Overview

overview

8

Static

static

1

Hiddify-Wi...64.exe

windows7-x64

8

Hiddify-Wi...64.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    95s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/11/2024, 01:45

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Hiddify-Windows-Setup-x64.exe
  • Size 26.8MB
  • Sample241114-b6jdhasjdv
  • SHA256 09e2cc9f7ca2a9521c7a3709ad4e652bb75630ff8fed76011a4f25e00769ca33
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
discoveryevasionexecution

Malware Config

Signatures

  • Stops running service(s) 4 TTPs
    evasionexecution
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 19 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies registry class 24 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Hiddify-Windows-Setup-x64.exe
    "C:\Users\Admin\AppData\Local\Temp\Hiddify-Windows-Setup-x64.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1036
    • C:\Users\Admin\AppData\Local\Temp\is-JV67H.tmp\Hiddify-Windows-Setup-x64.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-JV67H.tmp\Hiddify-Windows-Setup-x64.tmp" /SL5="$8005A,27140851,793600,C:\Users\Admin\AppData\Local\Temp\Hiddify-Windows-Setup-x64.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:5024
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill" /F /IM hiddify.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3448
      • C:\Windows\SYSTEM32\net.exe
        "net" stop "HiddifyTunnelService"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2340
        • C:\Windows\system32\net1.exe
          C:\Windows\system32\net1 stop "HiddifyTunnelService"
          4⤵
            PID:3084
        • C:\Windows\SYSTEM32\sc.exe
          "sc.exe" delete "HiddifyTunnelService"
          3⤵
          • Launches sc.exe
          PID:3520
        • C:\Program Files\Hiddify\Hiddify.exe
          "C:\Program Files\Hiddify\\Hiddify.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies registry class
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          PID:3100

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          Hiddify.exe
          • Path C:\Program Files\Hiddify\Hiddify.exe
          • Size 55KB
          • SHA256 e15e21ad120be0976cd6ade39862f798996366bfd226c3bead8df8d8b588a498
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          app.so
          • Path C:\Program Files\Hiddify\data\app.so
          • Size 12.1MB
          • SHA256 823475a5cfd7ccdf605752671e2f636215a64ff7ad7d11f408f5b0991a866e93
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          FontManifest.json
          • Path C:\Program Files\Hiddify\data\flutter_assets\FontManifest.json
          • Size 781B
          • SHA256 da8eea847f41a6d5f054d2c2a2c4c4e578a4c0047622f6e563488eb012e0a95f
          • MD5 SHA1 SHA512
          Submit Download

          NOTICES.Z
          • Path C:\Program Files\Hiddify\data\flutter_assets\NOTICES.Z
          • Size 106KB
          • SHA256 d2c00e582ceb0e7fffcb2609162cbf50aea76c5b7b5cfd1d4d6c655a65b2c685
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Emoji.ttf
          • Path C:\Program Files\Hiddify\data\flutter_assets\assets\fonts\Emoji.ttf
          • Size 742KB
          • SHA256 5518909b476eded6a4567288bf4709ee5a2a8e346b79f7082ae183ae19d2b879
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          logo.svg
          • Path C:\Program Files\Hiddify\data\flutter_assets\assets\images\logo.svg
          • Size 1KB
          • SHA256 b3a2962d667b08a984f8412211be20c751cdfe0a591b1f086c00a6a435f9f1fc
          • MD5 SHA1 SHA512
          Submit Download

          tray_icon_dark.ico
          • Path C:\Program Files\Hiddify\data\flutter_assets\assets\images\tray_icon_dark.ico
          • Size 40KB
          • SHA256 4c06e319a32e7134f7100e2a9bf98222ebca08e5e245440cd2a544aa6812a9bf
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          is-UVSVJ.tmp
          • Path C:\Program Files\Hiddify\data\flutter_assets\packages\circle_flags\assets\svg\is-UVSVJ.tmp
          • Size 510B
          • SHA256 5c8c1c7627d0464f30e112b0d509cee02341ac0748e0db968a857bd8ec5cf1fc
          • MD5 SHA1 SHA512
          Submit Download

          FluentSystemIcons-Regular.ttf
          • Path C:\Program Files\Hiddify\data\flutter_assets\packages\fluentui_system_icons\fonts\FluentSystemIcons-Regular.ttf
          • Size 2.2MB
          • SHA256 126dda2ad78eec59b00ce0a44d5c1f0ac57c10261674209880db015cd31ebcc3
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          icudtl.dat
          • Path C:\Program Files\Hiddify\data\icudtl.dat
          • Size 760KB
          • SHA256 c12537022ef818991a7bfed41a76d8d6ae962ffbc0e6511ac762a5d0845e7f7c
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          dynamic_color_plugin.dll
          • Path C:\Program Files\Hiddify\dynamic_color_plugin.dll
          • Size 70KB
          • SHA256 545c23d626b98f65a57cc07c9d7474ae80ec79b2cecc22d21c03a2b3cfaaf6e5
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          flutter_windows.dll
          • Path C:\Program Files\Hiddify\flutter_windows.dll
          • Size 17.3MB
          • SHA256 51bd933b887062ec6df08ff091feb57a7c8b40f2a8230e57891ddcc7d700b000
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msvcp140.dll
          • Path C:\Program Files\Hiddify\msvcp140.dll
          • Size 576KB
          • SHA256 08db4c39137815733db3adfc62e0a437798d7a5ec9eb40eecc638009e7189e5a
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          protocol_handler_windows_plugin.dll
          • Path C:\Program Files\Hiddify\protocol_handler_windows_plugin.dll
          • Size 100KB
          • SHA256 d9d6836b8a748c9839f4ff11e94cf252f67a2ef948ce8f2771a8d33b1def2a47
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          screen_retriever_plugin.dll
          • Path C:\Program Files\Hiddify\screen_retriever_plugin.dll
          • Size 95KB
          • SHA256 9cc3e94c92aee38ddced77b8db8dad0386a0fe5c9bb7efc2aa67e02cdbf68983
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          sentry_flutter_plugin.dll
          • Path C:\Program Files\Hiddify\sentry_flutter_plugin.dll
          • Size 68KB
          • SHA256 d94f12c4978f7efca576c25cfb24f228893bf5210dc99ca0ffba543ae91eddcd
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          share_plus_plugin.dll
          • Path C:\Program Files\Hiddify\share_plus_plugin.dll
          • Size 126KB
          • SHA256 58248ac639c956134f912cb386e9560e761f19e2244fdce4e0b733c7d30e35b6
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          sqlite3.dll
          • Path C:\Program Files\Hiddify\sqlite3.dll
          • Size 1.3MB
          • SHA256 c48fc3ffbd2bceec27676f09dd76e34c1a2febd8ac75eb2b484b769bb4376274
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          sqlite3_flutter_libs_plugin.dll
          • Path C:\Program Files\Hiddify\sqlite3_flutter_libs_plugin.dll
          • Size 9KB
          • SHA256 bba8cdf9966afd1562eecd3c654c8eb4ce635675a6997f221ddf8effef14b719
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          tray_manager_plugin.dll
          • Path C:\Program Files\Hiddify\tray_manager_plugin.dll
          • Size 103KB
          • SHA256 ce4fce399a2160e0e559a046d307d2c25180926fc15325e90e0b9ae86887cd2a
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          url_launcher_windows_plugin.dll
          • Path C:\Program Files\Hiddify\url_launcher_windows_plugin.dll
          • Size 83KB
          • SHA256 46ae5e7d4ed64b9830dfeb9841b2815d2ad558d3a05be87a8b7de2894f58b91b
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          vclibs_plugin.dll
          • Path C:\Program Files\Hiddify\vclibs_plugin.dll
          • Size 75KB
          • SHA256 b70ea921f87b6bf8b14b80c9513f2b1bfbbd8cc24ce900af4f5c5317ff16b4e8
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          vcruntime140.dll
          • Path C:\Program Files\Hiddify\vcruntime140.dll
          • Size 117KB
          • SHA256 554c3c0ee01e3c875cd77452fd298a953756c1999e9baeab86ca0e79fec6e4da
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          vcruntime140_1.dll
          • Path C:\Program Files\Hiddify\vcruntime140_1.dll
          • Size 58KB
          • SHA256 22e55ccae823b7d69786fc5f7d8626bb25882f127df875b42cfc58ca5fae780d
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          window_manager_plugin.dll
          • Path C:\Program Files\Hiddify\window_manager_plugin.dll
          • Size 134KB
          • SHA256 0c9943ff74e361a84c443357fd480f75ebdc1ca6ca9ed4cb96f8261755353b0c
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Hiddify-Windows-Setup-x64.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\is-JV67H.tmp\Hiddify-Windows-Setup-x64.tmp
          • Size 3.1MB
          • SHA256 3018b06eed9397ac6f9fc8f015366d5102b88d0ae2a96407703ec56e1d3b0f7e
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          shared_preferences.json
          • Path C:\Users\Admin\AppData\Roaming\Hiddify\hiddify\shared_preferences.json
          • Size 33B
          • SHA256 93ef21b324f1c0936bdee2842c01c2b35299ac5b1ddf09a5b95ddd590c21604c
          • MD5 SHA1 SHA512
          Submit Download

          memory/1036-8-0x00000000004A0000-0x0000000000570000-memory.dmp
          Download

          memory/1036-786-0x00000000004A0000-0x0000000000570000-memory.dmp
          Download

          memory/1036-0-0x00000000004A0000-0x0000000000570000-memory.dmp
          Download

          memory/1036-2-0x00000000004A1000-0x0000000000549000-memory.dmp
          Download

          memory/3100-755-0x000001DAFC1E0000-0x000001DAFC1E1000-memory.dmp
          Download

          memory/3100-759-0x000001DAFC1F0000-0x000001DAFC1F1000-memory.dmp
          Download

          memory/3100-756-0x000001DAFC240000-0x000001DAFCE59000-memory.dmp
          Download

          memory/3100-758-0x000001DAFC240000-0x000001DAFCE59000-memory.dmp
          Download

          memory/3100-757-0x000001DAFC240000-0x000001DAFCE59000-memory.dmp
          Download

          memory/5024-9-0x0000000000E20000-0x000000000114F000-memory.dmp
          Download

          memory/5024-12-0x0000000000E20000-0x000000000114F000-memory.dmp
          Download

          memory/5024-773-0x0000000000E20000-0x000000000114F000-memory.dmp
          Download

          memory/5024-718-0x0000000000E20000-0x000000000114F000-memory.dmp
          Download

          memory/5024-10-0x00000000013E0000-0x00000000013E1000-memory.dmp
          Download

          memory/5024-6-0x00000000013E0000-0x00000000013E1000-memory.dmp
          Download