Overview

overview

9

Static

static

5

Chollima.exe

windows10-2004-x64

9

Chollima.exe

windows11-ltsc_2024-x64

9

Analysis

  • user interaction
    yes
  • max time kernel
    1049s
  • max time network
    433s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    29/06/2026, 04:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Chollima.exe
  • Size 780KB
  • Sample260629-e9m3msev2r
  • SHA256 74dd8cdc532329315bf12d2ad2376d5ad0eab28f25a931911bdb23264ad9e3e2
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasionpersistenceupx

Malware Config

Signatures

  • Enumerates VirtualBox registry keys 2 TTPs 4 IoCs
    defense_evasion
  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
    defense_evasion
  • Drops file in Drivers directory 64 IoCs
  • Looks for VMWare Tools registry key 2 TTPs 1 IoCs
    defense_evasion
  • Looks for VMWare services registry key. 1 TTPs 2 IoCs
    defense_evasion
  • Manipulates Digital Signatures 4 IoCs

    Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

  • Boot or Logon Autostart Execution: Print Processors 1 TTPs 1 IoCs

    Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.

    persistence
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops desktop.ini file(s) 31 IoCs
  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Checks system information in the registry 2 TTPs 2 IoCs

    System information is often read in order to detect sandboxing environments.

  • Drops autorun.inf file 1 TTPs 2 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 64 IoCs
  • Modifies termsrv.dll 1 TTPs 1 IoCs

    Commonly used to allow simultaneous RDP sessions.

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Chollima.exe
    "C:\Users\Admin\AppData\Local\Temp\Chollima.exe"
    1⤵
    • Enumerates VirtualBox registry keys
    • Looks for VirtualBox Guest Additions in registry
    • Looks for VMWare Tools registry key
    • Looks for VMWare services registry key.
    • Checks computer location settings
    • Maps connected drives based on registry
    • Checks system information in the registry
    • Suspicious use of WriteProcessMemory
    PID:5080
    • C:\Windows\System32\Wbem\wmic.exe
      wmic.exe path win32_VideoController get name /value
      2⤵
      • Detects videocard installed
      • Suspicious use of AdjustPrivilegeToken
      PID:4368
    • C:\Windows\System32\Wbem\wmic.exe
      wmic.exe computersystem get manufacturer /value
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4460
    • C:\Windows\System32\Wbem\wmic.exe
      wmic.exe computersystem get model /value
      2⤵
        PID:552
      • C:\Windows\System32\Wbem\wmic.exe
        wmic.exe bios get manufacturer /value
        2⤵
          PID:2308
        • C:\Windows\System32\Wbem\wmic.exe
          wmic.exe bios get serialnumber /value
          2⤵
            PID:5012
          • C:\Windows\System32\Wbem\wmic.exe
            wmic.exe bios get version /value
            2⤵
              PID:4912
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\kill_yourself.cmd"
              2⤵
              • Drops file in Drivers directory
              • Manipulates Digital Signatures
              • Boot or Logon Autostart Execution: Print Processors
              • Drops desktop.ini file(s)
              • Drops autorun.inf file
              • Drops file in System32 directory
              • Modifies termsrv.dll
              • Drops file in Windows directory
              PID:2512
          • C:\Windows\System32\rundll32.exe
            C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
            1⤵
              PID:4768

            Network

                  MITRE ATT&CK Enterprise v16

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  kill_yourself.cmd
                  • Path C:\Users\Admin\AppData\Local\Temp\kill_yourself.cmd
                  • Size 80B
                  • SHA256 fe94e1a862ff2deb2f466b6986ea571810cf2958325d9e6d90758243c06fe362
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  memory/5080-0-0x00007FF60E410000-0x00007FF60E658000-memory.dmp
                  Download

                  memory/5080-4-0x00007FF60E410000-0x00007FF60E658000-memory.dmp
                  Download