Analysis
- user interaction
yes - max time kernel
167s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
19/10/2026, 16:17
General
- Target 8888888888888888888.7z
- Size 15.3MB
- Sample261019-tre2mswt2l
- SHA256 04d609ff1f7acc93cddf3891292d40d3d304042500b16829092841d365c4cee5
Score
10/10
Malware Config
Extracted
Family
-
hijackloader
Attributes
-
directory
%APPDATA%\DOUWNode_dev
-
inject_dll
%windir%\SysWOW64\input.dll
xor.hex
Signatures
- Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
- Detects HijackLoader (aka IDAT Loader) 1 IoCs
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 31 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\8888888888888888888.7z"1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Desktop\123\1234.exe"C:\Users\Admin\Desktop\123\1234.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\Desktop\123\1234.exe"C:\Users\Admin\Desktop\123\1234.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
1234.exe
MSVCP140_2.dll
Qt6Core.dll
Qt6Gui.dll
Qt6Network.dll
Qt6Widgets.dll
VCRUNTIME140.dll
VEConfig.dll
libiconv.dll
minidump_stackwalk.dll
msvcp140.dll
msvcp140_1.dll
sampler4.map
sprite16.so
sscronet.dll
vcruntime140_1.dll
memory/5808-87-0x00007FF97CD20000-0x00007FF97D2C9000-memory.dmp
memory/5808-88-0x00007FF99A290000-0x00007FF99A2F3000-memory.dmp
memory/6024-69-0x00007FF97CD20000-0x00007FF97D2C9000-memory.dmp
memory/6024-72-0x00007FF980030000-0x00007FF980093000-memory.dmp