Analysis
-
max time kernel
149s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
13/05/2024, 07:54
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-05-13_3dc7df33a1bec3cd18051a25458f34c8_xiaoba.exe
Resource
win7-20240220-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-13_3dc7df33a1bec3cd18051a25458f34c8_xiaoba.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
2024-05-13_3dc7df33a1bec3cd18051a25458f34c8_xiaoba.exe
-
Size
1.1MB
-
MD5
3dc7df33a1bec3cd18051a25458f34c8
-
SHA1
dbccbbb2d218166b3d7e56f2397c63dfee646ceb
-
SHA256
f28759ba7fe36b48557366548511e7651a357f0f94c017375997e75ef159944f
-
SHA512
d976f16b06f5f8d686a74fbe6b0fac4bdedf7150b4efab928b63b43d696fa730f80df20bdbf4593c8bdc7db4ceb76d0eb374a40d945e28e4190fceaa82981f92
-
SSDEEP
24576:kfZanlLXYSKEDRWTg+YeP/YkOqLKYbG6MGY0r:kPSKRM+Y2ZPLPNV
Score
9/10
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 25 IoCs
resource yara_rule behavioral1/memory/2348-0-0x0000000000390000-0x00000000003CE000-memory.dmp UPX behavioral1/memory/2348-9-0x0000000000390000-0x00000000003CE000-memory.dmp UPX behavioral1/memory/2348-1-0x0000000000390000-0x00000000003CE000-memory.dmp UPX behavioral1/memory/2348-15-0x0000000000390000-0x00000000003CE000-memory.dmp UPX behavioral1/memory/2348-13-0x0000000000390000-0x00000000003CE000-memory.dmp UPX behavioral1/memory/2348-17-0x0000000000390000-0x00000000003CE000-memory.dmp UPX behavioral1/memory/2348-3-0x0000000000390000-0x00000000003CE000-memory.dmp UPX behavioral1/memory/2348-2-0x0000000000390000-0x00000000003CE000-memory.dmp UPX behavioral1/memory/2348-5-0x0000000000390000-0x00000000003CE000-memory.dmp UPX behavioral1/memory/2348-7-0x0000000000390000-0x00000000003CE000-memory.dmp UPX behavioral1/memory/2348-31-0x0000000000390000-0x00000000003CE000-memory.dmp UPX behavioral1/memory/2348-44-0x0000000000390000-0x00000000003CE000-memory.dmp UPX behavioral1/memory/2348-41-0x0000000000390000-0x00000000003CE000-memory.dmp UPX behavioral1/memory/2348-39-0x0000000000390000-0x00000000003CE000-memory.dmp UPX behavioral1/memory/2348-37-0x0000000000390000-0x00000000003CE000-memory.dmp UPX behavioral1/memory/2348-35-0x0000000000390000-0x00000000003CE000-memory.dmp UPX behavioral1/memory/2348-33-0x0000000000390000-0x00000000003CE000-memory.dmp UPX behavioral1/memory/2348-29-0x0000000000390000-0x00000000003CE000-memory.dmp UPX behavioral1/memory/2348-27-0x0000000000390000-0x00000000003CE000-memory.dmp UPX behavioral1/memory/2348-25-0x0000000000390000-0x00000000003CE000-memory.dmp UPX behavioral1/memory/2348-23-0x0000000000390000-0x00000000003CE000-memory.dmp UPX behavioral1/memory/2348-21-0x0000000000390000-0x00000000003CE000-memory.dmp UPX behavioral1/memory/2348-19-0x0000000000390000-0x00000000003CE000-memory.dmp UPX behavioral1/memory/2348-11-0x0000000000390000-0x00000000003CE000-memory.dmp UPX behavioral1/memory/2348-45-0x0000000000390000-0x00000000003CE000-memory.dmp UPX -
resource yara_rule behavioral1/memory/2348-0-0x0000000000390000-0x00000000003CE000-memory.dmp upx behavioral1/memory/2348-9-0x0000000000390000-0x00000000003CE000-memory.dmp upx behavioral1/memory/2348-1-0x0000000000390000-0x00000000003CE000-memory.dmp upx behavioral1/memory/2348-15-0x0000000000390000-0x00000000003CE000-memory.dmp upx behavioral1/memory/2348-13-0x0000000000390000-0x00000000003CE000-memory.dmp upx behavioral1/memory/2348-17-0x0000000000390000-0x00000000003CE000-memory.dmp upx behavioral1/memory/2348-3-0x0000000000390000-0x00000000003CE000-memory.dmp upx behavioral1/memory/2348-2-0x0000000000390000-0x00000000003CE000-memory.dmp upx behavioral1/memory/2348-5-0x0000000000390000-0x00000000003CE000-memory.dmp upx behavioral1/memory/2348-7-0x0000000000390000-0x00000000003CE000-memory.dmp upx behavioral1/memory/2348-31-0x0000000000390000-0x00000000003CE000-memory.dmp upx behavioral1/memory/2348-44-0x0000000000390000-0x00000000003CE000-memory.dmp upx behavioral1/memory/2348-41-0x0000000000390000-0x00000000003CE000-memory.dmp upx behavioral1/memory/2348-39-0x0000000000390000-0x00000000003CE000-memory.dmp upx behavioral1/memory/2348-37-0x0000000000390000-0x00000000003CE000-memory.dmp upx behavioral1/memory/2348-35-0x0000000000390000-0x00000000003CE000-memory.dmp upx behavioral1/memory/2348-33-0x0000000000390000-0x00000000003CE000-memory.dmp upx behavioral1/memory/2348-29-0x0000000000390000-0x00000000003CE000-memory.dmp upx behavioral1/memory/2348-27-0x0000000000390000-0x00000000003CE000-memory.dmp upx behavioral1/memory/2348-25-0x0000000000390000-0x00000000003CE000-memory.dmp upx behavioral1/memory/2348-23-0x0000000000390000-0x00000000003CE000-memory.dmp upx behavioral1/memory/2348-21-0x0000000000390000-0x00000000003CE000-memory.dmp upx behavioral1/memory/2348-19-0x0000000000390000-0x00000000003CE000-memory.dmp upx behavioral1/memory/2348-11-0x0000000000390000-0x00000000003CE000-memory.dmp upx behavioral1/memory/2348-45-0x0000000000390000-0x00000000003CE000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2348 2024-05-13_3dc7df33a1bec3cd18051a25458f34c8_xiaoba.exe 2348 2024-05-13_3dc7df33a1bec3cd18051a25458f34c8_xiaoba.exe 2348 2024-05-13_3dc7df33a1bec3cd18051a25458f34c8_xiaoba.exe 2348 2024-05-13_3dc7df33a1bec3cd18051a25458f34c8_xiaoba.exe 2348 2024-05-13_3dc7df33a1bec3cd18051a25458f34c8_xiaoba.exe 2348 2024-05-13_3dc7df33a1bec3cd18051a25458f34c8_xiaoba.exe 2348 2024-05-13_3dc7df33a1bec3cd18051a25458f34c8_xiaoba.exe 2348 2024-05-13_3dc7df33a1bec3cd18051a25458f34c8_xiaoba.exe 2348 2024-05-13_3dc7df33a1bec3cd18051a25458f34c8_xiaoba.exe 2348 2024-05-13_3dc7df33a1bec3cd18051a25458f34c8_xiaoba.exe 2348 2024-05-13_3dc7df33a1bec3cd18051a25458f34c8_xiaoba.exe 2348 2024-05-13_3dc7df33a1bec3cd18051a25458f34c8_xiaoba.exe 2348 2024-05-13_3dc7df33a1bec3cd18051a25458f34c8_xiaoba.exe 2348 2024-05-13_3dc7df33a1bec3cd18051a25458f34c8_xiaoba.exe 2348 2024-05-13_3dc7df33a1bec3cd18051a25458f34c8_xiaoba.exe 2348 2024-05-13_3dc7df33a1bec3cd18051a25458f34c8_xiaoba.exe 2348 2024-05-13_3dc7df33a1bec3cd18051a25458f34c8_xiaoba.exe 2348 2024-05-13_3dc7df33a1bec3cd18051a25458f34c8_xiaoba.exe 2348 2024-05-13_3dc7df33a1bec3cd18051a25458f34c8_xiaoba.exe 2348 2024-05-13_3dc7df33a1bec3cd18051a25458f34c8_xiaoba.exe 2348 2024-05-13_3dc7df33a1bec3cd18051a25458f34c8_xiaoba.exe 2348 2024-05-13_3dc7df33a1bec3cd18051a25458f34c8_xiaoba.exe 2348 2024-05-13_3dc7df33a1bec3cd18051a25458f34c8_xiaoba.exe 2348 2024-05-13_3dc7df33a1bec3cd18051a25458f34c8_xiaoba.exe 2348 2024-05-13_3dc7df33a1bec3cd18051a25458f34c8_xiaoba.exe 2348 2024-05-13_3dc7df33a1bec3cd18051a25458f34c8_xiaoba.exe 2348 2024-05-13_3dc7df33a1bec3cd18051a25458f34c8_xiaoba.exe 2348 2024-05-13_3dc7df33a1bec3cd18051a25458f34c8_xiaoba.exe 2348 2024-05-13_3dc7df33a1bec3cd18051a25458f34c8_xiaoba.exe 2348 2024-05-13_3dc7df33a1bec3cd18051a25458f34c8_xiaoba.exe 2348 2024-05-13_3dc7df33a1bec3cd18051a25458f34c8_xiaoba.exe 2348 2024-05-13_3dc7df33a1bec3cd18051a25458f34c8_xiaoba.exe 2348 2024-05-13_3dc7df33a1bec3cd18051a25458f34c8_xiaoba.exe 2348 2024-05-13_3dc7df33a1bec3cd18051a25458f34c8_xiaoba.exe 2348 2024-05-13_3dc7df33a1bec3cd18051a25458f34c8_xiaoba.exe 2348 2024-05-13_3dc7df33a1bec3cd18051a25458f34c8_xiaoba.exe 2348 2024-05-13_3dc7df33a1bec3cd18051a25458f34c8_xiaoba.exe 2348 2024-05-13_3dc7df33a1bec3cd18051a25458f34c8_xiaoba.exe 2348 2024-05-13_3dc7df33a1bec3cd18051a25458f34c8_xiaoba.exe 2348 2024-05-13_3dc7df33a1bec3cd18051a25458f34c8_xiaoba.exe 2348 2024-05-13_3dc7df33a1bec3cd18051a25458f34c8_xiaoba.exe 2348 2024-05-13_3dc7df33a1bec3cd18051a25458f34c8_xiaoba.exe 2348 2024-05-13_3dc7df33a1bec3cd18051a25458f34c8_xiaoba.exe 2348 2024-05-13_3dc7df33a1bec3cd18051a25458f34c8_xiaoba.exe 2348 2024-05-13_3dc7df33a1bec3cd18051a25458f34c8_xiaoba.exe 2348 2024-05-13_3dc7df33a1bec3cd18051a25458f34c8_xiaoba.exe 2348 2024-05-13_3dc7df33a1bec3cd18051a25458f34c8_xiaoba.exe 2348 2024-05-13_3dc7df33a1bec3cd18051a25458f34c8_xiaoba.exe 2348 2024-05-13_3dc7df33a1bec3cd18051a25458f34c8_xiaoba.exe 2348 2024-05-13_3dc7df33a1bec3cd18051a25458f34c8_xiaoba.exe 2348 2024-05-13_3dc7df33a1bec3cd18051a25458f34c8_xiaoba.exe 2348 2024-05-13_3dc7df33a1bec3cd18051a25458f34c8_xiaoba.exe 2348 2024-05-13_3dc7df33a1bec3cd18051a25458f34c8_xiaoba.exe 2348 2024-05-13_3dc7df33a1bec3cd18051a25458f34c8_xiaoba.exe 2348 2024-05-13_3dc7df33a1bec3cd18051a25458f34c8_xiaoba.exe 2348 2024-05-13_3dc7df33a1bec3cd18051a25458f34c8_xiaoba.exe 2348 2024-05-13_3dc7df33a1bec3cd18051a25458f34c8_xiaoba.exe 2348 2024-05-13_3dc7df33a1bec3cd18051a25458f34c8_xiaoba.exe 2348 2024-05-13_3dc7df33a1bec3cd18051a25458f34c8_xiaoba.exe 2348 2024-05-13_3dc7df33a1bec3cd18051a25458f34c8_xiaoba.exe 2348 2024-05-13_3dc7df33a1bec3cd18051a25458f34c8_xiaoba.exe 2348 2024-05-13_3dc7df33a1bec3cd18051a25458f34c8_xiaoba.exe 2348 2024-05-13_3dc7df33a1bec3cd18051a25458f34c8_xiaoba.exe 2348 2024-05-13_3dc7df33a1bec3cd18051a25458f34c8_xiaoba.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2348 2024-05-13_3dc7df33a1bec3cd18051a25458f34c8_xiaoba.exe 2348 2024-05-13_3dc7df33a1bec3cd18051a25458f34c8_xiaoba.exe 2348 2024-05-13_3dc7df33a1bec3cd18051a25458f34c8_xiaoba.exe