53d4b1bdf55b84b9dc09963fbf8c25d2d8164dba5130d136a96c02dc548eb79f

Analysis

max time kernel
2s
max time network
2s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-11-2024 19:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Hellion.exe
Size

39.2MB
MD5

7c8b836cc2e24a14994390ecfc23ab60
SHA1

ae07a2cfa281c3e597ca309fd1fc9ac0990490d8
SHA256

53d4b1bdf55b84b9dc09963fbf8c25d2d8164dba5130d136a96c02dc548eb79f
SHA512

da57ecf50fa02aeba119981e7ff6ec8d9efad9633192898db6caa2a3f57037edbc5165c7bfb3664c98dacd262ed207cf5a151997e1bd119ddefdbf9ce5e7377d
SSDEEP

786432:w1mgeOt2n0c009m7azBnwpF7zWAwpnut5n:w1oZn0c009S8exWA35n

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1912	Stub.exe

Loads dropped DLL 2 IoCs

pid	Process
2524	Hellion.exe
1912	Stub.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2524 wrote to memory of 1912	2524	Hellion.exe	30
PID 2524 wrote to memory of 1912	2524	Hellion.exe	30
PID 2524 wrote to memory of 1912	2524	Hellion.exe	30

C:\Users\Admin\AppData\Local\Temp\Hellion.exe
"C:\Users\Admin\AppData\Local\Temp\Hellion.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Users\Admin\AppData\Local\Temp\onefile_2524_133765196188016000\Stub.exe
  C:\Users\Admin\AppData\Local\Temp\Hellion.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\onefile_2524_133765196188016000\python311.dll

Filesize
5.5MB

MD5
5a5dd7cad8028097842b0afef45bfbcf

SHA1
e247a2e460687c607253949c52ae2801ff35dc4a

SHA256
a811c7516f531f1515d10743ae78004dd627eba0dc2d3bc0d2e033b2722043ce

SHA512
e6268e4fad2ce3ef16b68298a57498e16f0262bf3531539ad013a66f72df471569f94c6fcc48154b7c3049a3ad15cbfcbb6345dacb4f4ed7d528c74d589c9858

Download Submit