xehook | 17f929c1d40a7fd6f897c0b15ca9c44b2059cbccb3037c31619d87954659478e | Triage

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
23-04-2024 09:55

Sharing

Report Analysis Logs

General

Target

tmp.exe
Size

273KB
MD5

e795115169cc800de0392d6a675d58fd
SHA1

8dd75837e360ba1cb8acf5a3d348dd020a5da482
SHA256

17f929c1d40a7fd6f897c0b15ca9c44b2059cbccb3037c31619d87954659478e
SHA512

5fb6543e91de175bd365462a1cc87d6772e43b0effd3757b3e408b08a4de5a004de9a85e7f1d09578fa3bc6b6486c5f5016c1b879496582dbb39b2e62e168f38
SSDEEP

6144:s/wl9dobdtMJNPX459l2/FpnovRWf1RdSxWbkHg6O0:HdoRtMJRkQp2MY0QO0

Score

10^/10

xehook stealer

Malware Config

Signatures

Detect Xehook Payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2332-0-0x0000000000FE0000-0x0000000001028000-memory.dmp	family_xehook

Xehook stealer
Xehook is an infostealer written in C#.
stealer xehook

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
2952	2332	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

tmp.exe

description	pid	Process	procid_target
PID 2332 wrote to memory of 2952	2332	tmp.exe	29
PID 2332 wrote to memory of 2952	2332	tmp.exe	29
PID 2332 wrote to memory of 2952	2332	tmp.exe	29
PID 2332 wrote to memory of 2952	2332	tmp.exe	29

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2332 -s 92
  2⤵
  - Program crash
  PID:2952

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2332-0-0x0000000000FE0000-0x0000000001028000-memory.dmp

Filesize
288KB

Download