Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
23-05-2024 00:34
General
-
Target
2024-05-23_497a1f36c93f4e7e05c6310f5a2f16ef_hacktools_xiaoba.exe
-
Size
3.2MB
-
MD5
497a1f36c93f4e7e05c6310f5a2f16ef
-
SHA1
90c17bbbf34f8920ac5d617c1da383d515d1212a
-
SHA256
a850fd3484fe4f09543dc58b9abc3ab31bce178255c4cc1614dff6317eaa5f09
-
SHA512
2c02f6c7300d3a24f903c0664439d00f00e3b84366c71ad7b711c9fbe4591a9deec70842d9e80c626ddc398faf89521159bd6df4c4972fa9f2fd7b2750822744
-
SSDEEP
49152:6zG1BqCBGJdodXAGRe5CFHRoHgmAZf1N6:DBIKRAGRe5K2UZW
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Program crash 1 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_497a1f36c93f4e7e05c6310f5a2f16ef_hacktools_xiaoba.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-23_497a1f36c93f4e7e05c6310f5a2f16ef_hacktools_xiaoba.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e5756bb.exeC:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e5756bb.exe 2406048752⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1996 -s 20523⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1996 -ip 19961⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.2MB
MD50672ea1f9e802f1416fc6314e643e22a
SHA1c92193c2ad747d7b9d407f17d726ab30f4726b80
SHA256b1dbfbc154418e405b88a185fa2538e21e21c663bef13123c9c7e76b19c2820f
SHA512f3d81940485b8438ea650e2427c66b1d60fe8272c76340168a8c964efa721bfc1ff61ab891297e6329f9347477be7981af7d973d1e6c3cc141490feef9632057
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
4KB
-
Filesize
3.6MB