Analysis
-
max time kernel
140s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
22-05-2024 01:49
General
-
Target
2024-05-22_70cffcdf772a00cd45f10ceb15d79a19_hacktools_xiaoba.exe
-
Size
3.2MB
-
MD5
70cffcdf772a00cd45f10ceb15d79a19
-
SHA1
72dc84534500637752c879fd250b9d06f9886da2
-
SHA256
0f8ca9ac2d6baf884acc8c394e47e8253e18a0ac4e2ab32c9ed2eb3b293995bb
-
SHA512
bf780f3d13a26a39255f31e6ac2e3ffd1fea267e271f750fc9abb7610bbfb0840575b2fe6ea68b33759c58f09a9e155896195980a094577d447f8179c6dedbc6
-
SSDEEP
49152:6zG1BqCBGJdodXAGRe5CFHRoHgmAZf1NG:DBIKRAGRe5K2UZi
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Program crash 1 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_70cffcdf772a00cd45f10ceb15d79a19_hacktools_xiaoba.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-22_70cffcdf772a00cd45f10ceb15d79a19_hacktools_xiaoba.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e574e4f.exeC:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e574e4f.exe 2406027032⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2780 -s 20523⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2780 -ip 27801⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.2MB
MD54911761f68e32b8b28ba974d5610fce2
SHA1f97183d6f6bb18eac1c044c7d7a2b478ff6bb37e
SHA25660033d3247245cd651a92aae5c2fef31c221a8f2b51d8740a79fccfd34760adb
SHA512aa41036615d242735163b27fb1482dd7f6d0b74ec7358db3809a8bd1ca6ab2ecec601ec6baf64d5af78e2a6494912455add03295a719e52f8901859430f7d50f
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
4KB
-
Filesize
3.6MB