Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
22-05-2024 01:52
General
-
Target
2024-05-22_7d5ce6a729016608ec358e04c1c996bc_hacktools_xiaoba.exe
-
Size
3.2MB
-
MD5
7d5ce6a729016608ec358e04c1c996bc
-
SHA1
61be46459d368465b50f0cd6398651c93357e55b
-
SHA256
25045d87dbca15e8a0ebb32db6ec7e98dc27f09720767d5b57e498c16dc20f1e
-
SHA512
060a01e7826d2cae66acb818eb444230a2703b7cbdaaf2307e12c5bc0bfdd3ab08b428c269757275fb86a2a309445e89c2a7812a992a14889387a83a63885604
-
SSDEEP
49152:6zG1BqCBGJdodXAGRe5CFHRoHgmAZf1NF:DBIKRAGRe5K2UZZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Program crash 1 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_7d5ce6a729016608ec358e04c1c996bc_hacktools_xiaoba.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-22_7d5ce6a729016608ec358e04c1c996bc_hacktools_xiaoba.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e5738f2.exeC:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e5738f2.exe 2405972812⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1240 -s 20523⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1240 -ip 12401⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.2MB
MD5293f56a0aa6a49ce35e0e5cdedc57d5d
SHA1c988afea6444a144c8742b87c80ed6f5707ffb9b
SHA25651e8ad45c0b06d525fb4ee8bc34e211aba6797451e326b57d39e8034dd3a30ad
SHA512c255228527c1c1714d7ecbe01bd17e3cfe38aff363aa8b1c9cb37ce536556f72c1100a18613858dc0109dde27687e0ba9b25bffc9e789fbb1a39a9f113babcf4
-
Filesize
3.6MB
-
Filesize
4KB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB