Analysis
-
max time kernel
135s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
22-05-2024 01:31
General
-
Target
2024-05-22_16a19671277b811ea302279d513a37ef_hacktools_xiaoba.exe
-
Size
3.2MB
-
MD5
16a19671277b811ea302279d513a37ef
-
SHA1
ca0a816dd753f7da9760b9c6971f10c20ea97bc4
-
SHA256
58258089d95cd2066d393ebea09c1d07d6370779963f15dbe59774541f66a95d
-
SHA512
49fc871cbb9c6efe60d03d77e3f9cad9708b4e6cd2e4f4a2ec7ccff4c2cd2dba9a1cb390657edc5f82a2976d34052e7f930a967f3beaa63660a5efdb730e3269
-
SSDEEP
49152:6zG1BqCBGJdodXAGRe5CFHRoHgmAZf1NM:DBIKRAGRe5K2UZQ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Program crash 1 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_16a19671277b811ea302279d513a37ef_hacktools_xiaoba.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-22_16a19671277b811ea302279d513a37ef_hacktools_xiaoba.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e572fca.exeC:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e572fca.exe 2405949212⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4080 -s 20563⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4080 -ip 40801⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.2MB
MD58941dc964f6f16173d8361df5aa82869
SHA122a939449b09d885b0187f8e7c99f40422543808
SHA25662f94f600aeaaa700dddc02bce0dedf1d23f7af2c5d5754515a57f12265476c8
SHA512ea27ea2cfe6952cb8ec41ab315a94f3ea8d028038356ca5c90956a0766d058c54a47492c9f9f84fcd1b7a7c73efb3e324392b826ca9a942e45aedbc655fc5ac5
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
4KB
-
Filesize
3.6MB