Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    31/05/2024, 15:52

General

  • Target

    2024-05-31_fba5952c01ddfadc5498bd31d77dcd73_hacktools_xiaoba.exe

  • Size

    3.2MB

  • MD5

    fba5952c01ddfadc5498bd31d77dcd73

  • SHA1

    135514416206d9c1530b9c4611b0845011e7a2f7

  • SHA256

    79a0ea8711cd6bb5be07a0bc3630a4c58177501267ffa02492988e073e8c0251

  • SHA512

    52e2f3513bc78bcb6a5087f6298b15ef829cdc761f0f4f709ad54359fae6f7c4debac6157a2ecfd20b77639a31fa7032f7bec89dca366b4f1b2ef95232fc8eaf

  • SSDEEP

    49152:6zG1BqCBGJdodXAGRe5CFHRoHgmAZf1Nk:DBIKRAGRe5K2UZI

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 9 IoCs
  • Program crash 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-31_fba5952c01ddfadc5498bd31d77dcd73_hacktools_xiaoba.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-31_fba5952c01ddfadc5498bd31d77dcd73_hacktools_xiaoba.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2932
    • C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\f7623b6.exe
      C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\f7623b6.exe 259400646
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2452
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2452 -s 580
        3⤵
        • Loads dropped DLL
        • Program crash
        PID:2728

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • \Users\Admin\AppData\Local\Temp\ÅäÖÃ\f7623b6.exe

          Filesize

          3.2MB

          MD5

          55cc7683717d69be9952c55b111cabc5

          SHA1

          a930700beac12a19bfa97462dd6ff508e0675e1c

          SHA256

          df70c36f2ab8a332417564da35ff6ce62c1dae060b9f0d3969d536a88d4fdf8c

          SHA512

          a62a2066658cfb92892f2bf7c1f9791ff772567940aee24e58b602b4fcd5b703603050fe9676ffbade55a28986a5539d23b8f001c00076dd0446e401a0246c99

        • memory/2452-11-0x0000000000400000-0x00000000007A5000-memory.dmp

          Filesize

          3.6MB

        • memory/2452-13-0x000000007699D000-0x000000007699E000-memory.dmp

          Filesize

          4KB

        • memory/2452-43-0x0000000000400000-0x00000000007A5000-memory.dmp

          Filesize

          3.6MB

        • memory/2452-44-0x000000007699D000-0x000000007699E000-memory.dmp

          Filesize

          4KB

        • memory/2932-1-0x0000000000400000-0x00000000007A5000-memory.dmp

          Filesize

          3.6MB

        • memory/2932-0-0x0000000000400000-0x00000000007A5000-memory.dmp

          Filesize

          3.6MB

        • memory/2932-12-0x0000000002A60000-0x0000000002E05000-memory.dmp

          Filesize

          3.6MB

        • memory/2932-32-0x0000000000400000-0x00000000007A5000-memory.dmp

          Filesize

          3.6MB