Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
-
submitted
23-05-2024 00:42
General
-
Target
2024-05-23_09eba0a370be6a1925447f36f8ab1dfd_hacktools_xiaoba.exe
-
Size
3.2MB
-
MD5
09eba0a370be6a1925447f36f8ab1dfd
-
SHA1
9a4348f7d49af775378fbee0454cf74fcc9aa15e
-
SHA256
3462640f0005835f635d534e2fc9768a2cfd299657e6748ee62d44e066d880d1
-
SHA512
13cfb6f57370d5f23c7d8212240ee2da3be19ed8df9340217cfcc5bfd440b7c115dc213b5db9a16f8c5c5c6d98635301b8d9caf86b3fc070305b0369adcd2106
-
SSDEEP
49152:6zG1BqCBGJdodXAGRe5CFHRoHgmAZf1NZ:DBIKRAGRe5K2UZl
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 9 IoCs
-
Program crash 1 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_09eba0a370be6a1925447f36f8ab1dfd_hacktools_xiaoba.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-23_09eba0a370be6a1925447f36f8ab1dfd_hacktools_xiaoba.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\f761e1b.exeC:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\f761e1b.exe 2593991952⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2196 -s 6123⤵
- Loads dropped DLL
- Program crash
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.2MB
MD5ab584ce5fedac31b0f000e3ce47b905c
SHA13aa6168a558523578a0782c29055623bd4ca5f3b
SHA2567ec1d0f3baced4378026b48c4573cd07b78ef7ed78503f451aeece60686c1182
SHA5122c3e062ace92943ca32051bc8e1f9be88426b05ea44e257eedf181e389228976927039fd02d5a96e4570ae9267c85d3192394c37c375c267983d1e1e76897cca
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
4KB
-
Filesize
3.6MB
-
Filesize
4KB