Overview

overview

7

Static

static

3

2024-05-22...ba.exe

windows7-x64

7

2024-05-22...ba.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    135s
  • max time network
    125s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-05-2024 01:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-05-22_16a19671277b811ea302279d513a37ef_hacktools_xiaoba.exe

  • Size

    3.2MB

  • MD5

    16a19671277b811ea302279d513a37ef

  • SHA1

    ca0a816dd753f7da9760b9c6971f10c20ea97bc4

  • SHA256

    58258089d95cd2066d393ebea09c1d07d6370779963f15dbe59774541f66a95d

  • SHA512

    49fc871cbb9c6efe60d03d77e3f9cad9708b4e6cd2e4f4a2ec7ccff4c2cd2dba9a1cb390657edc5f82a2976d34052e7f930a967f3beaa63660a5efdb730e3269

  • SSDEEP

    49152:6zG1BqCBGJdodXAGRe5CFHRoHgmAZf1NM:DBIKRAGRe5K2UZQ

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Program crash 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-22_16a19671277b811ea302279d513a37ef_hacktools_xiaoba.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-22_16a19671277b811ea302279d513a37ef_hacktools_xiaoba.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2668
    • C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e572fca.exe
      C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e572fca.exe 240594921
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:4080
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4080 -s 2056
        3⤵
        • Program crash
        PID:724
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4080 -ip 4080
    1⤵
      PID:620

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e572fca.exe
      Filesize

      3.2MB

      MD5

      8941dc964f6f16173d8361df5aa82869

      SHA1

      22a939449b09d885b0187f8e7c99f40422543808

      SHA256

      62f94f600aeaaa700dddc02bce0dedf1d23f7af2c5d5754515a57f12265476c8

      SHA512

      ea27ea2cfe6952cb8ec41ab315a94f3ea8d028038356ca5c90956a0766d058c54a47492c9f9f84fcd1b7a7c73efb3e324392b826ca9a942e45aedbc655fc5ac5

      Download Submit
    • memory/2668-1-0x0000000000400000-0x00000000007A5000-memory.dmp
      Filesize

      3.6MB

      Download
    • memory/2668-0-0x0000000000400000-0x00000000007A5000-memory.dmp
      Filesize

      3.6MB

      Download
    • memory/2668-22-0x0000000000400000-0x00000000007A5000-memory.dmp
      Filesize

      3.6MB

      Download
    • memory/4080-18-0x00000000765DA000-0x00000000765DB000-memory.dmp
      Filesize

      4KB

      Download
    • memory/4080-23-0x0000000000400000-0x00000000007A5000-memory.dmp
      Filesize

      3.6MB

      Download