xehook | 05bfbb0886bf381e6a4b2875e928aedf6abe197884d9a64ad7137f6016ed5c9f | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
19-04-2024 19:48

Sharing

Report Analysis Logs

General

Target

86956574d8364f5e6062a23189458eb2.exe
Size

276KB
MD5

86956574d8364f5e6062a23189458eb2
SHA1

9d0cd1bb0b618ffe9076e7ad5e607ea88abe85b0
SHA256

05bfbb0886bf381e6a4b2875e928aedf6abe197884d9a64ad7137f6016ed5c9f
SHA512

d206d519fe82cd025f0ace27759c6e99559187f7bd84dd61eadf06b0acf6f3ed6b289f650c163debe9afc38ec62cad51479c4b2e3ab3a0ab71132c5557064305
SSDEEP

6144:9g4e6XnYIZxmt5DmvpVYNB/nOCFDfuOTJ6I2vCoCe:a4XnYeuNN5J2OTLoCe

Score

10^/10

xehook stealer

Malware Config

Signatures

Detect Xehook Payload 1 IoCs

resource	yara_rule
behavioral1/memory/2184-0-0x0000000000ED0000-0x0000000000F19000-memory.dmp	family_xehook

Xehook stealer
Xehook is an infostealer written in C#.
stealer xehook

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2472	2184	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2472	2184	86956574d8364f5e6062a23189458eb2.exe	29
PID 2184 wrote to memory of 2472	2184	86956574d8364f5e6062a23189458eb2.exe	29
PID 2184 wrote to memory of 2472	2184	86956574d8364f5e6062a23189458eb2.exe	29
PID 2184 wrote to memory of 2472	2184	86956574d8364f5e6062a23189458eb2.exe	29

C:\Users\Admin\AppData\Local\Temp\86956574d8364f5e6062a23189458eb2.exe
"C:\Users\Admin\AppData\Local\Temp\86956574d8364f5e6062a23189458eb2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 48
  2⤵
  - Program crash
  PID:2472

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2184-0-0x0000000000ED0000-0x0000000000F19000-memory.dmp

Filesize
292KB

Download