f3180b52edf675cd58c3c14ba13210d7d6c61a52990424ea729bdf6783696f27

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
23-12-2024 15:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Hellion.exe
Size

38.2MB
MD5

59566623392030915cab95e28a90a436
SHA1

a4ab68d3d5b64ca75f316dbbe2701e7b6e4a57fa
SHA256

f3180b52edf675cd58c3c14ba13210d7d6c61a52990424ea729bdf6783696f27
SHA512

5746eab07150f70c0560dceeedb8032791b60aa5d4297337979f2f2ceccbd1d6163aa18fb0f52148f382373ae044f9f27ef1837485ba6438d8b95f63f922822d
SSDEEP

786432:E6O9GLfidzyMo8T9ZO8FyV1J1cuV7DW6USDdvBW/h4TSoRV11mm2sIZY7:Eh9G7AzyqZwJ186nTWp4TS2zssIZ+

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2300	Stub.exe

Loads dropped DLL 2 IoCs

pid	Process
2072	Hellion.exe
2300	Stub.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1596	chrome.exe
1596	chrome.exe

Suspicious use of AdjustPrivilegeToken 62 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 2300	2072	Hellion.exe	30
PID 2072 wrote to memory of 2300	2072	Hellion.exe	30
PID 2072 wrote to memory of 2300	2072	Hellion.exe	30
PID 1596 wrote to memory of 2420	1596	chrome.exe	34
PID 1596 wrote to memory of 2420	1596	chrome.exe	34
PID 1596 wrote to memory of 2420	1596	chrome.exe	34
PID 1596 wrote to memory of 2464	1596	chrome.exe	36
PID 1596 wrote to memory of 2464	1596	chrome.exe	36
PID 1596 wrote to memory of 2464	1596	chrome.exe	36
PID 1596 wrote to memory of 2464	1596	chrome.exe	36
PID 1596 wrote to memory of 2464	1596	chrome.exe	36
PID 1596 wrote to memory of 2464	1596	chrome.exe	36
PID 1596 wrote to memory of 2464	1596	chrome.exe	36
PID 1596 wrote to memory of 2464	1596	chrome.exe	36
PID 1596 wrote to memory of 2464	1596	chrome.exe	36
PID 1596 wrote to memory of 2464	1596	chrome.exe	36
PID 1596 wrote to memory of 2464	1596	chrome.exe	36
PID 1596 wrote to memory of 2464	1596	chrome.exe	36
PID 1596 wrote to memory of 2464	1596	chrome.exe	36
PID 1596 wrote to memory of 2464	1596	chrome.exe	36
PID 1596 wrote to memory of 2464	1596	chrome.exe	36
PID 1596 wrote to memory of 2464	1596	chrome.exe	36
PID 1596 wrote to memory of 2464	1596	chrome.exe	36
PID 1596 wrote to memory of 2464	1596	chrome.exe	36
PID 1596 wrote to memory of 2464	1596	chrome.exe	36
PID 1596 wrote to memory of 2464	1596	chrome.exe	36
PID 1596 wrote to memory of 2464	1596	chrome.exe	36
PID 1596 wrote to memory of 2464	1596	chrome.exe	36
PID 1596 wrote to memory of 2464	1596	chrome.exe	36
PID 1596 wrote to memory of 2464	1596	chrome.exe	36
PID 1596 wrote to memory of 2464	1596	chrome.exe	36
PID 1596 wrote to memory of 2464	1596	chrome.exe	36
PID 1596 wrote to memory of 2464	1596	chrome.exe	36
PID 1596 wrote to memory of 2464	1596	chrome.exe	36
PID 1596 wrote to memory of 2464	1596	chrome.exe	36
PID 1596 wrote to memory of 2464	1596	chrome.exe	36
PID 1596 wrote to memory of 2464	1596	chrome.exe	36
PID 1596 wrote to memory of 2464	1596	chrome.exe	36
PID 1596 wrote to memory of 2464	1596	chrome.exe	36
PID 1596 wrote to memory of 2464	1596	chrome.exe	36
PID 1596 wrote to memory of 2464	1596	chrome.exe	36
PID 1596 wrote to memory of 2464	1596	chrome.exe	36
PID 1596 wrote to memory of 2464	1596	chrome.exe	36
PID 1596 wrote to memory of 2464	1596	chrome.exe	36
PID 1596 wrote to memory of 2464	1596	chrome.exe	36
PID 1596 wrote to memory of 1748	1596	chrome.exe	37
PID 1596 wrote to memory of 1748	1596	chrome.exe	37
PID 1596 wrote to memory of 1748	1596	chrome.exe	37
PID 1596 wrote to memory of 1616	1596	chrome.exe	38
PID 1596 wrote to memory of 1616	1596	chrome.exe	38
PID 1596 wrote to memory of 1616	1596	chrome.exe	38
PID 1596 wrote to memory of 1616	1596	chrome.exe	38
PID 1596 wrote to memory of 1616	1596	chrome.exe	38
PID 1596 wrote to memory of 1616	1596	chrome.exe	38
PID 1596 wrote to memory of 1616	1596	chrome.exe	38
PID 1596 wrote to memory of 1616	1596	chrome.exe	38
PID 1596 wrote to memory of 1616	1596	chrome.exe	38
PID 1596 wrote to memory of 1616	1596	chrome.exe	38
PID 1596 wrote to memory of 1616	1596	chrome.exe	38
PID 1596 wrote to memory of 1616	1596	chrome.exe	38
PID 1596 wrote to memory of 1616	1596	chrome.exe	38
PID 1596 wrote to memory of 1616	1596	chrome.exe	38
PID 1596 wrote to memory of 1616	1596	chrome.exe	38
PID 1596 wrote to memory of 1616	1596	chrome.exe	38

C:\Users\Admin\AppData\Local\Temp\Hellion.exe
"C:\Users\Admin\AppData\Local\Temp\Hellion.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Users\Admin\AppData\Local\Temp\onefile_2072_133794413066324000\Stub.exe
  C:\Users\Admin\AppData\Local\Temp\Hellion.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2300

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef55c9758,0x7fef55c9768,0x7fef55c9778
  2⤵
  PID:2420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1164 --field-trial-handle=1236,i,2309444424361848810,10888713874716571446,131072 /prefetch:2
  2⤵
  PID:2464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1524 --field-trial-handle=1236,i,2309444424361848810,10888713874716571446,131072 /prefetch:8
  2⤵
  PID:1748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1616 --field-trial-handle=1236,i,2309444424361848810,10888713874716571446,131072 /prefetch:8
  2⤵
  PID:1616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=1604 --field-trial-handle=1236,i,2309444424361848810,10888713874716571446,131072 /prefetch:1
  2⤵
  PID:2372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2156 --field-trial-handle=1236,i,2309444424361848810,10888713874716571446,131072 /prefetch:1
  2⤵
  PID:1628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1360 --field-trial-handle=1236,i,2309444424361848810,10888713874716571446,131072 /prefetch:2
  2⤵
  PID:2240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3196 --field-trial-handle=1236,i,2309444424361848810,10888713874716571446,131072 /prefetch:1
  2⤵
  PID:1468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3636 --field-trial-handle=1236,i,2309444424361848810,10888713874716571446,131072 /prefetch:8
  2⤵
  PID:2152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3720 --field-trial-handle=1236,i,2309444424361848810,10888713874716571446,131072 /prefetch:1
  2⤵
  PID:2716

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\22d79fbe-c845-401a-b30f-f2d3d52379d6.tmp

Filesize
330KB

MD5
85caf87445405243ff40bac1df6917fd

SHA1
85b3b0856acf7263bc76f30e31b0f8637d83b5ad

SHA256
117daa81d810708a862b2b99866babe7e2a616cf10ced38e6a241f1e4bd7a31c

SHA512
6dfe33cbe40a4dd954710363888856805a15ba65178ebac7450e6da0cd94aecafebd2e0601084880b3b366d3ef7d4957fc293cca2a9b6a8d78ea684ae7404bff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001

Filesize
215KB

MD5
d79b35ccf8e6af6714eb612714349097

SHA1
eb3ccc9ed29830df42f3fd129951cb8b791aaf98

SHA256
c8459799169b81fdab64d028a9ebb058ea2d0ad5feb33a11f6a45a54a5ccc365

SHA512
f4be1c1e192a700139d7cff5059af81c0234ed5f032796036a1a4879b032ce4eedd16a121bbf776f17bc84a0012846f467ad48b46db4008841c25b779c7d8f5a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
4266614a4c8523d7e9f13e8ee62b65ff

SHA1
f919fa4c713f79e52aa321a4e4cde35951231d03

SHA256
c755db84bcd8ad5a1b9c1acef6b80fc9977981669c47fbace80e0907e4fca26e

SHA512
480ace8c5e7fb7ef1b17a5654b14eaf8cf990fef425538f2bd6389e747393721e1e78fab6b9acd55e1fd1c3e75745724c930ed7eea2d2cf506ca0fc0b59b8149

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
330KB

MD5
7ff66e5c4e474d55962d6ad92108f4a6

SHA1
8a283bf05725bbd58aa4a27abaa8859c0f9fdb12

SHA256
31d72bf91870fb3b7256954e3de4cb7a7c8cc290320eba594d735002e2f57c6b

SHA512
4ae3ce7f8d20152fae2ae6b1f457f1aaf69a3fb7955db1f88a9274de681bf1043a5092e13e7f7d3b4d342b040c8422ac371a872f41bb95135eb42bb62b69f370

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2072_133794413066324000\python310.dll

Filesize
4.3MB

MD5
e4533934b37e688106beac6c5919281e

SHA1
ada39f10ef0bbdcf05822f4260e43d53367b0017

SHA256
2bf761bae584ba67d9a41507b45ebd41ab6ae51755b1782496d0bc60cc1d41d5

SHA512
fa681a48ddd81854c9907026d4f36b008e509729f1d9a18a621f1d86cd1176c1a1ff4f814974306fa4d9e3886e2ce112a4f79b66713e1401f5dae4bcd8b898b9

Download Submit