Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
22-05-2024 20:09
General
-
Target
2024-05-22_463d0e5757defbebbbe3c815b4556b07_hacktools_xiaoba.exe
-
Size
3.2MB
-
MD5
463d0e5757defbebbbe3c815b4556b07
-
SHA1
5c1da784c697194398a482903c5df0fbdebae4c7
-
SHA256
43bd7c54f1f6fd3965c13c42da58c74f66837d836fd84ad15740aa1ab8f8e001
-
SHA512
85b0b7dd538f812c589e36d1ca5dd188c52ead8105b3273afb338dcbfccbf2a52c7c3e4656fb5b574f7d0c4b015689a53886118546753109065d112b9598398b
-
SSDEEP
49152:6zG1BqCBGJdodXAGRe5CFHRoHgmAZf1N7:DBIKRAGRe5K2UZX
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Program crash 1 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_463d0e5757defbebbbe3c815b4556b07_hacktools_xiaoba.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-22_463d0e5757defbebbbe3c815b4556b07_hacktools_xiaoba.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e574100.exeC:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e574100.exe 2405993122⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2924 -s 20723⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2924 -ip 29241⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.2MB
MD5558e5a565bf32ed371587ea659c16f51
SHA111a5fa3759f3e6a0c74cfc7bc559a5498ed43081
SHA256e42e687a124bc5bcfae82a6153c0363c14031d34f1bbb14346150bdb690360d7
SHA512ce6b735619f6250c8ace463f8fb2ecb3ebc81da1fd96d684eea1f4909b44280bfa44d510f42e7c6772c86ec19b624d9785a1786075c95c368aeb7d89a6fbf731
-
Filesize
3.6MB
-
Filesize
4KB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB