analyzer16.exe
Qt5Core.dll
Qt5Gui.dll
Qt5Network.dll
Qt5Qml.dll
VCRUNTIME140.dll
heap.yaml
msvcp_win.dll
stackdef.dump
ucrtbase.dll
vcruntime140_1.dll
memory/8-76-0x0000000000C00000-0x0000000000FBC000-memory.dmp
memory/8-82-0x0000000000C00000-0x0000000000FBC000-memory.dmp
memory/8-83-0x0000000000400000-0x00000000005D0000-memory.dmp
memory/8-81-0x00007FFDBA0C0000-0x00007FFDBA323000-memory.dmp
memory/1084-67-0x0000000000400000-0x0000000000428000-memory.dmp
memory/1084-0-0x0000000000400000-0x0000000000428000-memory.dmp
memory/1868-49-0x00007FFDB18C0000-0x00007FFDB1923000-memory.dmp
memory/1944-6-0x0000000002580000-0x0000000002581000-memory.dmp
memory/1944-66-0x0000000000400000-0x000000000052E000-memory.dmp
memory/3260-74-0x00007FFDA9E80000-0x00007FFDA9EE3000-memory.dmp
memory/3260-70-0x00007FFDA9E80000-0x00007FFDA9EE3000-memory.dmp
memory/3260-68-0x00007FFDA9E80000-0x00007FFDA9EE3000-memory.dmp