57316e29bbf6391f28d0c11c78b61607b9b1a4e87fb3adbb1855b8773223f0e1

Analysis

max time kernel
134s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
27-10-2023 03:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

HipsMain.exe
Size

9.0MB
MD5

4eca89b96ba84a68348f85b3a9dc03b7
SHA1

a1fd3e9093d8153b15fc1102f35c745b375ce9dc
SHA256

8df72d49778de3cc2ba9c31299f7f4a0a0a144ea4826a51b1de75d037ba2a7f7
SHA512

6170c930d76c9aca6ee9a6b4816b829677c7b303a20afc62e38fe675c7acd1e1fb8dca756c4ed44106fa1f37a99e05ebd271f78b7edddf238a3a15effd78ec32
SSDEEP

196608:ohPrc50mr2puHUHNTqICteEroXx8axG6NIyzlu8pgUN0Mi8mENps:OcKmr2pu0tTqInEroXOakuIyzlu8pja4

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 18 IoCs

Processes:

HipsMain.exe

pid	process
4796	HipsMain.exe
4796	HipsMain.exe
4796	HipsMain.exe
4796	HipsMain.exe
4796	HipsMain.exe
4796	HipsMain.exe
4796	HipsMain.exe
4796	HipsMain.exe
4796	HipsMain.exe
4796	HipsMain.exe
4796	HipsMain.exe
4796	HipsMain.exe
4796	HipsMain.exe
4796	HipsMain.exe
4796	HipsMain.exe
4796	HipsMain.exe
4796	HipsMain.exe
4796	HipsMain.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

HipsMain.exe

description	pid	process	target process
PID 1548 wrote to memory of 4796	1548	HipsMain.exe	HipsMain.exe
PID 1548 wrote to memory of 4796	1548	HipsMain.exe	HipsMain.exe

C:\Users\Admin\AppData\Local\Temp\HipsMain.exe
"C:\Users\Admin\AppData\Local\Temp\HipsMain.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1548

C:\Users\Admin\AppData\Local\Temp\HipsMain.exe
"C:\Users\Admin\AppData\Local\Temp\HipsMain.exe"
2⤵
- Loads dropped DLL
PID:4796

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI15482\VCRUNTIME140.dll
Filesize
94KB

MD5
a87575e7cf8967e481241f13940ee4f7

SHA1
879098b8a353a39e16c79e6479195d43ce98629e

SHA256
ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e

SHA512
e112f267ae4c9a592d0dd2a19b50187eb13e25f23ded74c2e6ccde458bcdaee99f4e3e0a00baf0e3362167ae7b7fe4f96ecbcd265cc584c1c3a4d1ac316e92f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15482\VCRUNTIME140.dll
Filesize
94KB

MD5
a87575e7cf8967e481241f13940ee4f7

SHA1
879098b8a353a39e16c79e6479195d43ce98629e

SHA256
ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e

SHA512
e112f267ae4c9a592d0dd2a19b50187eb13e25f23ded74c2e6ccde458bcdaee99f4e3e0a00baf0e3362167ae7b7fe4f96ecbcd265cc584c1c3a4d1ac316e92f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15482\_bz2.pyd
Filesize
84KB

MD5
1b64223fcf78fb54b0966cdf1364cfc2

SHA1
fa05117eb7e0e0f811055c441555fd69ad080f14

SHA256
f1caa21e43b746db5c5bd632e16565eb4e8fee39b4af3974ac8e7ef95bd1768a

SHA512
700a9dd45dd6d75fc507104723289b5839e585f0bc0591866f81ec344911571668fc508da93b862bba3ada61285e44e720394ca95ea9388a1e67d2d27edb221e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15482\_bz2.pyd
Filesize
84KB

MD5
1b64223fcf78fb54b0966cdf1364cfc2

SHA1
fa05117eb7e0e0f811055c441555fd69ad080f14

SHA256
f1caa21e43b746db5c5bd632e16565eb4e8fee39b4af3974ac8e7ef95bd1768a

SHA512
700a9dd45dd6d75fc507104723289b5839e585f0bc0591866f81ec344911571668fc508da93b862bba3ada61285e44e720394ca95ea9388a1e67d2d27edb221e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15482\_cffi_backend.cp39-win_amd64.pyd
Filesize
177KB

MD5
ba20b38817bd31b386615e6cf3096940

SHA1
dfd0286bc3d11d779f6b24f4245b5602b1842df0

SHA256
0fffe7a441f2c272a7c6d8cf5eb1adce71fde6f6102bc7c1ceb90e05730c4b07

SHA512
b580c1c26f4ddea3fb7050c83839e9e3ede7659f934928072ae8da53db0c92babc72dbc01130ec931f4ec87e3a3118b6d6c42a4654cd6775e24710517585b275

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15482\_cffi_backend.cp39-win_amd64.pyd
Filesize
177KB

MD5
ba20b38817bd31b386615e6cf3096940

SHA1
dfd0286bc3d11d779f6b24f4245b5602b1842df0

SHA256
0fffe7a441f2c272a7c6d8cf5eb1adce71fde6f6102bc7c1ceb90e05730c4b07

SHA512
b580c1c26f4ddea3fb7050c83839e9e3ede7659f934928072ae8da53db0c92babc72dbc01130ec931f4ec87e3a3118b6d6c42a4654cd6775e24710517585b275

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15482\_ctypes.pyd
Filesize
123KB

MD5
5bd1165ce7c92448bb937a1232a6f13f

SHA1
3b9e46626f58baaf58569dca3a22509373acee6a

SHA256
782afa4bc23a39ad06d90545179e3a905e7869155d7854a200c0cea2a2065616

SHA512
1203a13dc3ca4fd5fd9ed10bb04f25f7813065bb91dccbf70a9c2704c12345464cadc042b2ac1989686039247f9f10e9ce7933b189c25d44a9c8f5e8ebf9deb7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15482\_ctypes.pyd
Filesize
123KB

MD5
5bd1165ce7c92448bb937a1232a6f13f

SHA1
3b9e46626f58baaf58569dca3a22509373acee6a

SHA256
782afa4bc23a39ad06d90545179e3a905e7869155d7854a200c0cea2a2065616

SHA512
1203a13dc3ca4fd5fd9ed10bb04f25f7813065bb91dccbf70a9c2704c12345464cadc042b2ac1989686039247f9f10e9ce7933b189c25d44a9c8f5e8ebf9deb7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15482\_hashlib.pyd
Filesize
64KB

MD5
42fbc171edc5dbfe2f80c91aac4450d8

SHA1
74d6ac2fd375fdcdd0734db51cce817d1048ea35

SHA256
cf3110ba5fb05d7f371174756c037279def558fd99062c1021a11610ba0a228a

SHA512
a446113f13d47fff2b0993af2989d3441e1df781c9fd63bef9b733a18f79941a7959717baf664cec04045fe8b5cdef0309b97d19dd210d34746f24086c9205b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15482\_hashlib.pyd
Filesize
64KB

MD5
42fbc171edc5dbfe2f80c91aac4450d8

SHA1
74d6ac2fd375fdcdd0734db51cce817d1048ea35

SHA256
cf3110ba5fb05d7f371174756c037279def558fd99062c1021a11610ba0a228a

SHA512
a446113f13d47fff2b0993af2989d3441e1df781c9fd63bef9b733a18f79941a7959717baf664cec04045fe8b5cdef0309b97d19dd210d34746f24086c9205b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15482\_lzma.pyd
Filesize
159KB

MD5
fe2f15ce4822dc60f6cb7946eb31cc15

SHA1
dffc10907d1dac5807598146751b27ae1e3b1c3d

SHA256
b70653ac6f1cfd4eb5d8fea20a4ed1965607699a937ba6c422eb0f308ca334b5

SHA512
1f658692d8bd74de674acf06bece2d88fed51cb5fc5d9f611aade0984ff288f7f7f4268154e5017c36f235429ef1323de9e3bc079c3282b9b394a19c3d499dc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15482\_lzma.pyd
Filesize
159KB

MD5
fe2f15ce4822dc60f6cb7946eb31cc15

SHA1
dffc10907d1dac5807598146751b27ae1e3b1c3d

SHA256
b70653ac6f1cfd4eb5d8fea20a4ed1965607699a937ba6c422eb0f308ca334b5

SHA512
1f658692d8bd74de674acf06bece2d88fed51cb5fc5d9f611aade0984ff288f7f7f4268154e5017c36f235429ef1323de9e3bc079c3282b9b394a19c3d499dc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15482\_queue.pyd
Filesize
28KB

MD5
e34be01e0198aeebb07b8f00d2bc73bd

SHA1
98ceea493f77cb0b41c009aa9084cddf296626ff

SHA256
f9e55b911dc3ea4bbae60182adf72c037a8007d67fb3496dc88809569c4ee8e2

SHA512
c6deab35e38fbf1cf489b2f2b6703751c62e7235c7aa7a7bb0813717244f39213ab57cd2a013bdbb60145a9c5ef34a95554ae015936780398012e756b7bad721

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15482\_queue.pyd
Filesize
28KB

MD5
e34be01e0198aeebb07b8f00d2bc73bd

SHA1
98ceea493f77cb0b41c009aa9084cddf296626ff

SHA256
f9e55b911dc3ea4bbae60182adf72c037a8007d67fb3496dc88809569c4ee8e2

SHA512
c6deab35e38fbf1cf489b2f2b6703751c62e7235c7aa7a7bb0813717244f39213ab57cd2a013bdbb60145a9c5ef34a95554ae015936780398012e756b7bad721

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15482\_socket.pyd
Filesize
78KB

MD5
47db85de5df1060a6205b5ae419538c5

SHA1
53fd584c1df7a93adf90278a18bbed362f933642

SHA256
9957f8510b3a2c672d723a247d856424397c837bb0a7777a505442e288725631

SHA512
04ac8489545f7151bfd9caeadfcfda597bf78ea2c13069cdc9d6bcd3eba5e00db9d1af4e6ef22696c2da94bce15cbfdd2fa1a7e822604149c822fece8e4a0286

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15482\_socket.pyd
Filesize
78KB

MD5
47db85de5df1060a6205b5ae419538c5

SHA1
53fd584c1df7a93adf90278a18bbed362f933642

SHA256
9957f8510b3a2c672d723a247d856424397c837bb0a7777a505442e288725631

SHA512
04ac8489545f7151bfd9caeadfcfda597bf78ea2c13069cdc9d6bcd3eba5e00db9d1af4e6ef22696c2da94bce15cbfdd2fa1a7e822604149c822fece8e4a0286

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15482\_ssl.pyd
Filesize
151KB

MD5
3a3e2d8bd925fa6197eb8eb42b49a123

SHA1
5f1d411296531b36545a0895ad936ffab370cf23

SHA256
57be076f338b4938d309faee2e18de04a580c20e23b601a92671a62ad0517f11

SHA512
1ffe3aaeb0dbeb2672d2e14ced2c7ba6757881a7742a49fc81f317ce1b4ebd8d25ea1f410c06fbc408a5084768919368fec5d60823658b6f4a24434938b90f0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15482\_ssl.pyd
Filesize
151KB

MD5
3a3e2d8bd925fa6197eb8eb42b49a123

SHA1
5f1d411296531b36545a0895ad936ffab370cf23

SHA256
57be076f338b4938d309faee2e18de04a580c20e23b601a92671a62ad0517f11

SHA512
1ffe3aaeb0dbeb2672d2e14ced2c7ba6757881a7742a49fc81f317ce1b4ebd8d25ea1f410c06fbc408a5084768919368fec5d60823658b6f4a24434938b90f0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15482\base_library.zip
Filesize
1014KB

MD5
ceb502728c2ffe24420637189e27f49a

SHA1
91106e2d32d7c5b3dd092c69bfded79a34e110c1

SHA256
4f3107c18748ccae1862fa8aaf1a02ad395bef209d57c673256152eb1d9829be

SHA512
6df2581344378c344d1f4b59af1611ff97d73531e2ca3231b80ab1868aae4a12dbe369ea8edda52e478c90c9f0b8a243907acd509613341678d856e5f7e136dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15482\cryptography\hazmat\bindings\_rust.pyd
Filesize
6.3MB

MD5
0617be8f80712bfecc5b6551b0611c54

SHA1
8211673695be21afb30abde8f63e6321b4e2a492

SHA256
dcb9980557fd18e59a075758236da0d3fcd445fae2ef990e670cc5da1a67fc73

SHA512
2343786e5d40771d688fe5582dca2240b8821c957f51eb7cfb63a679bd5d71a126fee2bcd5e91feb205117a49220610daf302c95e245c34a0a8c6e061262c31a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15482\cryptography\hazmat\bindings\_rust.pyd
Filesize
6.3MB

MD5
0617be8f80712bfecc5b6551b0611c54

SHA1
8211673695be21afb30abde8f63e6321b4e2a492

SHA256
dcb9980557fd18e59a075758236da0d3fcd445fae2ef990e670cc5da1a67fc73

SHA512
2343786e5d40771d688fe5582dca2240b8821c957f51eb7cfb63a679bd5d71a126fee2bcd5e91feb205117a49220610daf302c95e245c34a0a8c6e061262c31a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15482\libcrypto-1_1.dll
Filesize
3.3MB

MD5
63c4f445b6998e63a1414f5765c18217

SHA1
8c1ac1b4290b122e62f706f7434517077974f40e

SHA256
664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2

SHA512
aa7bdb3c5bc8aeefbad70d785f2468acbb88ef6e6cac175da765647030734453a2836f9658dc7ce33f6fff0de85cb701c825ef5c04018d79fa1953c8ef946afd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15482\libcrypto-1_1.dll
Filesize
3.3MB

MD5
63c4f445b6998e63a1414f5765c18217

SHA1
8c1ac1b4290b122e62f706f7434517077974f40e

SHA256
664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2

SHA512
aa7bdb3c5bc8aeefbad70d785f2468acbb88ef6e6cac175da765647030734453a2836f9658dc7ce33f6fff0de85cb701c825ef5c04018d79fa1953c8ef946afd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15482\libcrypto-1_1.dll
Filesize
3.3MB

MD5
63c4f445b6998e63a1414f5765c18217

SHA1
8c1ac1b4290b122e62f706f7434517077974f40e

SHA256
664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2

SHA512
aa7bdb3c5bc8aeefbad70d785f2468acbb88ef6e6cac175da765647030734453a2836f9658dc7ce33f6fff0de85cb701c825ef5c04018d79fa1953c8ef946afd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15482\libffi-7.dll
Filesize
32KB

MD5
eef7981412be8ea459064d3090f4b3aa

SHA1
c60da4830ce27afc234b3c3014c583f7f0a5a925

SHA256
f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

SHA512
dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15482\libffi-7.dll
Filesize
32KB

MD5
eef7981412be8ea459064d3090f4b3aa

SHA1
c60da4830ce27afc234b3c3014c583f7f0a5a925

SHA256
f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

SHA512
dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15482\libssl-1_1.dll
Filesize
678KB

MD5
bd857f444ebbf147a8fcd1215efe79fc

SHA1
1550e0d241c27f41c63f197b1bd669591a20c15b

SHA256
b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf

SHA512
2b85c1521edeadf7e118610d6546fafbbad43c288a7f0f9d38d97c4423a541dfac686634cde956812916830fbb4aad8351a23d95cd490c4a5c0f628244d30f0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15482\libssl-1_1.dll
Filesize
678KB

MD5
bd857f444ebbf147a8fcd1215efe79fc

SHA1
1550e0d241c27f41c63f197b1bd669591a20c15b

SHA256
b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf

SHA512
2b85c1521edeadf7e118610d6546fafbbad43c288a7f0f9d38d97c4423a541dfac686634cde956812916830fbb4aad8351a23d95cd490c4a5c0f628244d30f0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15482\python3.DLL
Filesize
58KB

MD5
b7c5dab8505ee61de3988d4ed5870330

SHA1
ce4781ba0df2a80504b240520268e0946a1d496e

SHA256
175532b9e879e046ea91100876cb516098f668c2547f145130de5b1d34134672

SHA512
46364859b487d065d20a6613da99f850f99fb5d21942fb02f4df871fb3296c41cef3e2482f5e5d94a5a94cafa52ba0938267e54df35b6d09b4b6ddf40eed22f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15482\python3.dll
Filesize
58KB

MD5
b7c5dab8505ee61de3988d4ed5870330

SHA1
ce4781ba0df2a80504b240520268e0946a1d496e

SHA256
175532b9e879e046ea91100876cb516098f668c2547f145130de5b1d34134672

SHA512
46364859b487d065d20a6613da99f850f99fb5d21942fb02f4df871fb3296c41cef3e2482f5e5d94a5a94cafa52ba0938267e54df35b6d09b4b6ddf40eed22f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15482\python39.dll
Filesize
4.3MB

MD5
0c74e7172e79148d2c995951cb828fa1

SHA1
6e46616de50a7871668b2e6a22895b9c594d232a

SHA256
3937d1865f5a6f9ba892705bbe75352defc7b083b61894a4bdb6adefe0c2b39d

SHA512
bbca4b2c6338f0d4274c5db371cae075834677844e457280d8d9f2c5ba74b3a9a159aeb978cf3fa4983d2efda62cbc2c9570d56e4a9682324f7fc7c2788ede86

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15482\python39.dll
Filesize
4.3MB

MD5
0c74e7172e79148d2c995951cb828fa1

SHA1
6e46616de50a7871668b2e6a22895b9c594d232a

SHA256
3937d1865f5a6f9ba892705bbe75352defc7b083b61894a4bdb6adefe0c2b39d

SHA512
bbca4b2c6338f0d4274c5db371cae075834677844e457280d8d9f2c5ba74b3a9a159aeb978cf3fa4983d2efda62cbc2c9570d56e4a9682324f7fc7c2788ede86

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15482\select.pyd
Filesize
28KB

MD5
a0130c5a6e3c3b5fb7ef39f0d7f9c3b3

SHA1
71ec88cfc353a272dca4177cb621e49a108e5bec

SHA256
2c660a24a6de0a9f4cdd264a849a34dae9fed4fb7ea4bad1d0c8cc411abe09c5

SHA512
87d1b9ac18af2ffc3112f1aac6c2a30efc44c0ef6ecd46fb386238665dd491b1f8abf8c889a589c71fb5b59027865054e167f4d734b99851ba90c2519ab13e28

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15482\select.pyd
Filesize
28KB

MD5
a0130c5a6e3c3b5fb7ef39f0d7f9c3b3

SHA1
71ec88cfc353a272dca4177cb621e49a108e5bec

SHA256
2c660a24a6de0a9f4cdd264a849a34dae9fed4fb7ea4bad1d0c8cc411abe09c5

SHA512
87d1b9ac18af2ffc3112f1aac6c2a30efc44c0ef6ecd46fb386238665dd491b1f8abf8c889a589c71fb5b59027865054e167f4d734b99851ba90c2519ab13e28

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15482\unicodedata.pyd
Filesize
1.1MB

MD5
bdd26affb3c90fb1710f9b607de5b5d0

SHA1
91d7181afcedd825ebb72557474b31aa0184a195

SHA256
0a76b6ae84c49a88ff36a5b508e683018d6a664cfe3301a8a2ce5872fc2ea207

SHA512
e72ccbf25a3ae5acb7536523744126946f53488eb8b54db50524a18dfe19e9709aaefc1c47c817d2e5817e5de9d45c3fda31097f60e1db944646855a71e274c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15482\unicodedata.pyd
Filesize
1.1MB

MD5
bdd26affb3c90fb1710f9b607de5b5d0

SHA1
91d7181afcedd825ebb72557474b31aa0184a195

SHA256
0a76b6ae84c49a88ff36a5b508e683018d6a664cfe3301a8a2ce5872fc2ea207

SHA512
e72ccbf25a3ae5acb7536523744126946f53488eb8b54db50524a18dfe19e9709aaefc1c47c817d2e5817e5de9d45c3fda31097f60e1db944646855a71e274c5

Download Submit