Analysis
-
max time kernel
122s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
22-05-2024 01:49
General
-
Target
2024-05-22_70cffcdf772a00cd45f10ceb15d79a19_hacktools_xiaoba.exe
-
Size
3.2MB
-
MD5
70cffcdf772a00cd45f10ceb15d79a19
-
SHA1
72dc84534500637752c879fd250b9d06f9886da2
-
SHA256
0f8ca9ac2d6baf884acc8c394e47e8253e18a0ac4e2ab32c9ed2eb3b293995bb
-
SHA512
bf780f3d13a26a39255f31e6ac2e3ffd1fea267e271f750fc9abb7610bbfb0840575b2fe6ea68b33759c58f09a9e155896195980a094577d447f8179c6dedbc6
-
SSDEEP
49152:6zG1BqCBGJdodXAGRe5CFHRoHgmAZf1NG:DBIKRAGRe5K2UZi
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 9 IoCs
-
Program crash 1 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_70cffcdf772a00cd45f10ceb15d79a19_hacktools_xiaoba.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-22_70cffcdf772a00cd45f10ceb15d79a19_hacktools_xiaoba.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\f769695.exeC:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\f769695.exe 2594300522⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2888 -s 6003⤵
- Loads dropped DLL
- Program crash
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.2MB
MD5e9cd1fa4db4e77da22fd8446873f1440
SHA182a2388246a0842c76e80a720dfe593a7a394b3b
SHA25695337b5eea2b2e85dcfea37b1f17f67ab126e849e937998ee106588f8f96dfda
SHA5126d8e2d969e26d4b77025cb4ebe6ab576662316508ec8498b2df4558a9d0139c2740ea01d97cfae66dba178fcd618a5d6d239bde2451f98f2f626b3a532d3a659
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
4KB
-
Filesize
3.6MB
-
Filesize
4KB