Analysis
-
max time kernel
141s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
12/07/2024, 07:21
Static task
static1
Behavioral task
behavioral1
Sample
helium_2.0.0.4601_setup.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
helium_2.0.0.4601_setup.exe
Resource
win10v2004-20240709-en
General
-
Target
helium_2.0.0.4601_setup.exe
-
Size
6.2MB
-
MD5
44f4d3858310c16153777eee8610de1a
-
SHA1
dcb3db338d4d2da9b7168f66ab46fd823e3a7588
-
SHA256
c294d45d5993a69f3d61b515d4a59bacf45753b09b7892d59bda902d898c3f5e
-
SHA512
e1f93eeaa6c03c65855998aae9e1f972f45ada6e24ad7df7f95beb8bcdce34cb8d24be9101a583c52c0c4d63bd2865f5b11972a2d17094653cd7f7030ef2fad6
-
SSDEEP
98304:dX1JilLar0QJZvg5BSlnoe/MakVrVNn40t9kZaxwOiEWQpyA:ZILY0YljocMXBp9kk9iEtyA
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4592 is-844MF.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 624 wrote to memory of 4592 624 helium_2.0.0.4601_setup.exe 85 PID 624 wrote to memory of 4592 624 helium_2.0.0.4601_setup.exe 85 PID 624 wrote to memory of 4592 624 helium_2.0.0.4601_setup.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\helium_2.0.0.4601_setup.exe"C:\Users\Admin\AppData\Local\Temp\helium_2.0.0.4601_setup.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Users\Admin\AppData\Local\Temp\is-43UN0.tmp\is-844MF.tmp"C:\Users\Admin\AppData\Local\Temp\is-43UN0.tmp\is-844MF.tmp" /SL4 $60062 C:\Users\Admin\AppData\Local\Temp\helium_2.0.0.4601_setup.exe 6211824 711682⤵
- Executes dropped EXE
PID:4592
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
592KB
MD538e57692dc759034d88733a74010c102
SHA13dd1786d1bd2415ea56185a5dc755ef808265f13
SHA256c9b6429a22f9c977fbb84a5afd47cfe657eead7f6ce246f7e4df087ed25af794
SHA5123bafa5fad0186db7e2a71de02d988515617fd72422e8129432d678ff6d20c0ee9beda32b25bc58ccb87de36267e5e7119b7a6ada33ec494b2145dd639f9dcd99