hellcat | b8e71845cc8ccd668a3436d1952a6c57649974bb8399e599dc33afc4c0843be7

max time kernel
148s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 12:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Red-Flaged/b8e71845cc8ccd668a3436d1952a6c57649974bb8399e599dc33afc4c0843be7.exe
Size 2.8MB
Sample260712-p5a8dsas8k
SHA256 b8e71845cc8ccd668a3436d1952a6c57649974bb8399e599dc33afc4c0843be7
MD5 03c2034d91589b84d2f95b5e9408aedb
SHA1 ce1d4859cc8aedd425104ccb95f7e10b32658785
SHA512 049d94328709ce28c910bbd01ea22a563397169b6ed3659834eeec8a21bb6999d84791ac09a2c440ffc0ddbf1455f5360948555679e98871cfba37842490ff20
SSDEEP 49152:WU7XuDD/7oLfKyB4nJkq0Nw9c3A0Q5YzE8PvV3B/lH:W77cKdiq0sc35oYxPtR
TLSH
T165D57D07BCA108B9C4AAA331C9A692537B75BC481F3223D77E50B27C2FB6BD45976704
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery hellcat ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Adobe\Color\Profiles\_README_HELLCAT_.txt

hellcat

Ransom Note

All your files have been encrypted by the HELLCAT Ransomware Group. This includes documents, source codes, and any other important data on your system. To regain access to your files, you must pay a ransom of $xxx,xxx USD in Monero (XMR) or Bitcoin (BTC). If you fail to make the payment within 336 hours, your files will be permanently encrypted, leaked, and no further attempts to contact us will be entertained. Once you pay, we will provide you with a decryption key that will unlock your files. Failure to comply with these demands will result in irreversible loss of your files. We recommend you act swiftly and make the payment to avoid the permanent loss of your valuable data. Your cooperation is appreciated. If you have any questions or need assistance, refer to the contact information provided below. We will respond to your queries as soon as possible. We are open to negotiating, so feel free to contact us. Your victim hash: xxxxxxxx Providing us with the victim hash will help us prove your identity. If no hash is provided, we won't negotiate. Read this wiki to set up TOX: https://wiki.tox.chat/start Read this wiki to set up XMPP: https://wiki.xmpp.org/web/Main_Page Our Onion site: http://hellcakbszllztlyqbjzwcbdhfrodx55wq77kmftp4bhnhsnn5r3odad.onion TOX: 898923FE0699CFE1EFD17773425DECB080840877C29F883D389D6880B2B961737FACE98E82E4 XMPP: [email protected] - HELLCAT Ransomware

Emails

[email protected]

URLs

https://wiki.tox.chat/start
https://wiki.xmpp.org/web/Main_Page
http://hellcakbszllztlyqbjzwcbdhfrodx55wq77kmftp4bhnhsnn5r3odad.onion

Signatures

Family: Hellcat
Hellcat is a cross-platform ransomware written in Golang.
ransomware hellcat
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	cipher.exe

Enumerates processes with tasklist 1 TTPs 8 IoCs

discovery

Process Discovery

T1057

pid	Process
5476	tasklist.exe
2692	tasklist.exe
5928	tasklist.exe
2616	tasklist.exe
816	tasklist.exe
5680	tasklist.exe
724	tasklist.exe
5956	tasklist.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	5928	tasklist.exe
Token: SeDebugPrivilege	2616	tasklist.exe
Token: SeDebugPrivilege	816	tasklist.exe
Token: SeDebugPrivilege	5680	tasklist.exe
Token: SeDebugPrivilege	724	tasklist.exe
Token: SeDebugPrivilege	5956	tasklist.exe
Token: SeDebugPrivilege	5476	tasklist.exe
Token: SeDebugPrivilege	2692	tasklist.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4504 wrote to memory of 5928	4504	b8e71845cc8ccd668a3436d1952a6c57649974bb8399e599dc33afc4c0843be7.exe	88
PID 4504 wrote to memory of 2616	4504	b8e71845cc8ccd668a3436d1952a6c57649974bb8399e599dc33afc4c0843be7.exe	90
PID 4504 wrote to memory of 816	4504	b8e71845cc8ccd668a3436d1952a6c57649974bb8399e599dc33afc4c0843be7.exe	91
PID 4504 wrote to memory of 5680	4504	b8e71845cc8ccd668a3436d1952a6c57649974bb8399e599dc33afc4c0843be7.exe	92
PID 4504 wrote to memory of 724	4504	b8e71845cc8ccd668a3436d1952a6c57649974bb8399e599dc33afc4c0843be7.exe	93
PID 4504 wrote to memory of 5956	4504	b8e71845cc8ccd668a3436d1952a6c57649974bb8399e599dc33afc4c0843be7.exe	94
PID 4504 wrote to memory of 5476	4504	b8e71845cc8ccd668a3436d1952a6c57649974bb8399e599dc33afc4c0843be7.exe	96
PID 4504 wrote to memory of 2692	4504	b8e71845cc8ccd668a3436d1952a6c57649974bb8399e599dc33afc4c0843be7.exe	98
PID 4504 wrote to memory of 816	4504	b8e71845cc8ccd668a3436d1952a6c57649974bb8399e599dc33afc4c0843be7.exe	99
PID 816 wrote to memory of 4932	816	b8e71845cc8ccd668a3436d1952a6c57649974bb8399e599dc33afc4c0843be7.exe	100
PID 816 wrote to memory of 2968	816	b8e71845cc8ccd668a3436d1952a6c57649974bb8399e599dc33afc4c0843be7.exe	101

C:\Users\Admin\AppData\Local\Temp\Red-Flaged\b8e71845cc8ccd668a3436d1952a6c57649974bb8399e599dc33afc4c0843be7.exe
"C:\Users\Admin\AppData\Local\Temp\Red-Flaged\b8e71845cc8ccd668a3436d1952a6c57649974bb8399e599dc33afc4c0843be7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4504
- C:\Windows\system32\tasklist.exe
  tasklist /fo csv /nh
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:5928
- C:\Windows\system32\tasklist.exe
  tasklist /fo csv /nh
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:2616
- C:\Windows\system32\tasklist.exe
  tasklist /fo csv /nh
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:816
- C:\Windows\system32\tasklist.exe
  tasklist /fo csv /nh
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:5680
- C:\Windows\system32\tasklist.exe
  tasklist /fo csv /nh
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:724
- C:\Windows\system32\tasklist.exe
  tasklist /fo csv /nh
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:5956
- C:\Windows\system32\tasklist.exe
  tasklist /fo csv /nh
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:5476
- C:\Windows\system32\tasklist.exe
  tasklist /fo csv /nh
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:2692
- C:\Users\Admin\AppData\Local\Temp\Red-Flaged\b8e71845cc8ccd668a3436d1952a6c57649974bb8399e599dc33afc4c0843be7.exe
  C:\Users\Admin\AppData\Local\Temp\Red-Flaged\b8e71845cc8ccd668a3436d1952a6c57649974bb8399e599dc33afc4c0843be7.exe cleanup
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:816
- - C:\Windows\system32\cipher.exe
    cipher.exe /w:F:\
    3⤵
    - Enumerates connected drives
    PID:4932
- - C:\Windows\system32\cipher.exe
    cipher.exe /w:C:\
    3⤵
    PID:2968

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_README_HELLCAT_.txt

Path C:\Users\Admin\AppData\Local\Adobe\Color\Profiles\_README_HELLCAT_.txt
Size 1KB
SHA256 f8b6b826230fcd12ae1be3cf74193e065868e0998dd29b0ef09ad5a1298e5641
MD5 9b5b83d2ad9e3eda929234ba3f9f9fb1
SHA1 a92d13feea849df025fed16cfa022aefdd798f40
SHA512 679d17398be6740c79411a4a60889c8388e5119bd408da747d98ee99ef7bc42db2c1317ee03aa87f7c7d39248a6898145ecc407b87233a9c09268d3583a1e5f8
TLSH
T16421765FE719132009D722D2798DAEDAFE5E918813AA4410AC7D402433B9F670E77AF4
MD5 SHA1 SHA512 TLSH

Submit Download

Resubmissions

Analysis