Overview

overview

10

Static

static

10

SmartLab.exe

windows10-2004-x64

10

SmartLab.exe

windows11-ltsc_2024-x64

10

WebView2Loader.dll

windows10-2004-x64

1

WebView2Loader.dll

windows11-ltsc_2024-x64

1

mfc140u.dll

windows10-2004-x64

1

mfc140u.dll

windows11-ltsc_2024-x64

1

msvcp140.dll

windows10-2004-x64

1

msvcp140.dll

windows11-ltsc_2024-x64

1

msvcp_win.dll

windows10-2004-x64

1

ucrtbase.dll

windows10-2004-x64

1

vcruntime140.dll

windows10-2004-x64

1

vcruntime140.dll

windows11-ltsc_2024-x64

1

vcruntime140_1.dll

windows10-2004-x64

1

vcruntime140_1.dll

windows11-ltsc_2024-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    oct2.zip
  • Size 14.8MB
  • Sample261109-h24bfaay2y
  • SHA256 54297a9b17e5e21d4e8140a19bb61868e1911cf16553b61788a9b46ac324e1d1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
hijackloadersectopratdefense_evasiondiscoveryloaderprivilege_escalationrattrojan

Malware Config

Extracted

Family

  • hijackloader

Attributes
  • directory

    %APPDATA%\WordpadDownload_v3

  • inject_dll

    %windir%\SysWOW64\input.dll

xor.hex

Targets

    • Target
      SmartLab.exe
    • Size 5.4MB
    • SHA256 0bcdb372f12666baf0c8eaee6faa5edf58aa153399c0fcad9e927e5537564fa1
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    defense_evasiondiscoveryhijackloadersectopratloaderprivilege_escalationrattrojan

    • Detects HijackLoader (aka IDAT Loader)

    • Detects SectopRAT aka Arechclient2

    • Family: HijackLoader, IDAT loader, Ghostulse,

      HijackLoader is a multi-stage loader, first seen in 2023.

      loaderhijackloader

    • Family: SectopRAT

      SectopRAT also known as Arechclient2 is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2
    • Target
      WebView2Loader.dll
    • Size 145KB
    • SHA256 a86733c70d1eed6bbcd4e587ada4580289abc740187eb7cefff3b1a41b4d0434
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral3behavioral4
    • Target
      mfc140u.dll
    • Size 5.4MB
    • SHA256 8d97422cb84fd123deafce190fce6f34d868f7e692593fe1ed7d91ee7161ac27
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral5behavioral6
    • Target
      msvcp140.dll
    • Size 544KB
    • SHA256 1e2e2bcb916931f0ee6d0a567212511244e7442da574757c331c1b91087f2a0f
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral7behavioral8
    • Target
      msvcp_win.dll
    • Size 624KB
    • SHA256 2fc246f193104fb36285360e9fb14ce10b04edb50d9d5ecfd9fda1f010bfcdb9
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral9
    • Target
      ucrtbase.dll
    • Size 1000KB
    • SHA256 7b28f46f0a09cfd9129109a94b1c16c9c62eef46c09113c4c585d9bf0e69b2da
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral10
    • Target
      vcruntime140.dll
    • Size 121KB
    • SHA256 60b813f8b87ff4fa344f081c163c1a2234b5e3e41f748721c28fbdecbcfecb8a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral11behavioral12
    • Target
      vcruntime140_1.dll
    • Size 48KB
    • SHA256 e30b3f4979b63b50438d061858c9cde962f4494e585c627a11c98b6c5b7b2592
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral13behavioral14

MITRE ATT&CK Enterprise v16

Tasks