Overview
overview
10Static
static
10Howlis executor.zip
windows7-x64
7Howlis executor.zip
windows11-21h2-x64
8ForlornApi.dll
windows7-x64
1ForlornApi.dll
windows11-21h2-x64
1Howlis executor.exe
windows7-x64
7Howlis executor.exe
windows11-21h2-x64
8��+�*ʼn.pyc
windows7-x64
��+�*ʼn.pyc
windows11-21h2-x64
bin/Xeno.dll
windows7-x64
1bin/Xeno.dll
windows11-21h2-x64
7bin/libcry...64.dll
windows7-x64
1bin/libcry...64.dll
windows11-21h2-x64
1bin/libssl-3-x64.dll
windows7-x64
1bin/libssl-3-x64.dll
windows11-21h2-x64
1bin/xxhash.dll
windows7-x64
1bin/xxhash.dll
windows11-21h2-x64
1bin/zstd.dll
windows7-x64
1bin/zstd.dll
windows11-21h2-x64
1cver.txt
windows7-x64
1cver.txt
windows11-21h2-x64
8cxapis.dll
windows7-x64
1cxapis.dll
windows11-21h2-x64
1runtimes/w...er.dll
windows7-x64
1runtimes/w...er.dll
windows11-21h2-x64
1Analysis
-
max time kernel
1439s -
max time network
1443s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
16-12-2024 21:17
Behavioral task
behavioral1
Sample
Howlis executor.zip
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Howlis executor.zip
Resource
win11-20241023-en
Behavioral task
behavioral3
Sample
ForlornApi.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
ForlornApi.dll
Resource
win11-20241007-en
Behavioral task
behavioral5
Sample
Howlis executor.exe
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
Howlis executor.exe
Resource
win11-20241007-en
Behavioral task
behavioral7
Sample
��+�*ʼn.pyc
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
��+�*ʼn.pyc
Resource
win11-20241007-en
Behavioral task
behavioral9
Sample
bin/Xeno.dll
Resource
win7-20240729-en
Behavioral task
behavioral10
Sample
bin/Xeno.dll
Resource
win11-20241007-en
Behavioral task
behavioral11
Sample
bin/libcrypto-3-x64.dll
Resource
win7-20241010-en
Behavioral task
behavioral12
Sample
bin/libcrypto-3-x64.dll
Resource
win11-20241023-en
Behavioral task
behavioral13
Sample
bin/libssl-3-x64.dll
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
bin/libssl-3-x64.dll
Resource
win11-20241007-en
Behavioral task
behavioral15
Sample
bin/xxhash.dll
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
bin/xxhash.dll
Resource
win11-20241007-en
Behavioral task
behavioral17
Sample
bin/zstd.dll
Resource
win7-20241010-en
Behavioral task
behavioral18
Sample
bin/zstd.dll
Resource
win11-20241007-en
Behavioral task
behavioral19
Sample
cver.txt
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
cver.txt
Resource
win11-20241007-en
Behavioral task
behavioral21
Sample
cxapis.dll
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
cxapis.dll
Resource
win11-20241023-en
Behavioral task
behavioral23
Sample
runtimes/win-x64/native/WebView2Loader.dll
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
runtimes/win-x64/native/WebView2Loader.dll
Resource
win11-20241007-en
General
-
Target
Howlis executor.exe
-
Size
8.0MB
-
MD5
f1ca5255649ddad16f45692c7008f5ee
-
SHA1
5c01084da7bca0482b46095ca52d59b610225ce2
-
SHA256
1a4205f6c5a0bbae1d88ee3cc83b6be6c96c35c129b5c6f1792e176c503be723
-
SHA512
07571d2496fb412ed6aa1540c6bd7a80d6f18e7e17e6b86509fd4b25d566c2761dc9264031385f1be8799431effa2575384ab7dcc0bb02e8f5810a1081a07f00
-
SSDEEP
196608:i7umWsWOjmFwDRxtYSHdK3Hkdai7bN3mZbymVW:LshK2pMEB3QZG
Malware Config
Signatures
-
Loads dropped DLL 7 IoCs
pid Process 2848 Howlis executor.exe 2848 Howlis executor.exe 2848 Howlis executor.exe 2848 Howlis executor.exe 2848 Howlis executor.exe 2848 Howlis executor.exe 2848 Howlis executor.exe -
resource yara_rule behavioral5/files/0x000500000001a4b4-73.dat upx behavioral5/memory/2848-75-0x000007FEF6380000-0x000007FEF67E6000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2792 wrote to memory of 2848 2792 Howlis executor.exe 29 PID 2792 wrote to memory of 2848 2792 Howlis executor.exe 29 PID 2792 wrote to memory of 2848 2792 Howlis executor.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\Howlis executor.exe"C:\Users\Admin\AppData\Local\Temp\Howlis executor.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\Howlis executor.exe"C:\Users\Admin\AppData\Local\Temp\Howlis executor.exe"2⤵
- Loads dropped DLL
PID:2848
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
21KB
MD53473bc217562594b5b126d7aeb9380e9
SHA1b551b9d9aa80be070f577376e484610e01c5171a
SHA2560d8190fd619feb20df123931108d499132f7051f1ebb0ef246082f4c52c88b22
SHA512036b93457ade632ad68264d81ff26ee1156038e234c606882386d6babcbe722a18e9ced1655f97caecaf5fd514e261dafe999a3e9fec00cc677e177f0bf8e203
-
Filesize
20KB
MD550abf0a7ee67f00f247bada185a7661c
SHA10cddac9ac4db3bf10a11d4b79085ef9cb3fb84a1
SHA256f957a4c261506484b53534a9be8931c02ec1a349b3f431a858f8215cecfec3f7
SHA512c2694bb5d103baff1264926a04d2f0fe156b8815a23c3748412a81cc307b71a9236a0e974b5549321014065e393d10228a0f0004df9ba677f03b5d244a64b528
-
Filesize
21KB
MD50414909b279ea61ca344edbe8e33e40b
SHA14ece0dabe954c43f9bd5032de76ec29c47b22e10
SHA25605b0c773a77850f3d50ddb4b82cc4d5f19316fe1aaa65e21b4709ae73f60a28e
SHA512edbd33540cd1ef69f2ce824cfb991903ec6e4edda815f07d610247594ceeb2ebc78f05a44b4de8c5c937191b7e8b2ef221423c06df303d73deea721c25d15eed
-
Filesize
21KB
MD5b1ba47d8389c40c2dda3c56cbed14fc5
SHA12eef9ffa32171d53affa44e3db7727aa383f7fac
SHA256c7277c05dc6b905fad5cb930b0ecfbbc4676b46974b4571e54ca44cb6f6be404
SHA512466e31f17f73bda5149343b23f4966502a8597d2a2e43f9a6c9c32387451d92c6b658ccaae27044e68e4a9fd0ef9c89e32dc7639d59fcf04c596b6abfa09658b
-
Filesize
21KB
MD5953c63ef10ec30ef7c89a6f0f7074041
SHA14b4f1ff3085fded9dbd737f273585ad43175b0a3
SHA256c93954167c12e15b58ac95240d2e0a2fbd94561d739d9f6aca906d9c30453496
SHA512b4534785e4d02ad387e3c6082884d438cc4b3cd8758aabcf99620052f5842dbd298351bc1723c274d4f7d3fce0cc940df3d47865fece2f07cdb1151376ba852e
-
Filesize
1.4MB
MD54a6afa2200b1918c413d511c5a3c041c
SHA139ca3c2b669adac07d4a5eb1b3b79256cfe0c3b3
SHA256bec187f608507b57cf0475971ba646b8ab42288af8fdcf78bce25f1d8c84b1da
SHA512dbffb06ffff0542200344ea9863a44a6f1e1b783379e53df18580e697e8204d3911e091deb32a9c94b5599cdd54301b705b74e1f51104151cf13b89d57280a20
-
Filesize
1.1MB
MD53b337c2d41069b0a1e43e30f891c3813
SHA1ebee2827b5cb153cbbb51c9718da1549fa80fc5c
SHA256c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
SHA512fdb3012a71221447b35757ed2bdca6ed1f8833b2f81d03aabebd2cd7780a33a9c3d816535d03c5c3edd5aaf11d91156842b380e2a63135e3c7f87193ad211499