Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
30/05/2024, 04:12
General
-
Target
2024-05-30_72dde6246e4f4478276624c8b83638e7_hacktools_xiaoba.exe
-
Size
3.2MB
-
MD5
72dde6246e4f4478276624c8b83638e7
-
SHA1
6772b2b7fe94ea30ad29735735620611ccda0dd1
-
SHA256
a671d33e8f87cb94a94d2591dce5db620140d960d23869746a3fc8f8d915457b
-
SHA512
d2eb9ab4b494ab06f8ddc1f05afc813bb8a04da449ce92acfd666a39d7face2084216ac9b293e341ce0136e9c339278f5dd3add36451f77d630b8476ed4c3b72
-
SSDEEP
49152:6zG1BqCBGJdodXAGRe5CFHRoHgmAZf1NS:DBIKRAGRe5K2UZe
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 9 IoCs
-
Program crash 1 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-30_72dde6246e4f4478276624c8b83638e7_hacktools_xiaoba.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-30_72dde6246e4f4478276624c8b83638e7_hacktools_xiaoba.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\f76146b.exeC:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\f76146b.exe 2593967152⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2324 -s 6003⤵
- Loads dropped DLL
- Program crash
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.2MB
MD58a323a0b6af76615b24c4a1381434cd8
SHA12a64dfe1ef8ac5fd2a2e084bd15ed44513947e91
SHA256c228355544d22670ac9ffdca4544f7f5352b5e4b131f50ab4ce2417d3c961e55
SHA512a5433c6889ec656c82aa58d316c7018ae8a1ea5286df4bf340fc7e1edcc865301fc6e0168991c97afc0950b5943efe22da2db845261d4af81e4aff7ed5a62382
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
4KB
-
Filesize
3.6MB
-
Filesize
4KB