xehook | 17f929c1d40a7fd6f897c0b15ca9c44b2059cbccb3037c31619d87954659478e

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
22-04-2024 04:52

Target

17f929c1d40a7fd6f897c0b15ca9c44b2059cbccb3037c31619d87954659478e.exe
Size

273KB
MD5

e795115169cc800de0392d6a675d58fd
SHA1

8dd75837e360ba1cb8acf5a3d348dd020a5da482
SHA256

17f929c1d40a7fd6f897c0b15ca9c44b2059cbccb3037c31619d87954659478e
SHA512

5fb6543e91de175bd365462a1cc87d6772e43b0effd3757b3e408b08a4de5a004de9a85e7f1d09578fa3bc6b6486c5f5016c1b879496582dbb39b2e62e168f38
SSDEEP

6144:s/wl9dobdtMJNPX459l2/FpnovRWf1RdSxWbkHg6O0:HdoRtMJRkQp2MY0QO0

Score

10^/10

xehook stealer

Detect Xehook Payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2552-0-0x0000000000960000-0x00000000009A8000-memory.dmp	family_xehook

Xehook stealer
Xehook is an infostealer written in C#.
stealer xehook
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2472 2552 WerFault.exe 17f929c1d40a7fd6f897c0b15ca9c44b2059cbccb3037c31619d87954659478e.exe

pid	pid_target	process	target process
2472	2552	WerFault.exe	17f929c1d40a7fd6f897c0b15ca9c44b2059cbccb3037c31619d87954659478e.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

17f929c1d40a7fd6f897c0b15ca9c44b2059cbccb3037c31619d87954659478e.exe

description	pid	process	target process
PID 2552 wrote to memory of 2472	2552	17f929c1d40a7fd6f897c0b15ca9c44b2059cbccb3037c31619d87954659478e.exe	WerFault.exe
PID 2552 wrote to memory of 2472	2552	17f929c1d40a7fd6f897c0b15ca9c44b2059cbccb3037c31619d87954659478e.exe	WerFault.exe
PID 2552 wrote to memory of 2472	2552	17f929c1d40a7fd6f897c0b15ca9c44b2059cbccb3037c31619d87954659478e.exe	WerFault.exe
PID 2552 wrote to memory of 2472	2552	17f929c1d40a7fd6f897c0b15ca9c44b2059cbccb3037c31619d87954659478e.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\17f929c1d40a7fd6f897c0b15ca9c44b2059cbccb3037c31619d87954659478e.exe
"C:\Users\Admin\AppData\Local\Temp\17f929c1d40a7fd6f897c0b15ca9c44b2059cbccb3037c31619d87954659478e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2552 -s 92
  2⤵
  - Program crash
  PID:2472

memory/2552-0-0x0000000000960000-0x00000000009A8000-memory.dmp

Filesize
288KB

Download