Overview
overview
10Static
static
72023.10.12.exe
windows7-x64
12023.10.12.exe
windows10-2004-x64
1HipsMain.exe
windows7-x64
7HipsMain.exe
windows10-2004-x64
7HipsMain1.exe
windows7-x64
7HipsMain1.exe
windows10-2004-x64
7[local]loader.exe
windows7-x64
7[local]loader.exe
windows10-2004-x64
7[sus]aaa.exe
windows7-x64
10[sus]aaa.exe
windows10-2004-x64
10logsave.exe
windows7-x64
7logsave.exe
windows10-2004-x64
7福建省�...��.exe
windows7-x64
7福建省�...��.exe
windows10-2004-x64
7说明书.exe
windows7-x64
1说明书.exe
windows10-2004-x64
1Analysis
-
max time kernel
120s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
27-10-2023 03:49
Behavioral task
behavioral1
Sample
2023.10.12.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
2023.10.12.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral3
Sample
HipsMain.exe
Resource
win7-20231023-en
Behavioral task
behavioral4
Sample
HipsMain.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral5
Sample
HipsMain1.exe
Resource
win7-20231020-en
Behavioral task
behavioral6
Sample
HipsMain1.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral7
Sample
[local]loader.exe
Resource
win7-20231025-en
Behavioral task
behavioral8
Sample
[local]loader.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral9
Sample
[sus]aaa.exe
Resource
win7-20231023-en
Behavioral task
behavioral10
Sample
[sus]aaa.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral11
Sample
logsave.exe
Resource
win7-20231023-en
Behavioral task
behavioral12
Sample
logsave.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral13
Sample
福建省福州市闽运集团有限公司约巴定制巴士企划书.exe
Resource
win7-20231020-en
Behavioral task
behavioral14
Sample
福建省福州市闽运集团有限公司约巴定制巴士企划书.exe
Resource
win10v2004-20231025-en
Behavioral task
behavioral15
Sample
说明书.exe
Resource
win7-20231023-en
Behavioral task
behavioral16
Sample
说明书.exe
Resource
win10v2004-20231023-en
General
-
Target
HipsMain1.exe
-
Size
8.4MB
-
MD5
dc3b09a3b203597085bff5fba0c6fe3a
-
SHA1
1bad277e39b990c24820e2ef81ff0b7d4a80cfff
-
SHA256
bb14de223f20598b1aec67cdb3a06579ba74537251fb0a753ed40bac2063c2b5
-
SHA512
5b215002bed2774499c21a4c70661e6a5b4bc107f91a649c4820f6c473e76c548189221dc5f18dc97ef3eb3fe9f8d1e82585a419ea468a9e1bcbe4bf8f20778e
-
SSDEEP
196608:KUAcQ50mr2puHUHNT29onJ5hrZERw+ENFJzFcguwWA7gMjs:bAlKmr2pu0tT29c5hlERwRFJzFcgupAc
Malware Config
Signatures
-
Loads dropped DLL 19 IoCs
Processes:
HipsMain1.exepid process 2804 HipsMain1.exe 2804 HipsMain1.exe 2804 HipsMain1.exe 2804 HipsMain1.exe 2804 HipsMain1.exe 2804 HipsMain1.exe 2804 HipsMain1.exe 2804 HipsMain1.exe 2804 HipsMain1.exe 2804 HipsMain1.exe 2804 HipsMain1.exe 2804 HipsMain1.exe 2804 HipsMain1.exe 2804 HipsMain1.exe 2804 HipsMain1.exe 2804 HipsMain1.exe 2804 HipsMain1.exe 2804 HipsMain1.exe 2804 HipsMain1.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
HipsMain1.exedescription pid process target process PID 2148 wrote to memory of 2804 2148 HipsMain1.exe HipsMain1.exe PID 2148 wrote to memory of 2804 2148 HipsMain1.exe HipsMain1.exe PID 2148 wrote to memory of 2804 2148 HipsMain1.exe HipsMain1.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
99KB
MD518571d6663b7d9ac95f2821c203e471f
SHA13c186018df04e875d6b9f83521028a21f145e3be
SHA2560b040a314c19ff88f38fd9c89dca2d493113a6109adb8525733c3f6627da888f
SHA512c8cbca1072b8cb04f9d82135c91ff6d7a539cb7a488671cecb6b5e2f11a4807f47ad9af5a87ebee44984ab71d7c44fc87850f9d04fd2c5019ec1b6a1b483ca21
-
Filesize
84KB
MD5fc0d862a854993e0e51c00dee3eec777
SHA120203332c6f7bd51f6a5acbbc9f677c930d0669d
SHA256e5de23dbac7ece02566e79b3d1923a8eeae628925c7fb4b98a443cad94a06863
SHA512b3c2ade15cc196e687e83dd8d21ce88b83c8137a83cfc20bc8f2c8f3ab72643ef7ca08e1dc23de0695f508ba0080871956303ac30f92ab865f3e4249d4d65c2f
-
Filesize
177KB
MD577b5d28b725596b08d4393786d98bd27
SHA1e3f00478de1d28bc7d2e9f0b552778be3e32d43b
SHA256f7a00ba343d6f1ea8997d95b242fbbd70856ec2b98677d5f8b52921b8658369c
SHA512d44415d425f7423c3d68df22b72687a2d0da52966952e20d215553aa83de1e7a5192ec918a3d570d6c2362eb5500b56b87e3ffbc0b768bfa064585aea2a30e9d
-
Filesize
123KB
MD58adb1345c717e575e6614e163eb62328
SHA1f1ee3fff6e06dc4f22a5eb38c09c54580880e0a3
SHA25665edc348db42347570578b979151b787ceebfc98e0372c28116cc229494a78a8
SHA5120f11673854327fd2fcd12838f54c080edc4d40e4bcb50c413fe3f823056d189636dc661ea79207163f966719bf0815e1ffa75e2fb676df4e56ed6321f1ff6cae
-
Filesize
45KB
MD55fa7c9d5e6068718c6010bbeb18fbeb3
SHA193e8875d6d0f943b4226e25452c2c7d63d22b790
SHA2562e98f91087f56dfdffbbdd951cd55cd7ea771cec93d59cadb86b964ed8708155
SHA5123104aa8b785740dc6a5261c27b2bdc6e14b2f37862fa0fba151b1bc1bfc0e5fb5b6934b95488fa47c5af3fc2b2283f333ff6517b6f8cf0437c52cf171da58bf5
-
Filesize
158KB
MD560e215bb78fb9a40352980f4de818814
SHA1ff750858c3352081514e2ae0d200f3b8c3d40096
SHA256c4d00582dee45841747b07b91a3e46e55af79e6518ec9f0ce59b989c0acd2806
SHA512398a441de98963873417da6352413d080620faf2ae4b99425d7c9eaf96d5f2fdf1358e21f16870bdff514452115266a58ee3c6783611f037957bfa4bcec34230
-
Filesize
27KB
MD51fc2c6b80936efc502bfc30fc24caa56
SHA14e5b26ff3b225906c2b9e39e0f06126cfc43a257
SHA2569c47a3b84012837c60b7feced86ed0a4f12910a85fd259a4483a48cd940e3514
SHA512d07655d78aca969ccc0d7cedf9e337c7b20082d80be1d90d69c42be933fbab1c828316d2eb5461ded2ff35e52762e249fc0c2bccbc2b8436488fb6a270d3d9ee
-
Filesize
77KB
MD51d53841bb21acdcc8742828c3aded891
SHA1cdf15d4815820571684c1f720d0cba24129e79c8
SHA256ab13258c6da2c26c4dca7239ff4360ca9166ea8f53bb8cc08d2c7476cab7d61b
SHA5120266bcbcd7ca5f6c9df8dbeea00e1275932dacc38e5dd83a47bfbb87f7ca6778458a6671d8b84a63ae9216a65975da656ba487ac28d41140122f46d0174fa9f9
-
Filesize
150KB
MD584dea8d0acce4a707b094a3627b62eab
SHA1d45dda99466ab08cc922e828729d0840ae2ddc18
SHA256dcf6b3ff84b55c3859d0f176c4ce6904c0d7d4643a657b817c6322933dbf82f6
SHA512fdaa7eb10f8bf7b42a5c9691f600eff48190041a8b28a5dab977170db717fff58dd0f64b02ca30d274552ff30ee02a6577f1465792cf6760366c2588bf373108
-
Filesize
822KB
MD5bcc06d24c2c806a06e861d9020e65b30
SHA19d4d40a8e1de6fc9d4a092585523331882e370ec
SHA256a0fccbe44e5b9d3aabd6e955c2ecb5ff52492c469ebed61ea3cad5ec5642aa5d
SHA5123ec910b810fdd20d9d3527f80b1cd624e2a6336f49c9b0ea7bd3e0771329d740406e9c0dbb6ffb40cdd21cd2df40cb982ad8269e2912155865bf855e6ab971e4
-
Filesize
10KB
MD5e0c4121e0fc50b3652aae460481b52e3
SHA15ebe95c90c04211997eb4ccba10eb56d7a17433d
SHA256f3302b2617204bc8538b4c999b7fafb7eb34a372483560d4bbfa434c2a4bd99c
SHA5121c82cf0204510ab78bec946967a62527ace8813692def6f24af119a5c6efcc2f44caf77f1e68a0c8de6e97713549007adbd08b9009a8ff9e54251d0a59b1e502
-
Filesize
110KB
MD51807ef817f24adb68e5e638c5baf50f5
SHA19ac81da9f7a5cd2399233c9e8b4cc87b35b40efe
SHA256295e18f7870107b1522ddbbab1d9e695408e15c28104014fc58973c8d1bf8101
SHA5129bc2cb8603e8a50647d615518b507ea495abf03945a6098ab0177a6c0c6036216d8ad91eb961dd5b799f46f0f1e325c72a67cce7aee5ca5a25e562c0bdff2f50
-
Filesize
6.3MB
MD50617be8f80712bfecc5b6551b0611c54
SHA18211673695be21afb30abde8f63e6321b4e2a492
SHA256dcb9980557fd18e59a075758236da0d3fcd445fae2ef990e670cc5da1a67fc73
SHA5122343786e5d40771d688fe5582dca2240b8821c957f51eb7cfb63a679bd5d71a126fee2bcd5e91feb205117a49220610daf302c95e245c34a0a8c6e061262c31a
-
Filesize
3.2MB
MD5cc4cbf715966cdcad95a1e6c95592b3d
SHA1d5873fea9c084bcc753d1c93b2d0716257bea7c3
SHA256594303e2ce6a4a02439054c84592791bf4ab0b7c12e9bbdb4b040e27251521f1
SHA5123b5af9fbbc915d172648c2b0b513b5d2151f940ccf54c23148cd303e6660395f180981b148202bef76f5209acc53b8953b1cb067546f90389a6aa300c1fbe477
-
Filesize
32KB
MD5eef7981412be8ea459064d3090f4b3aa
SHA1c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA256f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
SHA512dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016
-
Filesize
673KB
MD5bc778f33480148efa5d62b2ec85aaa7d
SHA1b1ec87cbd8bc4398c6ebb26549961c8aab53d855
SHA2569d4cf1c03629f92662fc8d7e3f1094a7fc93cb41634994464b853df8036af843
SHA51280c1dd9d0179e6cc5f33eb62d05576a350af78b5170bfdf2ecda16f1d8c3c2d0e991a5534a113361ae62079fb165fff2344efd1b43031f1a7bfda696552ee173
-
Filesize
57KB
MD59779c701be8e17867d1d92d470607948
SHA16aae834541ccc73d1c87c9f1a12df4ac0cf9001f
SHA25659e6421802d30326c1704f15acc2b2888097241e291aba4860d1e1fc3d26d4bf
SHA5124e34bcdd2093347d2b4e5c0f8c25f5d36d54097283faf5b2be1c75d717f716d459a45336647d3360457f25417952e62f8f21f5a720204fe5b894d5513e43e782
-
Filesize
4.0MB
MD51f2688b97f9827f1de7dfedb4ad2348c
SHA1a9650970d38e30835336426f704579e87fcfc892
SHA256169eeb1bdf99ed93ca26453d5ca49339e5ae092662cd94cde09fbb10046f83fc
SHA51227e56b2d73226e36b0c473d8eb646813997cbdf955397d0b61fcae37ed1f2c3715e589f9a07d909a967009ed2c664d14007ccf37d83a7df7ce2a0fefca615503
-
Filesize
26KB
MD5a2ab334e18222738dcb05bf820725938
SHA12f75455a471f95ac814b8e4560a023034480b7b5
SHA2567ba95624370216795ea4a087c326422cfcbccc42b5ada21f4d85c532c71afad7
SHA51272e891d1c7e5ea44a569283b5c8bd8c310f2ee3d3cc9c25c6a7d7d77a62cb301c822c833b0792c3163cf0b0d6272da2f667e6bc74b07ed7946082433f77d9679
-
Filesize
1.0MB
MD5549c9eeda8546cd32d0713c723abd12a
SHA1f84b2c529cff58b888cc99f566fcd2eba6ff2b8e
SHA2565d5e733397ef7c4946cf26c84b07312cb12eaf339374613d4381e694ef38169b
SHA5129432daf045bac3e322b1797f49afe50f76faf8b7d8db063a1d56578016c813881af3324e2529032a8644a04b58ccc9d2c363bf92b56115f06b9eefebfab08180
-
Filesize
99KB
MD518571d6663b7d9ac95f2821c203e471f
SHA13c186018df04e875d6b9f83521028a21f145e3be
SHA2560b040a314c19ff88f38fd9c89dca2d493113a6109adb8525733c3f6627da888f
SHA512c8cbca1072b8cb04f9d82135c91ff6d7a539cb7a488671cecb6b5e2f11a4807f47ad9af5a87ebee44984ab71d7c44fc87850f9d04fd2c5019ec1b6a1b483ca21
-
Filesize
84KB
MD5fc0d862a854993e0e51c00dee3eec777
SHA120203332c6f7bd51f6a5acbbc9f677c930d0669d
SHA256e5de23dbac7ece02566e79b3d1923a8eeae628925c7fb4b98a443cad94a06863
SHA512b3c2ade15cc196e687e83dd8d21ce88b83c8137a83cfc20bc8f2c8f3ab72643ef7ca08e1dc23de0695f508ba0080871956303ac30f92ab865f3e4249d4d65c2f
-
Filesize
177KB
MD577b5d28b725596b08d4393786d98bd27
SHA1e3f00478de1d28bc7d2e9f0b552778be3e32d43b
SHA256f7a00ba343d6f1ea8997d95b242fbbd70856ec2b98677d5f8b52921b8658369c
SHA512d44415d425f7423c3d68df22b72687a2d0da52966952e20d215553aa83de1e7a5192ec918a3d570d6c2362eb5500b56b87e3ffbc0b768bfa064585aea2a30e9d
-
Filesize
123KB
MD58adb1345c717e575e6614e163eb62328
SHA1f1ee3fff6e06dc4f22a5eb38c09c54580880e0a3
SHA25665edc348db42347570578b979151b787ceebfc98e0372c28116cc229494a78a8
SHA5120f11673854327fd2fcd12838f54c080edc4d40e4bcb50c413fe3f823056d189636dc661ea79207163f966719bf0815e1ffa75e2fb676df4e56ed6321f1ff6cae
-
Filesize
45KB
MD55fa7c9d5e6068718c6010bbeb18fbeb3
SHA193e8875d6d0f943b4226e25452c2c7d63d22b790
SHA2562e98f91087f56dfdffbbdd951cd55cd7ea771cec93d59cadb86b964ed8708155
SHA5123104aa8b785740dc6a5261c27b2bdc6e14b2f37862fa0fba151b1bc1bfc0e5fb5b6934b95488fa47c5af3fc2b2283f333ff6517b6f8cf0437c52cf171da58bf5
-
Filesize
158KB
MD560e215bb78fb9a40352980f4de818814
SHA1ff750858c3352081514e2ae0d200f3b8c3d40096
SHA256c4d00582dee45841747b07b91a3e46e55af79e6518ec9f0ce59b989c0acd2806
SHA512398a441de98963873417da6352413d080620faf2ae4b99425d7c9eaf96d5f2fdf1358e21f16870bdff514452115266a58ee3c6783611f037957bfa4bcec34230
-
Filesize
27KB
MD51fc2c6b80936efc502bfc30fc24caa56
SHA14e5b26ff3b225906c2b9e39e0f06126cfc43a257
SHA2569c47a3b84012837c60b7feced86ed0a4f12910a85fd259a4483a48cd940e3514
SHA512d07655d78aca969ccc0d7cedf9e337c7b20082d80be1d90d69c42be933fbab1c828316d2eb5461ded2ff35e52762e249fc0c2bccbc2b8436488fb6a270d3d9ee
-
Filesize
77KB
MD51d53841bb21acdcc8742828c3aded891
SHA1cdf15d4815820571684c1f720d0cba24129e79c8
SHA256ab13258c6da2c26c4dca7239ff4360ca9166ea8f53bb8cc08d2c7476cab7d61b
SHA5120266bcbcd7ca5f6c9df8dbeea00e1275932dacc38e5dd83a47bfbb87f7ca6778458a6671d8b84a63ae9216a65975da656ba487ac28d41140122f46d0174fa9f9
-
Filesize
150KB
MD584dea8d0acce4a707b094a3627b62eab
SHA1d45dda99466ab08cc922e828729d0840ae2ddc18
SHA256dcf6b3ff84b55c3859d0f176c4ce6904c0d7d4643a657b817c6322933dbf82f6
SHA512fdaa7eb10f8bf7b42a5c9691f600eff48190041a8b28a5dab977170db717fff58dd0f64b02ca30d274552ff30ee02a6577f1465792cf6760366c2588bf373108
-
Filesize
10KB
MD5e0c4121e0fc50b3652aae460481b52e3
SHA15ebe95c90c04211997eb4ccba10eb56d7a17433d
SHA256f3302b2617204bc8538b4c999b7fafb7eb34a372483560d4bbfa434c2a4bd99c
SHA5121c82cf0204510ab78bec946967a62527ace8813692def6f24af119a5c6efcc2f44caf77f1e68a0c8de6e97713549007adbd08b9009a8ff9e54251d0a59b1e502
-
Filesize
110KB
MD51807ef817f24adb68e5e638c5baf50f5
SHA19ac81da9f7a5cd2399233c9e8b4cc87b35b40efe
SHA256295e18f7870107b1522ddbbab1d9e695408e15c28104014fc58973c8d1bf8101
SHA5129bc2cb8603e8a50647d615518b507ea495abf03945a6098ab0177a6c0c6036216d8ad91eb961dd5b799f46f0f1e325c72a67cce7aee5ca5a25e562c0bdff2f50
-
Filesize
6.3MB
MD50617be8f80712bfecc5b6551b0611c54
SHA18211673695be21afb30abde8f63e6321b4e2a492
SHA256dcb9980557fd18e59a075758236da0d3fcd445fae2ef990e670cc5da1a67fc73
SHA5122343786e5d40771d688fe5582dca2240b8821c957f51eb7cfb63a679bd5d71a126fee2bcd5e91feb205117a49220610daf302c95e245c34a0a8c6e061262c31a
-
Filesize
3.2MB
MD5cc4cbf715966cdcad95a1e6c95592b3d
SHA1d5873fea9c084bcc753d1c93b2d0716257bea7c3
SHA256594303e2ce6a4a02439054c84592791bf4ab0b7c12e9bbdb4b040e27251521f1
SHA5123b5af9fbbc915d172648c2b0b513b5d2151f940ccf54c23148cd303e6660395f180981b148202bef76f5209acc53b8953b1cb067546f90389a6aa300c1fbe477
-
Filesize
32KB
MD5eef7981412be8ea459064d3090f4b3aa
SHA1c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA256f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
SHA512dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016
-
Filesize
673KB
MD5bc778f33480148efa5d62b2ec85aaa7d
SHA1b1ec87cbd8bc4398c6ebb26549961c8aab53d855
SHA2569d4cf1c03629f92662fc8d7e3f1094a7fc93cb41634994464b853df8036af843
SHA51280c1dd9d0179e6cc5f33eb62d05576a350af78b5170bfdf2ecda16f1d8c3c2d0e991a5534a113361ae62079fb165fff2344efd1b43031f1a7bfda696552ee173
-
Filesize
57KB
MD59779c701be8e17867d1d92d470607948
SHA16aae834541ccc73d1c87c9f1a12df4ac0cf9001f
SHA25659e6421802d30326c1704f15acc2b2888097241e291aba4860d1e1fc3d26d4bf
SHA5124e34bcdd2093347d2b4e5c0f8c25f5d36d54097283faf5b2be1c75d717f716d459a45336647d3360457f25417952e62f8f21f5a720204fe5b894d5513e43e782
-
Filesize
4.0MB
MD51f2688b97f9827f1de7dfedb4ad2348c
SHA1a9650970d38e30835336426f704579e87fcfc892
SHA256169eeb1bdf99ed93ca26453d5ca49339e5ae092662cd94cde09fbb10046f83fc
SHA51227e56b2d73226e36b0c473d8eb646813997cbdf955397d0b61fcae37ed1f2c3715e589f9a07d909a967009ed2c664d14007ccf37d83a7df7ce2a0fefca615503
-
Filesize
26KB
MD5a2ab334e18222738dcb05bf820725938
SHA12f75455a471f95ac814b8e4560a023034480b7b5
SHA2567ba95624370216795ea4a087c326422cfcbccc42b5ada21f4d85c532c71afad7
SHA51272e891d1c7e5ea44a569283b5c8bd8c310f2ee3d3cc9c25c6a7d7d77a62cb301c822c833b0792c3163cf0b0d6272da2f667e6bc74b07ed7946082433f77d9679
-
Filesize
1.0MB
MD5549c9eeda8546cd32d0713c723abd12a
SHA1f84b2c529cff58b888cc99f566fcd2eba6ff2b8e
SHA2565d5e733397ef7c4946cf26c84b07312cb12eaf339374613d4381e694ef38169b
SHA5129432daf045bac3e322b1797f49afe50f76faf8b7d8db063a1d56578016c813881af3324e2529032a8644a04b58ccc9d2c363bf92b56115f06b9eefebfab08180