Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
28/05/2024, 15:42
General
-
Target
2024-05-28_d28fb010cc882d85b77da3777a27a11d_hacktools_xiaoba.exe
-
Size
3.2MB
-
MD5
d28fb010cc882d85b77da3777a27a11d
-
SHA1
6ab0fbc3e10d202030449a959e8a8d419f910299
-
SHA256
adca891ea176ea66c2767919ac82cf84fa236440fece88ed577cc0f26e60937d
-
SHA512
3feb643e97b79908a824340e0d7a534b3308e2d0a49671737f8b49d2f1484e6e0956689563393a4b44e9f3b96040e920f421389abe5e9bed229ef5c47833d40c
-
SSDEEP
49152:6zG1BqCBGJdodXAGRe5CFHRoHgmAZf1N8:DBIKRAGRe5K2UZ4
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 9 IoCs
-
Program crash 1 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-28_d28fb010cc882d85b77da3777a27a11d_hacktools_xiaoba.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-28_d28fb010cc882d85b77da3777a27a11d_hacktools_xiaoba.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\f761584.exeC:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\f761584.exe 2593969962⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1812 -s 6043⤵
- Loads dropped DLL
- Program crash
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.2MB
MD52127ae2ecafc6858d80f679f7e9f2a68
SHA1feab48ff06743f2221e90d42b2379a305bd111bd
SHA256ef8c8b800face6c2b1a9eeb76e74f008003b84c4b63de03973f5ed85abd58e1f
SHA512693e3de63bd0bd275da8da96d636e76c4134474963fdf832b800edf19466a16fe0f1602bf3129135fadd146db033917e1fda1a5d92211f4af5071931bf308e09
-
Filesize
4KB
-
Filesize
3.6MB
-
Filesize
4KB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB