Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
23-05-2024 00:42
General
-
Target
2024-05-23_09eba0a370be6a1925447f36f8ab1dfd_hacktools_xiaoba.exe
-
Size
3.2MB
-
MD5
09eba0a370be6a1925447f36f8ab1dfd
-
SHA1
9a4348f7d49af775378fbee0454cf74fcc9aa15e
-
SHA256
3462640f0005835f635d534e2fc9768a2cfd299657e6748ee62d44e066d880d1
-
SHA512
13cfb6f57370d5f23c7d8212240ee2da3be19ed8df9340217cfcc5bfd440b7c115dc213b5db9a16f8c5c5c6d98635301b8d9caf86b3fc070305b0369adcd2106
-
SSDEEP
49152:6zG1BqCBGJdodXAGRe5CFHRoHgmAZf1NZ:DBIKRAGRe5K2UZl
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Program crash 1 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_09eba0a370be6a1925447f36f8ab1dfd_hacktools_xiaoba.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-23_09eba0a370be6a1925447f36f8ab1dfd_hacktools_xiaoba.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e5769a7.exeC:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e5769a7.exe 2406097182⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1284 -s 20683⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1284 -ip 12841⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.2MB
MD59c0087df8f47fc3086db70174b7c940f
SHA1540e50508bd594c4a23bd31824b4b72189f8c081
SHA25605c9fa203556af08ddabf112d82b741c84c7f40ce01addc47de7d05b2b018059
SHA5120d419f5e49f97d73b6f3b2505757eb8e27f86195c83e11dbfe5d1a9e5352fc07796a7b3a40529b2da5a9a4db11ea31f0c44efe5eec785f3cbb3c44aaf4a33180
-
Filesize
3.6MB
-
Filesize
4KB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB