Overview

overview

10

Static

static

3

2026-06-04...ry.exe

windows10-2004-x64

10

2026-06-04...ry.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    144s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    04/06/2026, 21:31

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-04_250d533fe32b380981a7817943f6e409_elex_emotet_glassworm_icedid_luca-stealer_remcos_wannacry.exe
  • Size 6.1MB
  • Sample260604-1c46jsfy31
  • SHA256 28a0499f3704cb56105f04cc5556b340731acdc9b8c76eca5bff70f290f4e8f8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
credential_accessdiscoverygh0strathellcatpurplefoxpersistenceransomwareratrootkitspywarestealertrojanupx

Malware Config

Extracted

Path

  • C:\Users\Admin\AppData\Local\Adobe\Color\Profiles\_README_HELLCAT_.txt

  • hellcat

Ransom Note
  • All your files have been encrypted by the HELLCAT Ransomware Group. This includes documents, source codes, and any other important data on your system. To regain access to your files, you must pay a ransom of $xxx,xxx USD in Monero (XMR) or Bitcoin (BTC). If you fail to make the payment within 336 hours, your files will be permanently encrypted, leaked, and no further attempts to contact us will be entertained. Once you pay, we will provide you with a decryption key that will unlock your files. Failure to comply with these demands will result in irreversible loss of your files. We recommend you act swiftly and make the payment to avoid the permanent loss of your valuable data. Your cooperation is appreciated. If you have any questions or need assistance, refer to the contact information provided below. We will respond to your queries as soon as possible. We are open to negotiating, so feel free to contact us. Your victim hash: xxxxxxxx Providing us with the victim hash will help us prove your identity. If no hash is provided, we won't negotiate. Read this wiki to set up TOX: https://wiki.tox.chat/start Read this wiki to set up XMPP: https://wiki.xmpp.org/web/Main_Page Our Onion site: http://hellcakbszllztlyqbjzwcbdhfrodx55wq77kmftp4bhnhsnn5r3odad.onion TOX: 898923FE0699CFE1EFD17773425DECB080840877C29F883D389D6880B2B961737FACE98E82E4 XMPP: [email protected] - HELLCAT Ransomware
URLs

  • https://wiki.tox.chat/start

  • https://wiki.xmpp.org/web/Main_Page

  • http://hellcakbszllztlyqbjzwcbdhfrodx55wq77kmftp4bhnhsnn5r3odad.onion

Signatures

  • Family: Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat
  • Family: Hellcat

    Hellcat is a cross-platform ransomware written in Golang.

    ransomwarehellcat
  • Family: PurpleFox

    PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

    rootkittrojanpurplefox
  • Detect PurpleFox Rootkit 7 IoCs

    Detect PurpleFox Rootkit.

    rootkit
  • Gh0st RAT payload 8 IoCs
  • UPX dump on OEP (original entry point) 9 IoCs
  • Drops file in Drivers directory 1 IoCs
  • Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
    persistence
  • Sets service image path in registry 3 TTPs 1 IoCs

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 6 IoCs
  • Enumerates processes with tasklist 1 TTPs 9 IoCs
    discovery
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-04_250d533fe32b380981a7817943f6e409_elex_emotet_glassworm_icedid_luca-stealer_remcos_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-04_250d533fe32b380981a7817943f6e409_elex_emotet_glassworm_icedid_luca-stealer_remcos_wannacry.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:912
    • C:\Users\Admin\AppData\Local\Temp\R.exe
      C:\Users\Admin\AppData\Local\Temp\\R.exe
      2⤵
      • Server Software Component: Terminal Services DLL
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      PID:4352
    • C:\Users\Admin\AppData\Local\Temp\N.exe
      C:\Users\Admin\AppData\Local\Temp\\N.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1080
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Suspicious use of WriteProcessMemory
        PID:1992
        • C:\Windows\SysWOW64\PING.EXE
          ping -n 2 127.0.0.1
          4⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:4144
    • C:\Users\Admin\AppData\Local\Temp\HD_2026-06-04_250d533fe32b380981a7817943f6e409_elex_emotet_glassworm_icedid_luca-stealer_remcos_wannacry.exe
      C:\Users\Admin\AppData\Local\Temp\HD_2026-06-04_250d533fe32b380981a7817943f6e409_elex_emotet_glassworm_icedid_luca-stealer_remcos_wannacry.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:388
      • C:\Windows\system32\tasklist.exe
        tasklist /fo csv /nh
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:1108
      • C:\Windows\system32\tasklist.exe
        tasklist /fo csv /nh
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:2244
      • C:\Windows\system32\tasklist.exe
        tasklist /fo csv /nh
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:3956
      • C:\Windows\system32\tasklist.exe
        tasklist /fo csv /nh
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:5756
      • C:\Windows\system32\tasklist.exe
        tasklist /fo csv /nh
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:5072
      • C:\Windows\system32\tasklist.exe
        tasklist /fo csv /nh
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:2664
      • C:\Windows\system32\tasklist.exe
        tasklist /fo csv /nh
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:2704
      • C:\Windows\system32\tasklist.exe
        tasklist /fo csv /nh
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:3412
      • C:\Windows\system32\tasklist.exe
        tasklist /fo csv /nh
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:6088
      • C:\Users\Admin\AppData\Local\Temp\HD_2026-06-04_250d533fe32b380981a7817943f6e409_elex_emotet_glassworm_icedid_luca-stealer_remcos_wannacry.exe
        C:\Users\Admin\AppData\Local\Temp\HD_2026-06-04_250d533fe32b380981a7817943f6e409_elex_emotet_glassworm_icedid_luca-stealer_remcos_wannacry.exe cleanup
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2044
        • C:\Windows\system32\cipher.exe
          cipher.exe /w:F:\
          4⤵
          • Enumerates connected drives
          PID:2288
        • C:\Windows\system32\cipher.exe
          cipher.exe /w:C:\
          4⤵
            PID:404
    • C:\Windows\SysWOW64\svchost.exe
      C:\Windows\SysWOW64\svchost.exe -k "Remote Data"
      1⤵
        PID:1536
      • C:\Windows\SysWOW64\svchost.exe
        C:\Windows\SysWOW64\svchost.exe -k "Remote Data"
        1⤵
        • Loads dropped DLL
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:572
        • C:\Windows\SysWOW64\Remote Data.exe
          "C:\Windows\system32\Remote Data.exe" "c:\windows\system32\240664859.txt",MainThread
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:2208
      • C:\Windows\SysWOW64\TXPlatfor.exe
        C:\Windows\SysWOW64\TXPlatfor.exe -auto
        1⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4460
        • C:\Windows\SysWOW64\TXPlatfor.exe
          C:\Windows\SysWOW64\TXPlatfor.exe -acsi
          2⤵
          • Drops file in Drivers directory
          • Sets service image path in registry
          • Executes dropped EXE
          • Suspicious behavior: LoadsDriver
          • Suspicious use of AdjustPrivilegeToken
          PID:4816
      • C:\Windows\System32\svchost.exe
        C:\Windows\System32\svchost.exe -k "Remote Data"
        1⤵
          PID:1780

        Network

              MITRE ATT&CK Enterprise v16

              Reconnaissance

              Resource Development

              Initial Access

              Execution

              Persistence

              Boot or Logon Autostart Execution

              1
              T1547

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Create or Modify System Process

              1
              T1543

              Windows Service

              1
              T1543.003

              Server Software Component

              1
              T1505

              Terminal Services DLL

              1
              T1505.005

              Privilege Escalation

              Boot or Logon Autostart Execution

              1
              T1547

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Create or Modify System Process

              1
              T1543

              Windows Service

              1
              T1543.003

              Defense Evasion

              Modify Registry

              1
              T1112

              Credential Access

              Credentials from Password Stores

              2
              T1555

              Credentials from Web Browsers

              1
              T1555.003

              Windows Credential Manager

              1
              T1555.004

              Unsecured Credentials

              1
              T1552

              Credentials In Files

              1
              T1552.001

              Discovery

              Browser Information Discovery

              1
              T1217

              Peripheral Device Discovery

              1
              T1120

              Process Discovery

              1
              T1057

              Query Registry

              1
              T1012

              Remote System Discovery

              1
              T1018

              System Information Discovery

              2
              T1082

              System Location Discovery

              1
              T1614

              System Language Discovery

              1
              T1614.001

              System Network Configuration Discovery

              1
              T1016

              Internet Connection Discovery

              1
              T1016.001

              Lateral Movement

              Collection

              Data from Local System

              1
              T1005

              Command and Control

              Exfiltration

              Impact

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              _README_HELLCAT_.txt
              • Path C:\Users\Admin\AppData\Local\Adobe\Color\Profiles\_README_HELLCAT_.txt
              • Size 1KB
              • SHA256 f8b6b826230fcd12ae1be3cf74193e065868e0998dd29b0ef09ad5a1298e5641
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              HD_2026-06-04_250d533fe32b380981a7817943f6e409_elex_emotet_glassworm_icedid_luca-stealer_remcos_wannacry.exe
              • Path C:\Users\Admin\AppData\Local\Temp\HD_2026-06-04_250d533fe32b380981a7817943f6e409_elex_emotet_glassworm_icedid_luca-stealer_remcos_wannacry.exe
              • Size 2.8MB
              • SHA256 b8e71845cc8ccd668a3436d1952a6c57649974bb8399e599dc33afc4c0843be7
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              HD_X.dat
              • Path C:\Users\Admin\AppData\Local\Temp\HD_X.dat
              • Size 3.3MB
              • SHA256 3b71f651a3b9d2ab27f9fe8f17170a48687f04a7c972115f2fb134c651e7fe22
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              N.exe
              • Path C:\Users\Admin\AppData\Local\Temp\N.exe
              • Size 377KB
              • SHA256 3de6c02f52a661b8f934f59541d0cf297bb489eb2155e346b63c7338e09aeaf8
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              R.exe
              • Path C:\Users\Admin\AppData\Local\Temp\R.exe
              • Size 941KB
              • SHA256 bc29f2022ab3b812e50c8681ff196f090c038b5ab51e37daffac4469a8c2eb2c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              240664859.txt
              • Path C:\Windows\SysWOW64\240664859.txt
              • Size 899KB
              • SHA256 9c952bffc355fdebdf848d06c533836af5641296827cb288d7d0c687fcd0c690
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Remote Data.exe
              • Path C:\Windows\SysWOW64\Remote Data.exe
              • Size 40KB
              • SHA256 8dcaeeebef9b9f3d41d295db145ffb3850f309d089c08125c7fa7034db5fd80e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              memory/1080-19-0x0000000010000000-0x00000000101B6000-memory.dmp
              Download

              memory/1080-16-0x0000000010000000-0x00000000101B6000-memory.dmp
              Download

              memory/1080-18-0x0000000010000000-0x00000000101B6000-memory.dmp
              Download

              memory/4460-27-0x0000000010000000-0x00000000101B6000-memory.dmp
              Download

              memory/4460-25-0x0000000010000000-0x00000000101B6000-memory.dmp
              Download

              memory/4460-28-0x0000000010000000-0x00000000101B6000-memory.dmp
              Download

              memory/4816-54-0x0000000010000000-0x00000000101B6000-memory.dmp
              Download

              memory/4816-55-0x0000000010000000-0x00000000101B6000-memory.dmp
              Download

              memory/4816-50-0x0000000010000000-0x00000000101B6000-memory.dmp
              Download