Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
-
submitted
22-05-2024 01:49
General
-
Target
2024-05-22_74de393cfeeb12f9dfa11b2c69e903d4_hacktools_xiaoba.exe
-
Size
3.2MB
-
MD5
74de393cfeeb12f9dfa11b2c69e903d4
-
SHA1
e9dd5aeb364070c99cc0bd23ec871e512d55ad28
-
SHA256
e516236ac44d74f89b57988449cd8689fd9b71faf2322d62c04acd496b33b4df
-
SHA512
93c35b8862cc05c2e7b557d1d8ba7fa880ec05c03bee5114763e2c9324aa4b725f34fe2deb9dbed7bfe9fb601e8102c99619bde1d0b395cd9cdc04baa2aca981
-
SSDEEP
49152:6zG1BqCBGJdodXAGRe5CFHRoHgmAZf1NS:DBIKRAGRe5K2UZe
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 9 IoCs
-
Program crash 1 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_74de393cfeeb12f9dfa11b2c69e903d4_hacktools_xiaoba.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-22_74de393cfeeb12f9dfa11b2c69e903d4_hacktools_xiaoba.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\f761e79.exeC:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\f761e79.exe 2593993042⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2240 -s 6003⤵
- Loads dropped DLL
- Program crash
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.2MB
MD545446527a0249a88660cb25b4bd322c6
SHA1aa2f2e5ae09b198ba139c352a32549824bac9637
SHA256a0149f7b414976e8dd71ac997a40ff689b7a8f09e086942bf37adcdeb6436cbf
SHA51297f4cbabfad1c6bbbd8025c25717c97e2073bb1ac2e502668867d2c115e48503bc85baac824f327c06273c8604b2f07a0426181a32e11296edf238ae30d36a1a
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
4KB
-
Filesize
3.6MB
-
Filesize
4KB