hellcat | 7f28d26cbda14fd1ede297bb187aa59b92ee3f05889961b3fb5c692603f3127c

Resubmissions

11/11/2025, 15:40

251111-s39jysykcr

07/11/2025, 11:02

251107-m44gfatkaz10

01/11/2025, 15:59

251101-te8s7aew3e10

Analysis

max time kernel
149s
max time network
105s
platform
windows11-21h2_x64
resource
win11-20251015-en
resource tags

arch:x64arch:x86image:win11-20251015-enlocale:en-usos:windows11-21h2-x64system
submitted
01/11/2025, 15:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b8e71845cc8ccd668a3436d1952a6c57649974bb8399e599dc33afc4c0843be7.exe
Size 2.8MB
Sample251101-te8s7aew3e
SHA256 b8e71845cc8ccd668a3436d1952a6c57649974bb8399e599dc33afc4c0843be7
MD5 03c2034d91589b84d2f95b5e9408aedb
SHA1 ce1d4859cc8aedd425104ccb95f7e10b32658785
SHA512 049d94328709ce28c910bbd01ea22a563397169b6ed3659834eeec8a21bb6999d84791ac09a2c440ffc0ddbf1455f5360948555679e98871cfba37842490ff20
SSDEEP 49152:WU7XuDD/7oLfKyB4nJkq0Nw9c3A0Q5YzE8PvV3B/lH:W77cKdiq0sc35oYxPtR
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

credential_access discovery hellcat ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Adobe\Color\Profiles\_README_HELLCAT_.txt

hellcat

Ransom Note

All your files have been encrypted by the HELLCAT Ransomware Group. This includes documents, source codes, and any other important data on your system. To regain access to your files, you must pay a ransom of $xxx,xxx USD in Monero (XMR) or Bitcoin (BTC). If you fail to make the payment within 336 hours, your files will be permanently encrypted, leaked, and no further attempts to contact us will be entertained. Once you pay, we will provide you with a decryption key that will unlock your files. Failure to comply with these demands will result in irreversible loss of your files. We recommend you act swiftly and make the payment to avoid the permanent loss of your valuable data. Your cooperation is appreciated. If you have any questions or need assistance, refer to the contact information provided below. We will respond to your queries as soon as possible. We are open to negotiating, so feel free to contact us. Your victim hash: xxxxxxxx Providing us with the victim hash will help us prove your identity. If no hash is provided, we won't negotiate. Read this wiki to set up TOX: https://wiki.tox.chat/start Read this wiki to set up XMPP: https://wiki.xmpp.org/web/Main_Page Our Onion site: http://hellcakbszllztlyqbjzwcbdhfrodx55wq77kmftp4bhnhsnn5r3odad.onion TOX: 898923FE0699CFE1EFD17773425DECB080840877C29F883D389D6880B2B961737FACE98E82E4 XMPP: [email protected] - HELLCAT Ransomware

Emails

[email protected]

URLs

https://wiki.tox.chat/start
https://wiki.xmpp.org/web/Main_Page
http://hellcakbszllztlyqbjzwcbdhfrodx55wq77kmftp4bhnhsnn5r3odad.onion

Signatures

Hellcat
Hellcat is a cross-platform ransomware written in Golang.
ransomware hellcat
Hellcat family
hellcat
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	cipher.exe

Enumerates processes with tasklist 1 TTPs 11 IoCs

discovery

Process Discovery

T1057

pid	Process
1488	tasklist.exe
2328	tasklist.exe
2416	tasklist.exe
796	tasklist.exe
5128	tasklist.exe
1840	tasklist.exe
3596	tasklist.exe
1124	tasklist.exe
3244	tasklist.exe
3312	tasklist.exe
3116	tasklist.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	1488	tasklist.exe
Token: SeDebugPrivilege	2328	tasklist.exe
Token: SeDebugPrivilege	1124	tasklist.exe
Token: SeDebugPrivilege	2416	tasklist.exe
Token: SeDebugPrivilege	3244	tasklist.exe
Token: SeDebugPrivilege	3312	tasklist.exe
Token: SeDebugPrivilege	796	tasklist.exe
Token: SeDebugPrivilege	5128	tasklist.exe
Token: SeDebugPrivilege	1840	tasklist.exe
Token: SeDebugPrivilege	3596	tasklist.exe
Token: SeDebugPrivilege	3116	tasklist.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 5828 wrote to memory of 1488	5828	b8e71845cc8ccd668a3436d1952a6c57649974bb8399e599dc33afc4c0843be7.exe	79
PID 5828 wrote to memory of 1488	5828	b8e71845cc8ccd668a3436d1952a6c57649974bb8399e599dc33afc4c0843be7.exe	79
PID 5828 wrote to memory of 2328	5828	b8e71845cc8ccd668a3436d1952a6c57649974bb8399e599dc33afc4c0843be7.exe	81
PID 5828 wrote to memory of 2328	5828	b8e71845cc8ccd668a3436d1952a6c57649974bb8399e599dc33afc4c0843be7.exe	81
PID 5828 wrote to memory of 1124	5828	b8e71845cc8ccd668a3436d1952a6c57649974bb8399e599dc33afc4c0843be7.exe	82
PID 5828 wrote to memory of 1124	5828	b8e71845cc8ccd668a3436d1952a6c57649974bb8399e599dc33afc4c0843be7.exe	82
PID 5828 wrote to memory of 2416	5828	b8e71845cc8ccd668a3436d1952a6c57649974bb8399e599dc33afc4c0843be7.exe	83
PID 5828 wrote to memory of 2416	5828	b8e71845cc8ccd668a3436d1952a6c57649974bb8399e599dc33afc4c0843be7.exe	83
PID 5828 wrote to memory of 3244	5828	b8e71845cc8ccd668a3436d1952a6c57649974bb8399e599dc33afc4c0843be7.exe	84
PID 5828 wrote to memory of 3244	5828	b8e71845cc8ccd668a3436d1952a6c57649974bb8399e599dc33afc4c0843be7.exe	84
PID 5828 wrote to memory of 3312	5828	b8e71845cc8ccd668a3436d1952a6c57649974bb8399e599dc33afc4c0843be7.exe	85
PID 5828 wrote to memory of 3312	5828	b8e71845cc8ccd668a3436d1952a6c57649974bb8399e599dc33afc4c0843be7.exe	85
PID 5828 wrote to memory of 796	5828	b8e71845cc8ccd668a3436d1952a6c57649974bb8399e599dc33afc4c0843be7.exe	86
PID 5828 wrote to memory of 796	5828	b8e71845cc8ccd668a3436d1952a6c57649974bb8399e599dc33afc4c0843be7.exe	86
PID 5828 wrote to memory of 5128	5828	b8e71845cc8ccd668a3436d1952a6c57649974bb8399e599dc33afc4c0843be7.exe	87
PID 5828 wrote to memory of 5128	5828	b8e71845cc8ccd668a3436d1952a6c57649974bb8399e599dc33afc4c0843be7.exe	87
PID 5828 wrote to memory of 1840	5828	b8e71845cc8ccd668a3436d1952a6c57649974bb8399e599dc33afc4c0843be7.exe	88
PID 5828 wrote to memory of 1840	5828	b8e71845cc8ccd668a3436d1952a6c57649974bb8399e599dc33afc4c0843be7.exe	88
PID 5828 wrote to memory of 3596	5828	b8e71845cc8ccd668a3436d1952a6c57649974bb8399e599dc33afc4c0843be7.exe	89
PID 5828 wrote to memory of 3596	5828	b8e71845cc8ccd668a3436d1952a6c57649974bb8399e599dc33afc4c0843be7.exe	89
PID 5828 wrote to memory of 3116	5828	b8e71845cc8ccd668a3436d1952a6c57649974bb8399e599dc33afc4c0843be7.exe	90
PID 5828 wrote to memory of 3116	5828	b8e71845cc8ccd668a3436d1952a6c57649974bb8399e599dc33afc4c0843be7.exe	90
PID 5828 wrote to memory of 5824	5828	b8e71845cc8ccd668a3436d1952a6c57649974bb8399e599dc33afc4c0843be7.exe	92
PID 5828 wrote to memory of 5824	5828	b8e71845cc8ccd668a3436d1952a6c57649974bb8399e599dc33afc4c0843be7.exe	92
PID 5824 wrote to memory of 3124	5824	b8e71845cc8ccd668a3436d1952a6c57649974bb8399e599dc33afc4c0843be7.exe	93
PID 5824 wrote to memory of 3124	5824	b8e71845cc8ccd668a3436d1952a6c57649974bb8399e599dc33afc4c0843be7.exe	93
PID 5824 wrote to memory of 5224	5824	b8e71845cc8ccd668a3436d1952a6c57649974bb8399e599dc33afc4c0843be7.exe	94
PID 5824 wrote to memory of 5224	5824	b8e71845cc8ccd668a3436d1952a6c57649974bb8399e599dc33afc4c0843be7.exe	94

C:\Users\Admin\AppData\Local\Temp\b8e71845cc8ccd668a3436d1952a6c57649974bb8399e599dc33afc4c0843be7.exe
"C:\Users\Admin\AppData\Local\Temp\b8e71845cc8ccd668a3436d1952a6c57649974bb8399e599dc33afc4c0843be7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5828
- C:\Windows\system32\tasklist.exe
  tasklist /fo csv /nh
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:1488
- C:\Windows\system32\tasklist.exe
  tasklist /fo csv /nh
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:2328
- C:\Windows\system32\tasklist.exe
  tasklist /fo csv /nh
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:1124
- C:\Windows\system32\tasklist.exe
  tasklist /fo csv /nh
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:2416
- C:\Windows\system32\tasklist.exe
  tasklist /fo csv /nh
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:3244
- C:\Windows\system32\tasklist.exe
  tasklist /fo csv /nh
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:3312
- C:\Windows\system32\tasklist.exe
  tasklist /fo csv /nh
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:796
- C:\Windows\system32\tasklist.exe
  tasklist /fo csv /nh
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:5128
- C:\Windows\system32\tasklist.exe
  tasklist /fo csv /nh
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:1840
- C:\Windows\system32\tasklist.exe
  tasklist /fo csv /nh
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:3596
- C:\Windows\system32\tasklist.exe
  tasklist /fo csv /nh
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:3116
- C:\Users\Admin\AppData\Local\Temp\b8e71845cc8ccd668a3436d1952a6c57649974bb8399e599dc33afc4c0843be7.exe
  C:\Users\Admin\AppData\Local\Temp\b8e71845cc8ccd668a3436d1952a6c57649974bb8399e599dc33afc4c0843be7.exe cleanup
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5824
- - C:\Windows\system32\cipher.exe
    cipher.exe /w:F:\
    3⤵
    - Enumerates connected drives
    PID:3124
- - C:\Windows\system32\cipher.exe
    cipher.exe /w:C:\
    3⤵
    PID:5224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_README_HELLCAT_.txt

Path C:\Users\Admin\AppData\Local\Adobe\Color\Profiles\_README_HELLCAT_.txt
Size 1KB
SHA256 f8b6b826230fcd12ae1be3cf74193e065868e0998dd29b0ef09ad5a1298e5641
MD5 9b5b83d2ad9e3eda929234ba3f9f9fb1
SHA1 a92d13feea849df025fed16cfa022aefdd798f40
SHA512 679d17398be6740c79411a4a60889c8388e5119bd408da747d98ee99ef7bc42db2c1317ee03aa87f7c7d39248a6898145ecc407b87233a9c09268d3583a1e5f8
MD5 SHA1 SHA512

Submit Download