Analysis
-
max time kernel
121s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
22-05-2024 01:52
General
-
Target
2024-05-22_7d5ce6a729016608ec358e04c1c996bc_hacktools_xiaoba.exe
-
Size
3.2MB
-
MD5
7d5ce6a729016608ec358e04c1c996bc
-
SHA1
61be46459d368465b50f0cd6398651c93357e55b
-
SHA256
25045d87dbca15e8a0ebb32db6ec7e98dc27f09720767d5b57e498c16dc20f1e
-
SHA512
060a01e7826d2cae66acb818eb444230a2703b7cbdaaf2307e12c5bc0bfdd3ab08b428c269757275fb86a2a309445e89c2a7812a992a14889387a83a63885604
-
SSDEEP
49152:6zG1BqCBGJdodXAGRe5CFHRoHgmAZf1NF:DBIKRAGRe5K2UZZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 9 IoCs
-
Program crash 1 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_7d5ce6a729016608ec358e04c1c996bc_hacktools_xiaoba.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-22_7d5ce6a729016608ec358e04c1c996bc_hacktools_xiaoba.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\f775052.exeC:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\f775052.exe 2594776012⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1820 -s 14523⤵
- Loads dropped DLL
- Program crash
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.2MB
MD5e33dd2dc5ebaa9927713e0ac8f20f2cf
SHA10492a1f6dfedbcaf5b1b65a1ce08fc16c2cfc5b4
SHA25664cd8509b0368f412416d5e65faad6308233a7931e7f4ef27902966bab15d5c5
SHA512e4af71e816137ed784bffa22d9a8d8171e5dffbbea26160cdc7660e647e2da43a86509516b6509240fc1ed038f1b7a30cf261a9f37310932799a48d73c56ca9e
-
Filesize
3.6MB
-
Filesize
4KB
-
Filesize
3.6MB
-
Filesize
4KB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB