Analysis
-
max time kernel
117s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
22-05-2024 20:09
General
-
Target
2024-05-22_463d0e5757defbebbbe3c815b4556b07_hacktools_xiaoba.exe
-
Size
3.2MB
-
MD5
463d0e5757defbebbbe3c815b4556b07
-
SHA1
5c1da784c697194398a482903c5df0fbdebae4c7
-
SHA256
43bd7c54f1f6fd3965c13c42da58c74f66837d836fd84ad15740aa1ab8f8e001
-
SHA512
85b0b7dd538f812c589e36d1ca5dd188c52ead8105b3273afb338dcbfccbf2a52c7c3e4656fb5b574f7d0c4b015689a53886118546753109065d112b9598398b
-
SSDEEP
49152:6zG1BqCBGJdodXAGRe5CFHRoHgmAZf1N7:DBIKRAGRe5K2UZX
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 9 IoCs
-
Program crash 1 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_463d0e5757defbebbbe3c815b4556b07_hacktools_xiaoba.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-22_463d0e5757defbebbbe3c815b4556b07_hacktools_xiaoba.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\f7674a3.exeC:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\f7674a3.exe 2594213792⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 6043⤵
- Loads dropped DLL
- Program crash
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.2MB
MD59ab14f0e0c90a23393e7e2db208550ad
SHA168fc6ddd4d200a0c2ef72f65d6b9859751d536e5
SHA2564ae127f6a3869e6d55f067e916b4fea1cd03b94e3fa06547a7cad83cdef35c91
SHA512d2b60cb33d64536b92b5edaf4abec9eb7da917aae6e3078f71a87e167765ad4009d0ad3188f8c3df2cc0bb3ca58dad6051c66ac40ad9213ca1c4ed918f630f6a
-
Filesize
3.6MB
-
Filesize
4KB
-
Filesize
3.6MB
-
Filesize
4KB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB