Analysis
-
max time kernel
120s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
22-05-2024 01:42
General
-
Target
2024-05-22_5086dc2ae2d0086baa995033713fd70a_hacktools_xiaoba.exe
-
Size
3.2MB
-
MD5
5086dc2ae2d0086baa995033713fd70a
-
SHA1
b79acb1f8131efe1454ef39262fcf3155ab26a4e
-
SHA256
812c7d78d1fb477d4d03f61dd97284b6cb37af1b0c87517bb236f03bae4a9dbe
-
SHA512
c0d46ade8274f9f5e5497607dc0358c9f8e5dad9fbfe6f56a95e85ec0917925f1985b1653b15092136eb33e71ead0f68f634d6d513fa7c116c0d83730788f5e7
-
SSDEEP
49152:6zG1BqCBGJdodXAGRe5CFHRoHgmAZf1Nc:DBIKRAGRe5K2UZo
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 9 IoCs
-
Program crash 1 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_5086dc2ae2d0086baa995033713fd70a_hacktools_xiaoba.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-22_5086dc2ae2d0086baa995033713fd70a_hacktools_xiaoba.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\f768881.exeC:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\f768881.exe 2594264642⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2748 -s 6083⤵
- Loads dropped DLL
- Program crash
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.2MB
MD55b594b547c3f518f795fb1b23ac437e6
SHA12cffa4ea905e31ffc285c6f31b13468ae3982822
SHA256a02483b4f973c70d21a51e0e654734e47054029d961ab7d5c248fbe8f4cce47e
SHA5129e7da86685e7848d600551a2f3f0be2242b6ed59da7542aaff80f0c6e11cb79e042c9a773e08caf354f693b862f81ee9be4c4b9193fda334bf641e4326dbf358
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
4KB
-
Filesize
3.6MB
-
Filesize
4KB