Analysis

  • max time kernel
    139s
  • max time network
    161s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/05/2024, 15:52

General

  • Target

    2024-05-31_fba5952c01ddfadc5498bd31d77dcd73_hacktools_xiaoba.exe

  • Size

    3.2MB

  • MD5

    fba5952c01ddfadc5498bd31d77dcd73

  • SHA1

    135514416206d9c1530b9c4611b0845011e7a2f7

  • SHA256

    79a0ea8711cd6bb5be07a0bc3630a4c58177501267ffa02492988e073e8c0251

  • SHA512

    52e2f3513bc78bcb6a5087f6298b15ef829cdc761f0f4f709ad54359fae6f7c4debac6157a2ecfd20b77639a31fa7032f7bec89dca366b4f1b2ef95232fc8eaf

  • SSDEEP

    49152:6zG1BqCBGJdodXAGRe5CFHRoHgmAZf1Nk:DBIKRAGRe5K2UZI

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Program crash 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-31_fba5952c01ddfadc5498bd31d77dcd73_hacktools_xiaoba.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-31_fba5952c01ddfadc5498bd31d77dcd73_hacktools_xiaoba.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3604
    • C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e57f760.exe
      C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e57f760.exe 240646000
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:100
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 100 -s 2052
        3⤵
        • Program crash
        PID:1328
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 180 -p 100 -ip 100
    1⤵
      PID:3292
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4036 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:8
      1⤵
        PID:4116

      Network

            MITRE ATT&CK Matrix

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e57f760.exe

              Filesize

              3.2MB

              MD5

              7c9bd7c4f0728d414eda5b336ada4f08

              SHA1

              d4f7692fd2d5324a02dd112c3fb91219d9763db2

              SHA256

              2be76055be03f5c487a47cd999957678687732daad50bfbae1a3ddc1b5f2f2f5

              SHA512

              7e34d0126fa1050dad56619abea51631470ed043928c741b322934f65b9ac35b375038277443418af9c095a72c87143430c1866e3332693e399780b673df0011

            • memory/100-17-0x000000007589A000-0x000000007589B000-memory.dmp

              Filesize

              4KB

            • memory/100-21-0x0000000000400000-0x00000000007A5000-memory.dmp

              Filesize

              3.6MB

            • memory/3604-0-0x0000000000400000-0x00000000007A5000-memory.dmp

              Filesize

              3.6MB

            • memory/3604-1-0x0000000000400000-0x00000000007A5000-memory.dmp

              Filesize

              3.6MB

            • memory/3604-7-0x0000000000400000-0x00000000007A5000-memory.dmp

              Filesize

              3.6MB