Overview

overview

7

Static

static

3

HypnoHotli...PC.exe

windows10-2004-x64

7

HypnoHotli...PC.exe

windows11-ltsc_2024-x64

7

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...ls.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

3

Hypno Hotline.exe

windows10-2004-x64

7

LICENSES.c...m.html

windows10-2004-x64

3

LICENSES.c...m.html

windows11-ltsc_2024-x64

3

d3dcompiler_47.dll

windows10-2004-x64

1

ffmpeg.dll

windows10-2004-x64

1

libEGL.dll

windows10-2004-x64

1

libGLESv2.dll

windows10-2004-x64

1

resources/elevate.exe

windows10-2004-x64

3

resources/elevate.exe

windows11-ltsc_2024-x64

3

vk_swiftshader.dll

windows10-2004-x64

1

vulkan-1.dll

windows10-2004-x64

1

$PLUGINSDI...7z.dll

windows10-2004-x64

3

$PLUGINSDI...7z.dll

windows11-ltsc_2024-x64

3

Analysis

  • max time kernel
    149s
  • max time network
    160s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    27/07/2026, 10:46

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Hypno Hotline.exe
  • Size 193.4MB
  • Sample260727-mt89ya1tes
  • SHA256 e0c03f53f2d854704bfd8c42abadb17ecaef9909c1e341228afcf7cf26757553
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
persistence

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Hypno Hotline.exe
    "C:\Users\Admin\AppData\Local\Temp\Hypno Hotline.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1076
    • C:\Users\Admin\AppData\Local\Temp\Hypno Hotline.exe
      "C:\Users\Admin\AppData\Local\Temp\Hypno Hotline.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\hypno-hotline-desktop" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1744,i,697071207655320111,3857839143037506968,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=1740 /prefetch:2
      2⤵
        PID:4572
      • C:\Users\Admin\AppData\Local\Temp\Hypno Hotline.exe
        "C:\Users\Admin\AppData\Local\Temp\Hypno Hotline.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\hypno-hotline-desktop" --field-trial-handle=1744,i,697071207655320111,3857839143037506968,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2144 /prefetch:3
        2⤵
          PID:2388
        • C:\Users\Admin\AppData\Local\Temp\Hypno Hotline.exe
          "C:\Users\Admin\AppData\Local\Temp\Hypno Hotline.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\hypno-hotline-desktop" --app-user-model-id="electron.app.Hypno Hotline" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1744,i,697071207655320111,3857839143037506968,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:1
          2⤵
          • Checks computer location settings
          PID:2396
        • C:\Users\Admin\AppData\Local\Temp\Hypno Hotline.exe
          "C:\Users\Admin\AppData\Local\Temp\Hypno Hotline.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\hypno-hotline-desktop" --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1744,i,697071207655320111,3857839143037506968,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:8
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:3844

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            default.dic
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
            • Size 2B
            • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
            • MD5 SHA1 SHA512
            Submit Download

            Network Persistent State
            • Path C:\Users\Admin\AppData\Roaming\hypno-hotline-desktop\Network\Network Persistent State
            • Size 305B
            • SHA256 af91c24fdfc36a6b8dbddd8e49e472d94153f5c75a886d3432356d3829c01566
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Network Persistent State~RFe59792e.TMP
            • Path C:\Users\Admin\AppData\Roaming\hypno-hotline-desktop\Network\Network Persistent State~RFe59792e.TMP
            • Size 59B
            • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            CURRENT
            • Path C:\Users\Admin\AppData\Roaming\hypno-hotline-desktop\Session Storage\CURRENT
            • Size 16B
            • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
            • MD5 SHA1 SHA512
            Submit Download

            memory/3844-97-0x000001C38F7A0000-0x000001C38F7A1000-memory.dmp
            Download

            memory/3844-96-0x000001C38F7A0000-0x000001C38F7A1000-memory.dmp
            Download

            memory/3844-95-0x000001C38F7A0000-0x000001C38F7A1000-memory.dmp
            Download

            memory/3844-101-0x000001C38F7A0000-0x000001C38F7A1000-memory.dmp
            Download

            memory/3844-104-0x000001C38F7A0000-0x000001C38F7A1000-memory.dmp
            Download

            memory/3844-107-0x000001C38F7A0000-0x000001C38F7A1000-memory.dmp
            Download

            memory/3844-106-0x000001C38F7A0000-0x000001C38F7A1000-memory.dmp
            Download

            memory/3844-105-0x000001C38F7A0000-0x000001C38F7A1000-memory.dmp
            Download

            memory/3844-103-0x000001C38F7A0000-0x000001C38F7A1000-memory.dmp
            Download

            memory/3844-102-0x000001C38F7A0000-0x000001C38F7A1000-memory.dmp
            Download