Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
19-03-2024 18:57
General
-
Target
67a8db376b3438977898afc7c53a01c041191f7e7631c2f14945d55393286185.exe
-
Size
148KB
-
MD5
7789d854c72417f4b49dcae6221348b0
-
SHA1
5d4a1f85c12db13735d924d5bee5fd65f88569e2
-
SHA256
67a8db376b3438977898afc7c53a01c041191f7e7631c2f14945d55393286185
-
SHA512
21e27ffed153cd5e70b81cfd69520316d447e91b6a5f33ddc544ed94efe4f3d1724d301335b8045a4e0997d598c02cf849a754a056021fe776893c34367a2cf9
-
SSDEEP
3072:sg5hSHWwsgcwVJ/LjOl5L4WqidIvGgPr/5:wHYTwV0r4WqidIvGgP
Score
10/10
Malware Config
Signatures
-
Detect Xehook Payload 1 IoCs
-
Xehook stealer
Xehook is an infostealer written in C#.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\67a8db376b3438977898afc7c53a01c041191f7e7631c2f14945d55393286185.exe"C:\Users\Admin\AppData\Local\Temp\67a8db376b3438977898afc7c53a01c041191f7e7631c2f14945d55393286185.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
176KB
-
Filesize
104KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
10.8MB