Analysis
-
max time kernel
140s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
-
submitted
02-05-2024 04:37
General
-
Target
2024-05-02_e167ebbe920bee0ea4120b7ffdb0919d_hacktools_xiaoba.exe
-
Size
3.2MB
-
MD5
e167ebbe920bee0ea4120b7ffdb0919d
-
SHA1
85e8bde967c162da59e7ac29842beae0cfd58d9a
-
SHA256
cd50bf730245756946cf171fc9794df41faf65c4fcb5b123a2f91aeb82d3e2a2
-
SHA512
1b7f6cd133133eabd7c548fcbc9a6332e047c44fe3584898eb100f3cb76f0c7deb705fb6378ece234b3fdb45209468982f0c8b73ad5cd8c3ec2f22bf03fa9092
-
SSDEEP
49152:6zG1BqCBGJdodXAGRe5CFHRoHgmAZf1NW:DBIKRAGRe5K2UZi
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Program crash 1 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-02_e167ebbe920bee0ea4120b7ffdb0919d_hacktools_xiaoba.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-02_e167ebbe920bee0ea4120b7ffdb0919d_hacktools_xiaoba.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e573e41.exeC:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e573e41.exe 2405985932⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4924 -s 20523⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4924 -ip 49241⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.2MB
MD5bd6c0d6e9067046c2b5b2b05032ac11b
SHA174fb5ef9568447c261a1d6a6388b850df8f22740
SHA2565cae53c8e3f58ee5db15b862271e47131f3c4d9b314d48f84b4c728091d0a2fa
SHA5129e1d038f8463fe9e3ef88c8ed336c3d8b8d37c3b934a19fa6a70b1520dbb38178c5e1764ff128e9f61369c66cffca9be4f2546b5f5b83e5ec357754e2db2d5f9
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
4KB
-
Filesize
3.6MB