Analysis
-
max time kernel
131s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
22-05-2024 01:49
General
-
Target
2024-05-22_74de393cfeeb12f9dfa11b2c69e903d4_hacktools_xiaoba.exe
-
Size
3.2MB
-
MD5
74de393cfeeb12f9dfa11b2c69e903d4
-
SHA1
e9dd5aeb364070c99cc0bd23ec871e512d55ad28
-
SHA256
e516236ac44d74f89b57988449cd8689fd9b71faf2322d62c04acd496b33b4df
-
SHA512
93c35b8862cc05c2e7b557d1d8ba7fa880ec05c03bee5114763e2c9324aa4b725f34fe2deb9dbed7bfe9fb601e8102c99619bde1d0b395cd9cdc04baa2aca981
-
SSDEEP
49152:6zG1BqCBGJdodXAGRe5CFHRoHgmAZf1NS:DBIKRAGRe5K2UZe
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Program crash 1 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_74de393cfeeb12f9dfa11b2c69e903d4_hacktools_xiaoba.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-22_74de393cfeeb12f9dfa11b2c69e903d4_hacktools_xiaoba.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e574016.exeC:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e574016.exe 2405990622⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1448 -s 20563⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1448 -ip 14481⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.2MB
MD55b8d4a5a13753f5cf0d28fe36689a226
SHA1552097026c045bff5876b41c6754888280f0eaea
SHA256a6dbc56d7fb926338fa28c245996bab5ae0149ea40f5839caa5564ca74e953b4
SHA5121b6a84c95ecb1f848e4212ea257f6644c92379e5f13c112627ccf80619cf36c6722e4517ca349f95b54d22121619aaa3b8396c41eab3729f29f8c63f629331e4
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
4KB
-
Filesize
3.6MB