Analysis
-
max time kernel
134s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
22-05-2024 02:00
General
-
Target
2024-05-22_92e2b2b9ffae532a2c2c6a8a5ceb58fc_hacktools_xiaoba.exe
-
Size
3.2MB
-
MD5
92e2b2b9ffae532a2c2c6a8a5ceb58fc
-
SHA1
f823d25fe8ab4e8b17a3039ab9d8a5342bb76be8
-
SHA256
c02c90a3814b0970c112fd677b84073067b24c460f5d73307a7196066cd7ac0f
-
SHA512
97d0d7d774d0a3798ee3935a4ebea5b0842d5478b515ac18d395366f353c75645a6aaa89d256e1bbdb6bc3455e2b3b878d845cc3dc20bb9dadc83a45dc114f64
-
SSDEEP
49152:6zG1BqCBGJdodXAGRe5CFHRoHgmAZf1NB:DBIKRAGRe5K2UZ1
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Program crash 1 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_92e2b2b9ffae532a2c2c6a8a5ceb58fc_hacktools_xiaoba.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-22_92e2b2b9ffae532a2c2c6a8a5ceb58fc_hacktools_xiaoba.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e572c7e.exeC:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e572c7e.exe 2405944372⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3192 -s 20563⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3192 -ip 31921⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.2MB
MD588327e71318f5a699ae0cbf3a02cd5df
SHA17b95cb9e7c69173aeb45041fed36e47981c3a282
SHA256444abe3062b9d8b1b204e38bb34613a3c36b65f56c59de0788ab12129cceba6c
SHA51271da0feb0b6a653a7081e0591521ccfd053e333c1b09f8a4bdc5d6e076c7b5c17763b20a6e12f7f0d762f6521eb0cc470598e5cedaf60808596490cf0d6568cb
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
4KB
-
Filesize
3.6MB