Overview

overview

7

Static

static

3

2024-02-01...ba.exe

windows7-x64

7

2024-02-01...ba.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    138s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-02-2024 13:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-02-01_ff92d013e12793767df7cdfa628904d7_hacktools_xiaoba.exe

  • Size

    3.2MB

  • MD5

    ff92d013e12793767df7cdfa628904d7

  • SHA1

    7626619dc1b80c7cd698e952c9d73b06dfe54b51

  • SHA256

    bceaa9fd153f70d8cecd19b5d482ab9e22881f3b2b67a06159ac1a88683ab0fd

  • SHA512

    e4d280e948e39e94c73aae2341585015a898d3b565ac8f267ebee9932e46462624c3fa508e3ac2ff7e3db9fbe4694ad2678514a9ee46c8858091f85c619693b6

  • SSDEEP

    49152:6zG1BqCBGJdodXAGRe5CFHRoHgmAZf1Ng:DBIKRAGRe5K2UZs

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Program crash 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-02-01_ff92d013e12793767df7cdfa628904d7_hacktools_xiaoba.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-02-01_ff92d013e12793767df7cdfa628904d7_hacktools_xiaoba.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:524
    • C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e57447b.exe
      C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e57447b.exe 240600187
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:4900
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4900 -s 2068
        3⤵
        • Program crash
        PID:1352
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4900 -ip 4900
    1⤵
      PID:1044

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e57447b.exe
      Filesize

      483KB

      MD5

      61daee99c658227271bcb26cefdc658c

      SHA1

      fe603bf87667b9344960e6760a1a09ccaf88f540

      SHA256

      2a8d58c12dee004a2bfad7b9538d921b780724979e483d312865e1f136451799

      SHA512

      8b744dbf8dd951391af37e572baecae096c35cfacaf0c7684d50c0d6038fbf1525dd30483ea20c7dbbdb51bb5943c1a59357670adb844744d49c0b8eddb6f7a8

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e57447b.exe
      Filesize

      447KB

      MD5

      88a6b2c1412f8a4599e9941dfe93f0b7

      SHA1

      7ba416163b309b78c98c37ec9e416989e4ba63c2

      SHA256

      11cd699405fda8e3327a64e86db9f017566f4351e73287085a450427fe860962

      SHA512

      787545a2a5865fa6f2f5d42ebc7daf0ad2d36ee23e6032584260ecb2d88a1388e39d4a22cb6a82cb1a6d8e321c95b6caf4e49ef3757e0912efd5f278152e8fe4

      Download Submit

    • memory/524-0-0x0000000000400000-0x00000000007A5000-memory.dmp

      Filesize

      3.6MB

      Download

    • memory/524-1-0x0000000000400000-0x00000000007A5000-memory.dmp

      Filesize

      3.6MB

      Download

    • memory/524-20-0x0000000000400000-0x00000000007A5000-memory.dmp

      Filesize

      3.6MB

      Download

    • memory/4900-7-0x0000000000400000-0x00000000007A5000-memory.dmp

      Filesize

      3.6MB

      Download

    • memory/4900-16-0x0000000077750000-0x00000000778F0000-memory.dmp

      Filesize

      1.6MB

      Download

    • memory/4900-21-0x0000000000400000-0x00000000007A5000-memory.dmp

      Filesize

      3.6MB

      Download

    • memory/4900-22-0x0000000077750000-0x00000000778F0000-memory.dmp

      Filesize

      1.6MB

      Download