Analysis
-
max time kernel
133s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
23-05-2024 00:27
General
-
Target
2024-05-23_23d74bffb23b7315793698bbc0e997f7_hacktools_xiaoba.exe
-
Size
3.2MB
-
MD5
23d74bffb23b7315793698bbc0e997f7
-
SHA1
e877bd36b9287e6cd1906ee7486ba0df5b4ba245
-
SHA256
7e2dbde01e1ef5a006ecc8a03ce0fbcaafabd207e31367786421ad2009909293
-
SHA512
8fdceff799e180c818d53b5423ba75e295db1dd35121ceaa2f3bfc2249e8c3d37941cfa03316ed439f2efbb71a434f191feb604ab1ad6fbaad620f25c3d9c168
-
SSDEEP
49152:6zG1BqCBGJdodXAGRe5CFHRoHgmAZf1NU:DBIKRAGRe5K2UZY
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Program crash 1 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_23d74bffb23b7315793698bbc0e997f7_hacktools_xiaoba.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-23_23d74bffb23b7315793698bbc0e997f7_hacktools_xiaoba.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e57441d.exeC:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e57441d.exe 2406001092⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1252 -s 20563⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1252 -ip 12521⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.2MB
MD5601122276949208cbf9be435b2443ffc
SHA1af2a8b1bf995cacc4f2567b9ca8ddaafca24b3ee
SHA25679322f387f18f9a71a0b0d00603ab535bbdb448454bd92041f7888e040bae5c0
SHA51205733682ed2da69774f2d87ebac84aa873095938a765af2ff270b812f92e44b27eec985f7a8b8133f282e1db62d97e5035a0cae0b09e775723a0f42b01c4be0a
-
Filesize
3.6MB
-
Filesize
4KB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB