Analysis
-
max time kernel
122s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
23-05-2024 00:28
General
-
Target
2024-05-23_23fe17a3d65d3be7daff0c7d5b564c68_hacktools_xiaoba.exe
-
Size
3.2MB
-
MD5
23fe17a3d65d3be7daff0c7d5b564c68
-
SHA1
2492d33cb0bdccb3de7906575ce6659a1cc57205
-
SHA256
d177c1b0ed91867e218fdd2b20246ff0e30b2d340c62b2db50ca4cb7168bcb6d
-
SHA512
6f267b50a9843b06b60f4a921944d4ae8a5f00af0fbfa2dbdee0a69ed65570f1164fd2559a6238240f51002e57b72149ad7e352b84f67b147c6ca3dfb778d17b
-
SSDEEP
49152:6zG1BqCBGJdodXAGRe5CFHRoHgmAZf1Nx:DBIKRAGRe5K2UZt
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 9 IoCs
-
Program crash 1 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_23fe17a3d65d3be7daff0c7d5b564c68_hacktools_xiaoba.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-23_23fe17a3d65d3be7daff0c7d5b564c68_hacktools_xiaoba.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\f760e82.exeC:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\f760e82.exe 2593952022⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1652 -s 6003⤵
- Loads dropped DLL
- Program crash
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.2MB
MD54b24373f8a929a7413b688a1effafca7
SHA1a3a39c13a4cf33bd71cec8f825844af61682ee26
SHA2561e77daac7cc8928694601e31a4620f67511d8c63a6aad7b7ea5b21a06c60692d
SHA5125c702355c940e42c553c7d5d8959749a10cd947abf6ba1f716971d9a47fffe508a5e41cfcfe4245d7d9a3d546ea6632781188f48c355da9fcce6868311c445e1
-
Filesize
4KB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
4KB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB