Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
25-05-2024 03:56
General
-
Target
2024-05-25_d4da04d17ba24e70509b71c4b1a51a2d_hacktools_xiaoba.exe
-
Size
3.2MB
-
MD5
d4da04d17ba24e70509b71c4b1a51a2d
-
SHA1
8bac4020a4b7513aec111daca0e5e7a7fe9c02b5
-
SHA256
1f2db29c2cce3dd181134d1ee644faf07cc39ba079ce69152b45c4703b19f472
-
SHA512
7cb613be047f06f80304de4b429b98bf434194215204ae3a2ef54061183031551693363b9179b88e70fa6775207f075b7e738aec191f4234c42877e06161c10a
-
SSDEEP
49152:6zG1BqCBGJdodXAGRe5CFHRoHgmAZf1NF:DBIKRAGRe5K2UZx
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 9 IoCs
-
Program crash 1 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_d4da04d17ba24e70509b71c4b1a51a2d_hacktools_xiaoba.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-25_d4da04d17ba24e70509b71c4b1a51a2d_hacktools_xiaoba.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\f7638fb.exeC:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\f7638fb.exe 2594060902⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2140 -s 6083⤵
- Loads dropped DLL
- Program crash
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.2MB
MD54ece4e176293b4152172a0dd91de9a4b
SHA1aed19c5e7a9c6b0b5dfaec4e04b41d437582926c
SHA2562335cf2433eba84f6cd10fcc6eba957bc0d3a54757a0badfc930c522a0dfb92d
SHA512e36757fb2f8a6b1265d4c8f6eb81dfffb3982b13064aeaa807c42a76d713cc16be8412ca4b6a5c911f4567c321e33adac7927841964f45804c12702794de1f27
-
Filesize
3.6MB
-
Filesize
4KB
-
Filesize
3.6MB
-
Filesize
4KB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB