Analysis
-
max time kernel
119s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
14-05-2024 01:23
General
-
Target
2024-05-14_f22bba182f4d8b772a7242d2d7bbfc22_hacktools_xiaoba.exe
-
Size
3.2MB
-
MD5
f22bba182f4d8b772a7242d2d7bbfc22
-
SHA1
186e2662f72cca92bfe491980856c9a1305e0d5e
-
SHA256
949ffa1fe14a3cd6d0816fe6ad870b4abc6580c43289995ebb00085292ce370b
-
SHA512
27641f0dffa9387808f3ccbc1a7544c86834e73bca35d9e4930a4c1d23f36c95ed80755a8edb1f7f615f712539a3d2874a132f36de14ec314538921507e1afe3
-
SSDEEP
49152:6zG1BqCBGJdodXAGRe5CFHRoHgmAZf1NR:DBIKRAGRe5K2UZd
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 9 IoCs
-
Program crash 1 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-14_f22bba182f4d8b772a7242d2d7bbfc22_hacktools_xiaoba.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-14_f22bba182f4d8b772a7242d2d7bbfc22_hacktools_xiaoba.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\f769ccc.exeC:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\f769ccc.exe 2594316282⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2772 -s 6003⤵
- Loads dropped DLL
- Program crash
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.2MB
MD565ed9040910c9e59dc478827b4dff71e
SHA1015e9e0abf9c9b031639e9eb74cb004926493401
SHA256ff3c99ec28ab4d6dee2958f7cd68c573ab7eb322507071d1e434d41adf7c100b
SHA512aef63834b454a3a1c0f828ed198d2de6583e28e065adf00cc9482fc0a756421e7f0520b8ba31253ff008e83659c813e2a63185dd14d00bc2814244ad81b4d3be
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
4KB
-
Filesize
3.6MB
-
Filesize
4KB