171bd35e1e4211a26484cbd33f3dc370db67357c827d233959ed82cfd7a315fa

Analysis

max time kernel
43s
max time network
54s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
16-04-2024 00:03

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

hellz.exe
Size

307.0MB
MD5

999c0e4a99d73ce8b10acecb6e61e51b
SHA1

7321225ea44ca74fe97692117ff76a9754850b28
SHA256

171bd35e1e4211a26484cbd33f3dc370db67357c827d233959ed82cfd7a315fa
SHA512

0dc0ea9db04deb375797d4870ea9d8a1b0673a4e49ed2cf1035185f096f1e069bda24e0cbcaa50a77be609b7050bbf1ceed45d7f0e54f45e13fda2e3022e0413
SSDEEP

98304:XXGhy2X6iL/Q2vkYFPK6me1/QPN1bnXK1pBvmAZDyw+3wcbFM3/wxCCzt3+EkZA:GYg6ivcYY6meObbnXCBvmAZmw+oG3O9

Score

10^/10

agilenet evasion persistence themida trojan

Malware Config

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Processes:

resource	yara_rule
behavioral1/memory/2424-117-0x000000001C200000-0x000000001C20E000-memory.dmp	disable_win_def

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

hellz.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ hellz.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	hellz.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

hellz.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	hellz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	hellz.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

hellz.exehellz.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	hellz.exe
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	hellz.exe

Drops startup file 2 IoCs

Processes:

hellz.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	hellz.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	hellz.exe

Executes dropped EXE 1 IoCs

Processes:

hellz.exe

pid process

2424 hellz.exe
Loads dropped DLL 1 IoCs

Processes:

hellz.exe

pid process

2424 hellz.exe

pid	process
2424	hellz.exe

pid	process
2424	hellz.exe

Obfuscated with Agile.Net obfuscator 2 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
C:\Windows\hellz.exe	agile_net
behavioral1/memory/2424-31-0x0000000000ED0000-0x00000000015D6000-memory.dmp	agile_net

Themida packer 7 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\1bdd127f-c499-4809-bf4c-63d6bfee1837\AgileDotNetRT64.dll	themida
behavioral1/memory/2424-39-0x00007FFD80F50000-0x00007FFD81AD4000-memory.dmp	themida
behavioral1/memory/2424-42-0x00007FFD80F50000-0x00007FFD81AD4000-memory.dmp	themida
behavioral1/memory/2424-112-0x00007FFD80F50000-0x00007FFD81AD4000-memory.dmp	themida
behavioral1/memory/2424-113-0x00007FFD80F50000-0x00007FFD81AD4000-memory.dmp	themida
behavioral1/memory/2424-115-0x00007FFD80F50000-0x00007FFD81AD4000-memory.dmp	themida
behavioral1/memory/2424-116-0x00007FFD80F50000-0x00007FFD81AD4000-memory.dmp	themida

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

hellz.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe"	hellz.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

hellz.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA hellz.exe
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

23 ip-api.com
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

hellz.exe

pid process

2424 hellz.exe
Drops file in Windows directory 2 IoCs

Processes:

hellz.exe

description ioc process

File created C:\Windows\hellz.exe hellz.exe
File opened for modification C:\Windows\hellz.exe hellz.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

776 timeout.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	hellz.exe

flow	ioc
23	ip-api.com

pid	process
2424	hellz.exe

description	ioc	process
File created	C:\Windows\hellz.exe	hellz.exe
File opened for modification	C:\Windows\hellz.exe	hellz.exe

pid	process
776	timeout.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exehellz.exe

pid	process
1076	powershell.exe
1076	powershell.exe
1196	powershell.exe
1196	powershell.exe
1160	powershell.exe
1160	powershell.exe
3128	powershell.exe
3128	powershell.exe
2624	powershell.exe
2624	powershell.exe
2424	hellz.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

hellz.exepowershell.exehellz.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	4960	hellz.exe
Token: SeDebugPrivilege	1076	powershell.exe
Token: SeDebugPrivilege	2424	hellz.exe
Token: SeDebugPrivilege	1196	powershell.exe
Token: SeDebugPrivilege	1160	powershell.exe
Token: SeDebugPrivilege	3128	powershell.exe
Token: SeDebugPrivilege	2624	powershell.exe
Token: SeShutdownPrivilege	2424	hellz.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

hellz.exe

pid process

2424 hellz.exe

pid	process
2424	hellz.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

hellz.execmd.exehellz.exe

description	pid	process	target process
PID 4960 wrote to memory of 1076	4960	hellz.exe	powershell.exe
PID 4960 wrote to memory of 1076	4960	hellz.exe	powershell.exe
PID 4960 wrote to memory of 2424	4960	hellz.exe	hellz.exe
PID 4960 wrote to memory of 2424	4960	hellz.exe	hellz.exe
PID 4960 wrote to memory of 3100	4960	hellz.exe	cmd.exe
PID 4960 wrote to memory of 3100	4960	hellz.exe	cmd.exe
PID 3100 wrote to memory of 776	3100	cmd.exe	timeout.exe
PID 3100 wrote to memory of 776	3100	cmd.exe	timeout.exe
PID 2424 wrote to memory of 1196	2424	hellz.exe	powershell.exe
PID 2424 wrote to memory of 1196	2424	hellz.exe	powershell.exe
PID 2424 wrote to memory of 1160	2424	hellz.exe	powershell.exe
PID 2424 wrote to memory of 1160	2424	hellz.exe	powershell.exe
PID 2424 wrote to memory of 3128	2424	hellz.exe	powershell.exe
PID 2424 wrote to memory of 3128	2424	hellz.exe	powershell.exe
PID 2424 wrote to memory of 2624	2424	hellz.exe	powershell.exe
PID 2424 wrote to memory of 2624	2424	hellz.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\hellz.exe
"C:\Users\Admin\AppData\Local\Temp\hellz.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4960

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\hellz.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1076

C:\Windows\hellz.exe
"C:\Windows\hellz.exe"
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2424

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\hellz.exe'
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1196

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'hellz.exe'
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1160

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svchost.exe'
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3128

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2624

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp7A50.tmp.bat""
2⤵
- Suspicious use of WriteProcessMemory
PID:3100

C:\Windows\system32\timeout.exe
timeout 3
3⤵
- Delays execution with timeout.exe
PID:776

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
c28937317ffaecb0023533dc0069808d

SHA1
9f5175aeaf73db5ab967b57bd896a982a9c6e906

SHA256
f6cb138382b9333938304b47ca2fcab5d9fa5c3fa63665020872c49a5d7bd7a9

SHA512
2de2e86570c35021f4fecd1e9fec285d410d8e36fce3ef4d782ff8c7d43242f10de123dac7e1c0609c27f33e6b88c46d83bc47948ca0b0329ca0ba70a5105ce4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
6d3e9c29fe44e90aae6ed30ccf799ca8

SHA1
c7974ef72264bbdf13a2793ccf1aed11bc565dce

SHA256
2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

SHA512
60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
22310ad6749d8cc38284aa616efcd100

SHA1
440ef4a0a53bfa7c83fe84326a1dff4326dcb515

SHA256
55b1d8021c4eb4c3c0d75e3ed7a4eb30cd0123e3d69f32eeb596fe4ffec05abf

SHA512
2ef08e2ee15bb86695fe0c10533014ffed76ececc6e579d299d3365fafb7627f53e32e600bb6d872b9f58aca94f8cb7e1e94cdfd14777527f7f0aa019d9c6def

Download Submit
C:\Users\Admin\AppData\Local\Temp\1bdd127f-c499-4809-bf4c-63d6bfee1837\AgileDotNetRT64.dll
Filesize
4.2MB

MD5
05b012457488a95a05d0541e0470d392

SHA1
74f541d6a8365508c794ef7b4ac7c297457f9ce3

SHA256
1f77a0749ac730500f203b8c4d072587923ac679e184a3859aeb855c2a2e7d8d

SHA512
6d6e7b838d4425d49ac8d3738135374ef5357f0677b07cecb7afbf5feddc1997bf6dce68d48787eff8a74c4728def8880c8f01842eda35b5815fb561fa401ae6

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xhh1a1wr.jpo.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp7A50.tmp.bat
Filesize
157B

MD5
ec4df16f931017bd4671abb77ecd4bde

SHA1
5207ca4b1abda19f7ea84dde0c900418a33bda7d

SHA256
0ce661dc025373ca03825add48d7559ac8e1e964963dbc59217683eaf652334d

SHA512
dcb46624b6d62a52c1e09130c20322711191a8eed7b655b56775c86a006a7c2adf8209bf63ec47f7e85183afb12ca6b092c957bd47c97e536c5dda56bd12fb2a

Download Submit
C:\Windows\hellz.exe
Filesize
7.0MB

MD5
013fc4d4f9cd4a48faa6d6cbccb01415

SHA1
102225f92f989df2474537723a2795554d26a4ca

SHA256
fb6906b2590d8ae2dc5d625055f8820551bad8baa3f52fc383be401fd8e8c5dd

SHA512
77360f28b0bc571a1e91edd46157c06662ad72b50e47228eed7757f0e51e5ef953e4b827e6af944ee2c2a6eacdef51d9d63f4e8d786731fbda6f6865e568c0f1

Download Submit
memory/1076-14-0x0000014FD0C70000-0x0000014FD0C80000-memory.dmp

Filesize
64KB

Download
memory/1076-13-0x00007FFD868C0000-0x00007FFD87381000-memory.dmp

Filesize
10.8MB

Download
memory/1076-18-0x00007FFD868C0000-0x00007FFD87381000-memory.dmp

Filesize
10.8MB

Download
memory/1076-15-0x0000014FD0C70000-0x0000014FD0C80000-memory.dmp

Filesize
64KB

Download
memory/1076-3-0x0000014FD0D80000-0x0000014FD0DA2000-memory.dmp

Filesize
136KB

Download
memory/1160-74-0x00007FFD868C0000-0x00007FFD87381000-memory.dmp

Filesize
10.8MB

Download
memory/1160-76-0x00007FFD868C0000-0x00007FFD87381000-memory.dmp

Filesize
10.8MB

Download
memory/1196-63-0x00007FFD868C0000-0x00007FFD87381000-memory.dmp

Filesize
10.8MB

Download
memory/1196-60-0x00007FFD868C0000-0x00007FFD87381000-memory.dmp

Filesize
10.8MB

Download
memory/1196-61-0x0000019AE0980000-0x0000019AE0990000-memory.dmp

Filesize
64KB

Download
memory/2424-32-0x00007FFD868C0000-0x00007FFD87381000-memory.dmp

Filesize
10.8MB

Download
memory/2424-111-0x00007FFD868C0000-0x00007FFD87381000-memory.dmp

Filesize
10.8MB

Download
memory/2424-43-0x00007FFD850B0000-0x00007FFD851FE000-memory.dmp

Filesize
1.3MB

Download
memory/2424-42-0x00007FFD80F50000-0x00007FFD81AD4000-memory.dmp

Filesize
11.5MB

Download
memory/2424-40-0x00007FFDA5430000-0x00007FFDA5625000-memory.dmp

Filesize
2.0MB

Download
memory/2424-39-0x00007FFD80F50000-0x00007FFD81AD4000-memory.dmp

Filesize
11.5MB

Download
memory/2424-31-0x0000000000ED0000-0x00000000015D6000-memory.dmp

Filesize
7.0MB

Download
memory/2424-117-0x000000001C200000-0x000000001C20E000-memory.dmp

Filesize
56KB

Download
memory/2424-116-0x00007FFD80F50000-0x00007FFD81AD4000-memory.dmp

Filesize
11.5MB

Download
memory/2424-115-0x00007FFD80F50000-0x00007FFD81AD4000-memory.dmp

Filesize
11.5MB

Download
memory/2424-114-0x00007FFDA5430000-0x00007FFDA5625000-memory.dmp

Filesize
2.0MB

Download
memory/2424-113-0x00007FFD80F50000-0x00007FFD81AD4000-memory.dmp

Filesize
11.5MB

Download
memory/2424-112-0x00007FFD80F50000-0x00007FFD81AD4000-memory.dmp

Filesize
11.5MB

Download
memory/2624-102-0x00007FFD868C0000-0x00007FFD87381000-memory.dmp

Filesize
10.8MB

Download
memory/2624-104-0x000002C5716C0000-0x000002C5716D0000-memory.dmp

Filesize
64KB

Download
memory/2624-103-0x000002C5716C0000-0x000002C5716D0000-memory.dmp

Filesize
64KB

Download
memory/2624-106-0x00007FFD868C0000-0x00007FFD87381000-memory.dmp

Filesize
10.8MB

Download
memory/3128-91-0x00007FFD868C0000-0x00007FFD87381000-memory.dmp

Filesize
10.8MB

Download
memory/3128-87-0x00000222470F0000-0x0000022247100000-memory.dmp

Filesize
64KB

Download
memory/3128-88-0x00000222470F0000-0x0000022247100000-memory.dmp

Filesize
64KB

Download
memory/3128-82-0x00007FFD868C0000-0x00007FFD87381000-memory.dmp

Filesize
10.8MB

Download
memory/4960-0-0x00000000001C0000-0x00000000008BE000-memory.dmp

Filesize
7.0MB

Download
memory/4960-48-0x00007FFD868C0000-0x00007FFD87381000-memory.dmp

Filesize
10.8MB

Download
memory/4960-2-0x000000001B560000-0x000000001B570000-memory.dmp

Filesize
64KB

Download
memory/4960-1-0x00007FFD868C0000-0x00007FFD87381000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads