Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
21/04/2024, 05:51
General
-
Target
2024-04-21_a90275af72c9be6f57cac6ce3ffb5043_hacktools_xiaoba.exe
-
Size
2.8MB
-
MD5
a90275af72c9be6f57cac6ce3ffb5043
-
SHA1
a1782030359b41dedc59e44d48c4a92299b3095c
-
SHA256
17572a05af68237a3ec766db9391bb9261c9ff3ff6d5788bc2b80bb4b1048898
-
SHA512
e01136af810a025939096282ee3d38d9a2dc9f4569ae6af4a101bf3236ada611a7fb72557f082db8830a58d872d9215757eac59fc17cfd68a2466434f0d54728
-
SSDEEP
49152:wdkTieIs2ZU8W74jAUCvIj8wLXjS9mauEe2gqjKq+/lCPDvDmeAJMI//B9jztlpD:ZXIsiU12Uwj8wLXjS9mauEe2gqjKq+/p
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 28 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL 6 IoCs
-
UPX packed file 28 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in System32 directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Internet Explorer settings 1 TTPs 27 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 11 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-21_a90275af72c9be6f57cac6ce3ffb5043_hacktools_xiaoba.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-21_a90275af72c9be6f57cac6ce3ffb5043_hacktools_xiaoba.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" www.wg79.com2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3536 CREDAT:17410 /prefetch:23⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
1.3MB
MD59fbb1e0bd621a5331b8dffb5d2989955
SHA10dc57f3c98cabd09f15ca7d4457e4c61a2c10ae7
SHA25671a1b830c0265e8daa71f9ec6ac7875f34058c6b6c496061678192f109f162b0
SHA5123b4f7f8df77bae2a3a2d4808ff33c5e2a3ca9b6bef5ae6ba7c779688ef10fb17b3ac9ef1d083e763247a0aa81eb7938c6e487e2941561ae0048f2e1347855a09
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
1.3MB
-
Filesize
248KB
-
Filesize
248KB