hijackloader | 6f08d25994d6b37a4c711033e6b949ab66c15914952eb4c86efa504f727af635

Resubmissions

13-06-2024 03:14

240613-drjrtswcqk 10

12-06-2024 14:43

240612-r3q7yayelh 10

Analysis

max time kernel
80s
max time network
71s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13-06-2024 03:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

mp.exe
Size

9.2MB
MD5

bbc886e8c9dde33980c382263b7ce8b8
SHA1

a5953c53277cfb3db60f8060fe6d69ca87dc8ee4
SHA256

6f08d25994d6b37a4c711033e6b949ab66c15914952eb4c86efa504f727af635
SHA512

f247523b095cd3259a18ec2866491385326d8ae92b4cba0f068822b06730c9b7a15b9773ac0cd043a7b06655b0fe29d9cca7d6559c4ce0f9241f0abfab592bee
SSDEEP

196608:wssBSXxz17OxBaQR5MetJ05SuN1qpJ1pRONksJp:wssBSXxzIBaQR525do1pRbkp

Score

10^/10

hijackloader stealc xprivate4 loader stealer

Malware Config

Extracted

Family

stealc

Botnet

xprivate4

http://45.88.77.186

Attributes

url_path
/93fc676dbd45174b.php

Signatures

Detects HijackLoader (aka IDAT Loader) 1 IoCs

Processes:

resource yara_rule

behavioral2/memory/3200-0-0x0000000140000000-0x0000000140943000-memory.dmp family_hijackloader
HijackLoader
HijackLoader is a multistage loader first seen in 2023.
loader hijackloader
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

5000 cmd.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

mp.exe

description pid process target process

PID 3200 set thread context of 5000 3200 mp.exe cmd.exe

resource	yara_rule
behavioral2/memory/3200-0-0x0000000140000000-0x0000000140943000-memory.dmp	family_hijackloader

pid	process
5000	cmd.exe

description	pid	process	target process
PID 3200 set thread context of 5000	3200	mp.exe	cmd.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	explorer.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

mp.execmd.exeexplorer.exe

pid process

3200 mp.exe
3200 mp.exe
5000 cmd.exe
5000 cmd.exe
4496 explorer.exe
4496 explorer.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

mp.execmd.exe

pid process

3200 mp.exe
5000 cmd.exe

pid	process
3200	mp.exe
3200	mp.exe
5000	cmd.exe
5000	cmd.exe
4496	explorer.exe
4496	explorer.exe

pid	process
3200	mp.exe
5000	cmd.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

mp.execmd.exe

description	pid	process	target process
PID 3200 wrote to memory of 5000	3200	mp.exe	cmd.exe
PID 3200 wrote to memory of 5000	3200	mp.exe	cmd.exe
PID 3200 wrote to memory of 5000	3200	mp.exe	cmd.exe
PID 3200 wrote to memory of 5000	3200	mp.exe	cmd.exe
PID 5000 wrote to memory of 4496	5000	cmd.exe	explorer.exe
PID 5000 wrote to memory of 4496	5000	cmd.exe	explorer.exe
PID 5000 wrote to memory of 4496	5000	cmd.exe	explorer.exe
PID 5000 wrote to memory of 4496	5000	cmd.exe	explorer.exe
PID 5000 wrote to memory of 4496	5000	cmd.exe	explorer.exe

C:\Users\Admin\AppData\Local\Temp\mp.exe
"C:\Users\Admin\AppData\Local\Temp\mp.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3200

C:\Windows\SysWOW64\cmd.exe
C:\Windows\SysWOW64\cmd.exe
2⤵
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:5000

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:4496

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\a525aadb
Filesize
860KB

MD5
8eb66daf67881808a2cbfc44968c67a1

SHA1
bedeafb20a6c40963792b5073471d9ddf0a18a3d

SHA256
c6c6c9c5a3bf247bef76187aade92b75afaf18cf98fb83c92d4866dfa5a5732d

SHA512
f78300c1cd65843bc9056f2470334b284061cff26920c65a3f4e2ce8a34c6a75b8464e6872190334a9d143d2613a7854d978a2686253136aa1d0e9677b97e05e

Download Submit
memory/3200-0-0x0000000140000000-0x0000000140943000-memory.dmp

Filesize
9.3MB

Download
memory/3200-1-0x00007FFCDB0C0000-0x00007FFCDB232000-memory.dmp

Filesize
1.4MB

Download
memory/3200-2-0x00007FFCDB0D8000-0x00007FFCDB0D9000-memory.dmp

Filesize
4KB

Download
memory/3200-3-0x00007FFCDB0C0000-0x00007FFCDB232000-memory.dmp

Filesize
1.4MB

Download
memory/3200-4-0x00007FFCDB0C0000-0x00007FFCDB232000-memory.dmp

Filesize
1.4MB

Download
memory/4496-18-0x00000000010A3000-0x00000000010AB000-memory.dmp

Filesize
32KB

Download
memory/4496-21-0x0000000000D00000-0x0000000000F3C000-memory.dmp

Filesize
2.2MB

Download
memory/4496-24-0x0000000000D00000-0x0000000000F3C000-memory.dmp

Filesize
2.2MB

Download
memory/4496-23-0x0000000000D00000-0x0000000000F3C000-memory.dmp

Filesize
2.2MB

Download
memory/4496-22-0x0000000000D00000-0x0000000000F3C000-memory.dmp

Filesize
2.2MB

Download
memory/4496-13-0x0000000000D00000-0x0000000000F3C000-memory.dmp

Filesize
2.2MB

Download
memory/4496-14-0x00007FFCE9DD0000-0x00007FFCE9FC5000-memory.dmp

Filesize
2.0MB

Download
memory/4496-15-0x0000000000D00000-0x0000000000F3C000-memory.dmp

Filesize
2.2MB

Download
memory/4496-19-0x0000000000FC0000-0x00000000013F3000-memory.dmp

Filesize
4.2MB

Download
memory/5000-12-0x0000000075960000-0x0000000075ADB000-memory.dmp

Filesize
1.5MB

Download
memory/5000-20-0x000000007596E000-0x0000000075970000-memory.dmp

Filesize
8KB

Download
memory/5000-7-0x00007FFCE9DD0000-0x00007FFCE9FC5000-memory.dmp

Filesize
2.0MB

Download
memory/5000-9-0x000000007596E000-0x0000000075970000-memory.dmp

Filesize
8KB

Download
memory/5000-8-0x0000000075960000-0x0000000075ADB000-memory.dmp

Filesize
1.5MB

Download
memory/5000-10-0x0000000075960000-0x0000000075ADB000-memory.dmp

Filesize
1.5MB

Download