Overview
overview
7Static
static
3bin/NIKYME...au.dll
windows7-x64
1bin/NIKYME...au.dll
windows10-2004-x64
1bin/save.js
windows7-x64
3bin/save.js
windows10-2004-x64
3hyperion.exe
windows7-x64
7hyperion.exe
windows10-2004-x64
7scripts/UNC TEST.js
windows7-x64
3scripts/UNC TEST.js
windows10-2004-x64
3workspace/...che.js
windows7-x64
3workspace/...che.js
windows10-2004-x64
3Analysis
-
max time kernel
15s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
08/08/2024, 22:48
Static task
static1
Behavioral task
behavioral1
Sample
bin/NIKYMETAA-luau.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
bin/NIKYMETAA-luau.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
bin/save.js
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
bin/save.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
hyperion.exe
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
hyperion.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
scripts/UNC TEST.js
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
scripts/UNC TEST.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
workspace/f42f3746fb3eb60f837d3673581c14a5-cache.js
Resource
win7-20240729-en
Behavioral task
behavioral10
Sample
workspace/f42f3746fb3eb60f837d3673581c14a5-cache.js
Resource
win10v2004-20240802-en
General
-
Target
hyperion.exe
-
Size
58.4MB
-
MD5
0ec4d20dccaa0aed06a491a4c9c1636d
-
SHA1
b7aeed9a004193b472fc82296cd0d7f121978433
-
SHA256
2cffa447570221c478089472e676991105bf71154549b40608eeac113f890515
-
SHA512
81c77adc25ff0b01c039f2dfc35d38d169281db8892eb6c5b1123b4ea1b94f3eb080dffcd846c7a0ddff0512a58b594b5d583f89eadd5d9d91c7f3b478a6ce17
-
SSDEEP
1572864:uvEb9dLgxquRke+EJYPLnB3e4tBwzBtJ1srDVSmCo:uMbgxzupnB3eCBw1T1s/cx
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2380 main.exe -
Loads dropped DLL 2 IoCs
pid Process 1496 hyperion.exe 2380 main.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1496 wrote to memory of 2380 1496 hyperion.exe 31 PID 1496 wrote to memory of 2380 1496 hyperion.exe 31 PID 1496 wrote to memory of 2380 1496 hyperion.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\hyperion.exe"C:\Users\Admin\AppData\Local\Temp\hyperion.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\onefile_1496_133676309358368000\main.exeC:\Users\Admin\AppData\Local\Temp\hyperion.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2380
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.3MB
MD563a1fa9259a35eaeac04174cecb90048
SHA10dc0c91bcd6f69b80dcdd7e4020365dd7853885a
SHA25614b06796f288bc6599e458fb23a944ab0c843e9868058f02a91d4606533505ed
SHA512896caa053f48b1e4102e0f41a7d13d932a746eea69a894ae564ef5a84ef50890514deca6496e915aae40a500955220dbc1b1016fe0b8bcdde0ad81b2917dea8b