| File name: | malware.zip |
| Full analysis: | https://app.any.run/tasks/1e28a327-f763-40ad-9e8c-f05fe5fa82cb |
| Verdict: | Malicious activity |
| Threats: | HijackLoader is a modular malware acting as a vehicle for distributing different types of malicious software on compromised systems. It gained prominence during the summer of 2023 and has since been used in multiple attacks against organizations from various sectors, including hospitality businesses. |
| Analysis date: | May 15, 2025, 12:13:54 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/zip |
| File info: | Zip archive data, at least v2.0 to extract, compression method=deflate |
| MD5: | 378891315409C1243823A72A2F3FB029 |
| SHA1: | 04C1A9BB9F38C5B2C96BF3D2E8DDB6E34C94D354 |
| SHA256: | 6745669064F773D41721853152775470BACE6F0701A20C5AE617B75980426BB3 |
| SSDEEP: | 98304:Csz9PWX+c7n7vJtGLUDxMOLe7b+txKHwGpbOEbG23LziA9exi8AXAQDwkMP2MB0+:gsZRyMcEGz |
MALICIOUS
Executing a file with an untrusted certificate
- ODlwEPeb.exe (PID: 7760)
- FusionClus.exe (PID: 7884)
- XPFix.exe (PID: 8128)
HIJACKLOADER has been detected (YARA)
- ODlwEPeb.exe (PID: 7760)
RHADAMANTHYS mutex has been found
- svchost.exe (PID: 8168)
- FusionClus.exe (PID: 7884)
RHADAMANTHYS has been detected (YARA)
- svchost.exe (PID: 8168)
SUSPICIOUS
Process drops legitimate windows executable
- WinRAR.exe (PID: 4180)
- ODlwEPeb.exe (PID: 7760)
The process creates files with name similar to system file names
- WinRAR.exe (PID: 4180)
- ODlwEPeb.exe (PID: 7760)
Reads security settings of Internet Explorer
- WinRAR.exe (PID: 4180)
The process drops C-runtime libraries
- ODlwEPeb.exe (PID: 7760)
Executable content was dropped or overwritten
- ODlwEPeb.exe (PID: 7760)
The process checks if it is being run in the virtual environment
- svchost.exe (PID: 8168)
INFO
The sample compiled with english language support
- WinRAR.exe (PID: 4180)
- ODlwEPeb.exe (PID: 7760)
Executable content was dropped or overwritten
- WinRAR.exe (PID: 4180)
Manual execution by a user
- ODlwEPeb.exe (PID: 7760)
- svchost.exe (PID: 8168)
Creates files in the program directory
- ODlwEPeb.exe (PID: 7760)
Checks supported languages
- ODlwEPeb.exe (PID: 7760)
- FusionClus.exe (PID: 7884)
- XPFix.exe (PID: 8128)
Reads the computer name
- ODlwEPeb.exe (PID: 7760)
- FusionClus.exe (PID: 7884)
- XPFix.exe (PID: 8128)
Creates files or folders in the user directory
- ODlwEPeb.exe (PID: 7760)
The sample compiled with chinese language support
- ODlwEPeb.exe (PID: 7760)
Create files in a temporary directory
- ODlwEPeb.exe (PID: 7760)
- XPFix.exe (PID: 8128)
Reads the software policy settings
- slui.exe (PID: 7252)
- slui.exe (PID: 1184)
Checks proxy server information
- slui.exe (PID: 1184)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .zip | | | ZIP compressed archive (100) |
|---|
EXIF
ZIP
| ZipRequiredVersion: | 20 |
|---|---|
| ZipBitFlag: | - |
| ZipCompression: | Deflated |
| ZipModifyDate: | 2025:05:12 16:46:34 |
| ZipCRC: | 0x08b8ca42 |
| ZipCompressedSize: | 183665 |
| ZipUncompressedSize: | 568008 |
| ZipFileName: | dvatransport.dll |
Total processes
142
Monitored processes
10
Malicious processes
3
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1184 | C:\WINDOWS\System32\slui.exe -Embedding | C:\Windows\System32\slui.exe | svchost.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Activation Client Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2196 | C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s Dnscache | C:\Windows\System32\svchost.exe | services.exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Host Process for Windows Services Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4180 | "C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\malware.zip | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.91.0 Modules
| |||||||||||||||
| 7220 | C:\WINDOWS\system32\SppExtComObj.exe -Embedding | C:\Windows\System32\SppExtComObj.Exe | — | svchost.exe | |||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: KMS Connection Broker Exit code: 0 Version: 10.0.19041.3996 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7252 | "C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEvent | C:\Windows\System32\slui.exe | SppExtComObj.Exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows Activation Client Exit code: 1 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7668 | C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding | C:\Windows\System32\rundll32.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7760 | "C:\Users\admin\AppData\Local\Temp\malware\ODlwEPeb.exe" | C:\Users\admin\AppData\Local\Temp\malware\ODlwEPeb.exe | explorer.exe | ||||||||||||
User: admin Company: Adobe Systems Incorporated Integrity Level: MEDIUM Description: Adobe Dynamic Link Manager.0 Exit code: 0 Version: 8.0.0.0 Modules
| |||||||||||||||
| 7884 | C:\Users\admin\AppData\Local\Temp\FusionClus.exe | C:\Users\admin\AppData\Local\Temp\FusionClus.exe | ODlwEPeb.exe | ||||||||||||
User: admin Company: Greatis Software Integrity Level: MEDIUM Description: Run non elevated program Exit code: 0 Version: 1.0.0.1 Modules
| |||||||||||||||
| 8128 | "C:\Users\admin\AppData\Roaming\configtool_alpha\XPFix.exe" "C:\Users\admin\AppData\Roaming\configtool_alpha\XPFix.exe" /update | C:\Users\admin\AppData\Roaming\configtool_alpha\XPFix.exe | — | ODlwEPeb.exe | |||||||||||
User: admin Company: 360.cn Integrity Level: MEDIUM Description: 360安全卫士 安全防护中心模块 Exit code: 0 Version: 1, 0, 0, 1013 Modules
| |||||||||||||||
| 8168 | "C:\Windows\System32\svchost.exe" | C:\Windows\SysWOW64\svchost.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Host Process for Windows Services Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
4 350
Read events
4 325
Write events
12
Delete events
13
Modification events
| (PID) Process: | (4180) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 3 |
Value: C:\Users\admin\Desktop\preferences.zip | |||
| (PID) Process: | (4180) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\chromium_ext.zip | |||
| (PID) Process: | (4180) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\omni_23_10_2024_.zip | |||
| (PID) Process: | (4180) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\malware.zip | |||
| (PID) Process: | (4180) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (4180) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (4180) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (4180) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (4180) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath |
| Operation: | delete value | Name: | 15 |
Value: | |||
| (PID) Process: | (4180) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath |
| Operation: | delete value | Name: | 14 |
Value: | |||
Executable files
25
Suspicious files
8
Text files
0
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 4180 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\malware\dvatransport.dll | executable | |
MD5:C56CB2A849C920137088A6191D86C6BC | SHA256:5E12D3CF38ED4CAC63129F421633E2E78548722EC3ED34B6463A6840DB01A59F | |||
| 4180 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\malware\boost_threads.dll | executable | |
MD5:44D1D2711F5FF5C0D5A566BEEED1FBE2 | SHA256:882F809095A5A2B8BE3C5A26D5882632D99B0622DB904DCA3FFCB48FD093D91C | |||
| 4180 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\malware\ODlwEPeb.exe | executable | |
MD5:0E4D0427E2EF970138A24C0F3A6EC8DF | SHA256:F9E187178A9E7C0BA13E0465AEBBD446966393C09EA5930BEA86DEE9208C31D7 | |||
| 4180 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\malware\dvanet.dll | executable | |
MD5:5790ABD90395C121EFA8B6D7A615F050 | SHA256:6C154B0E07F2A7A8DAFBCA6610FFC4B50899ED815A3A27F8F9F87D5EB99F1ADD | |||
| 4180 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\malware\dvacore.dll | executable | |
MD5:35D25E3AB2C4B362AE162C6AF3482B28 | SHA256:E33F1D96F2905FB874EC52777AFC3498231791426B7049E9EF61AEDB9F782042 | |||
| 4180 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\malware\Hekkrekweert.oehx | binary | |
MD5:5C43888FCE3D2F1ABD1D0CFBFD668E61 | SHA256:2E4654A20596DBDBE5A6779BDA13A16F540EB45687A93EC563A0ED56F16DAE72 | |||
| 4180 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\malware\dvamediatypes.dll | executable | |
MD5:0641560E5ECD1702AA259AC8C48577E1 | SHA256:3FAA936558703316EDBFB0D57D697F0ED160149B1417F4D5D02D9EF3576FF779 | |||
| 7760 | ODlwEPeb.exe | C:\ProgramData\configtool_alpha\boost_system.dll | executable | |
MD5:CEF0081A028FDA210C1AD6417865CC95 | SHA256:4F3A1C28B3A15E6FBB3EA635B2C43FEA7DE4A797543B5CF2142FE6B0240F2C5F | |||
| 7760 | ODlwEPeb.exe | C:\ProgramData\configtool_alpha\boost_date_time.dll | executable | |
MD5:E4862728552671212C86B50470710BEB | SHA256:83A6FF307C32692F8775302315295E6A814701D5A617621C25B935CF9660D50F | |||
| 4180 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\malware\boost_system.dll | executable | |
MD5:CEF0081A028FDA210C1AD6417865CC95 | SHA256:4F3A1C28B3A15E6FBB3EA635B2C43FEA7DE4A797543B5CF2142FE6B0240F2C5F | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
61
DNS requests
61
Threats
9
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
7956 | SIHClient.exe | GET | 200 | 2.23.246.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
7956 | SIHClient.exe | GET | 200 | 2.23.246.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
6544 | svchost.exe | GET | 200 | 2.17.190.73:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
5496 | MoUsoCoreWorker.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
5496 | MoUsoCoreWorker.exe | GET | 200 | 23.48.23.143:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
— | — | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
5496 | MoUsoCoreWorker.exe | 23.48.23.143:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
5496 | MoUsoCoreWorker.exe | 23.35.229.160:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
3216 | svchost.exe | 172.211.123.250:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | FR | whitelisted |
6544 | svchost.exe | 40.126.31.129:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
6544 | svchost.exe | 2.17.190.73:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
2568 | RUXIMICS.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
2104 | svchost.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |
cloudflare-dns.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
2196 | svchost.exe | Potentially Bad Traffic | ET DNS Query to a *.top domain - Likely Hostile |
8168 | svchost.exe | Misc activity | ET INFO Cloudflare DNS Over HTTPS Certificate Inbound |
2196 | svchost.exe | Potentially Bad Traffic | ET DNS Query to a *.top domain - Likely Hostile |
2196 | svchost.exe | Potentially Bad Traffic | ET DNS Query to a *.top domain - Likely Hostile |
8168 | svchost.exe | Misc activity | ET INFO Cloudflare DNS Over HTTPS Certificate Inbound |
2196 | svchost.exe | Potentially Bad Traffic | ET DNS Query to a *.top domain - Likely Hostile |
2196 | svchost.exe | Potentially Bad Traffic | ET DNS Query to a *.top domain - Likely Hostile |
2196 | svchost.exe | Potentially Bad Traffic | ET DNS Query to a *.top domain - Likely Hostile |
2196 | svchost.exe | Potentially Bad Traffic | ET DNS Query to a *.top domain - Likely Hostile |