Analysis
-
max time kernel
149s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05/06/2024, 02:52
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-06-05_20b6034073d947bcb5c4dc9b1708b65d_xiaoba.exe
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-05_20b6034073d947bcb5c4dc9b1708b65d_xiaoba.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
2024-06-05_20b6034073d947bcb5c4dc9b1708b65d_xiaoba.exe
-
Size
1.1MB
-
MD5
20b6034073d947bcb5c4dc9b1708b65d
-
SHA1
7f930b351b506307c827585710140dee5665bab0
-
SHA256
727ace020b0e1f2413b53845072f99d1bd731442e25db5824a63e796fcc0cba8
-
SHA512
228a95a9437007075f3b85d892acbbaf82d43f8d5b3fa335904bcfe11a2bc565fe25c94ab006bcce3ad7554c542ed56ed753c763444b130ce8244fbc2939efc0
-
SSDEEP
24576:kfZanlLXYSKEDRWTg+YeP/YkOqLKBbD6MGY0r:kPSKRM+Y2ZPL2iV
Score
9/10
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 27 IoCs
resource yara_rule behavioral1/memory/2084-0-0x0000000000250000-0x000000000028E000-memory.dmp UPX behavioral1/memory/2084-1-0x0000000000250000-0x000000000028E000-memory.dmp UPX behavioral1/memory/2084-2-0x0000000000250000-0x000000000028E000-memory.dmp UPX behavioral1/memory/2084-46-0x0000000000250000-0x000000000028E000-memory.dmp UPX behavioral1/memory/2084-45-0x0000000000250000-0x000000000028E000-memory.dmp UPX behavioral1/memory/2084-39-0x0000000000250000-0x000000000028E000-memory.dmp UPX behavioral1/memory/2084-37-0x0000000000250000-0x000000000028E000-memory.dmp UPX behavioral1/memory/2084-35-0x0000000000250000-0x000000000028E000-memory.dmp UPX behavioral1/memory/2084-31-0x0000000000250000-0x000000000028E000-memory.dmp UPX behavioral1/memory/2084-29-0x0000000000250000-0x000000000028E000-memory.dmp UPX behavioral1/memory/2084-27-0x0000000000250000-0x000000000028E000-memory.dmp UPX behavioral1/memory/2084-47-0x0000000000250000-0x000000000028E000-memory.dmp UPX behavioral1/memory/2084-44-0x0000000000250000-0x000000000028E000-memory.dmp UPX behavioral1/memory/2084-33-0x0000000000250000-0x000000000028E000-memory.dmp UPX behavioral1/memory/2084-11-0x0000000000250000-0x000000000028E000-memory.dmp UPX behavioral1/memory/2084-9-0x0000000000250000-0x000000000028E000-memory.dmp UPX behavioral1/memory/2084-25-0x0000000000250000-0x000000000028E000-memory.dmp UPX behavioral1/memory/2084-23-0x0000000000250000-0x000000000028E000-memory.dmp UPX behavioral1/memory/2084-7-0x0000000000250000-0x000000000028E000-memory.dmp UPX behavioral1/memory/2084-21-0x0000000000250000-0x000000000028E000-memory.dmp UPX behavioral1/memory/2084-19-0x0000000000250000-0x000000000028E000-memory.dmp UPX behavioral1/memory/2084-17-0x0000000000250000-0x000000000028E000-memory.dmp UPX behavioral1/memory/2084-5-0x0000000000250000-0x000000000028E000-memory.dmp UPX behavioral1/memory/2084-16-0x0000000000250000-0x000000000028E000-memory.dmp UPX behavioral1/memory/2084-13-0x0000000000250000-0x000000000028E000-memory.dmp UPX behavioral1/memory/2084-3-0x0000000000250000-0x000000000028E000-memory.dmp UPX behavioral1/memory/2084-48-0x0000000000250000-0x000000000028E000-memory.dmp UPX -
resource yara_rule behavioral1/memory/2084-0-0x0000000000250000-0x000000000028E000-memory.dmp upx behavioral1/memory/2084-1-0x0000000000250000-0x000000000028E000-memory.dmp upx behavioral1/memory/2084-2-0x0000000000250000-0x000000000028E000-memory.dmp upx behavioral1/memory/2084-46-0x0000000000250000-0x000000000028E000-memory.dmp upx behavioral1/memory/2084-45-0x0000000000250000-0x000000000028E000-memory.dmp upx behavioral1/memory/2084-39-0x0000000000250000-0x000000000028E000-memory.dmp upx behavioral1/memory/2084-37-0x0000000000250000-0x000000000028E000-memory.dmp upx behavioral1/memory/2084-35-0x0000000000250000-0x000000000028E000-memory.dmp upx behavioral1/memory/2084-31-0x0000000000250000-0x000000000028E000-memory.dmp upx behavioral1/memory/2084-29-0x0000000000250000-0x000000000028E000-memory.dmp upx behavioral1/memory/2084-27-0x0000000000250000-0x000000000028E000-memory.dmp upx behavioral1/memory/2084-47-0x0000000000250000-0x000000000028E000-memory.dmp upx behavioral1/memory/2084-44-0x0000000000250000-0x000000000028E000-memory.dmp upx behavioral1/memory/2084-33-0x0000000000250000-0x000000000028E000-memory.dmp upx behavioral1/memory/2084-11-0x0000000000250000-0x000000000028E000-memory.dmp upx behavioral1/memory/2084-9-0x0000000000250000-0x000000000028E000-memory.dmp upx behavioral1/memory/2084-25-0x0000000000250000-0x000000000028E000-memory.dmp upx behavioral1/memory/2084-23-0x0000000000250000-0x000000000028E000-memory.dmp upx behavioral1/memory/2084-7-0x0000000000250000-0x000000000028E000-memory.dmp upx behavioral1/memory/2084-21-0x0000000000250000-0x000000000028E000-memory.dmp upx behavioral1/memory/2084-19-0x0000000000250000-0x000000000028E000-memory.dmp upx behavioral1/memory/2084-17-0x0000000000250000-0x000000000028E000-memory.dmp upx behavioral1/memory/2084-5-0x0000000000250000-0x000000000028E000-memory.dmp upx behavioral1/memory/2084-16-0x0000000000250000-0x000000000028E000-memory.dmp upx behavioral1/memory/2084-13-0x0000000000250000-0x000000000028E000-memory.dmp upx behavioral1/memory/2084-3-0x0000000000250000-0x000000000028E000-memory.dmp upx behavioral1/memory/2084-48-0x0000000000250000-0x000000000028E000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2084 2024-06-05_20b6034073d947bcb5c4dc9b1708b65d_xiaoba.exe 2084 2024-06-05_20b6034073d947bcb5c4dc9b1708b65d_xiaoba.exe 2084 2024-06-05_20b6034073d947bcb5c4dc9b1708b65d_xiaoba.exe 2084 2024-06-05_20b6034073d947bcb5c4dc9b1708b65d_xiaoba.exe 2084 2024-06-05_20b6034073d947bcb5c4dc9b1708b65d_xiaoba.exe 2084 2024-06-05_20b6034073d947bcb5c4dc9b1708b65d_xiaoba.exe 2084 2024-06-05_20b6034073d947bcb5c4dc9b1708b65d_xiaoba.exe 2084 2024-06-05_20b6034073d947bcb5c4dc9b1708b65d_xiaoba.exe 2084 2024-06-05_20b6034073d947bcb5c4dc9b1708b65d_xiaoba.exe 2084 2024-06-05_20b6034073d947bcb5c4dc9b1708b65d_xiaoba.exe 2084 2024-06-05_20b6034073d947bcb5c4dc9b1708b65d_xiaoba.exe 2084 2024-06-05_20b6034073d947bcb5c4dc9b1708b65d_xiaoba.exe 2084 2024-06-05_20b6034073d947bcb5c4dc9b1708b65d_xiaoba.exe 2084 2024-06-05_20b6034073d947bcb5c4dc9b1708b65d_xiaoba.exe 2084 2024-06-05_20b6034073d947bcb5c4dc9b1708b65d_xiaoba.exe 2084 2024-06-05_20b6034073d947bcb5c4dc9b1708b65d_xiaoba.exe 2084 2024-06-05_20b6034073d947bcb5c4dc9b1708b65d_xiaoba.exe 2084 2024-06-05_20b6034073d947bcb5c4dc9b1708b65d_xiaoba.exe 2084 2024-06-05_20b6034073d947bcb5c4dc9b1708b65d_xiaoba.exe 2084 2024-06-05_20b6034073d947bcb5c4dc9b1708b65d_xiaoba.exe 2084 2024-06-05_20b6034073d947bcb5c4dc9b1708b65d_xiaoba.exe 2084 2024-06-05_20b6034073d947bcb5c4dc9b1708b65d_xiaoba.exe 2084 2024-06-05_20b6034073d947bcb5c4dc9b1708b65d_xiaoba.exe 2084 2024-06-05_20b6034073d947bcb5c4dc9b1708b65d_xiaoba.exe 2084 2024-06-05_20b6034073d947bcb5c4dc9b1708b65d_xiaoba.exe 2084 2024-06-05_20b6034073d947bcb5c4dc9b1708b65d_xiaoba.exe 2084 2024-06-05_20b6034073d947bcb5c4dc9b1708b65d_xiaoba.exe 2084 2024-06-05_20b6034073d947bcb5c4dc9b1708b65d_xiaoba.exe 2084 2024-06-05_20b6034073d947bcb5c4dc9b1708b65d_xiaoba.exe 2084 2024-06-05_20b6034073d947bcb5c4dc9b1708b65d_xiaoba.exe 2084 2024-06-05_20b6034073d947bcb5c4dc9b1708b65d_xiaoba.exe 2084 2024-06-05_20b6034073d947bcb5c4dc9b1708b65d_xiaoba.exe 2084 2024-06-05_20b6034073d947bcb5c4dc9b1708b65d_xiaoba.exe 2084 2024-06-05_20b6034073d947bcb5c4dc9b1708b65d_xiaoba.exe 2084 2024-06-05_20b6034073d947bcb5c4dc9b1708b65d_xiaoba.exe 2084 2024-06-05_20b6034073d947bcb5c4dc9b1708b65d_xiaoba.exe 2084 2024-06-05_20b6034073d947bcb5c4dc9b1708b65d_xiaoba.exe 2084 2024-06-05_20b6034073d947bcb5c4dc9b1708b65d_xiaoba.exe 2084 2024-06-05_20b6034073d947bcb5c4dc9b1708b65d_xiaoba.exe 2084 2024-06-05_20b6034073d947bcb5c4dc9b1708b65d_xiaoba.exe 2084 2024-06-05_20b6034073d947bcb5c4dc9b1708b65d_xiaoba.exe 2084 2024-06-05_20b6034073d947bcb5c4dc9b1708b65d_xiaoba.exe 2084 2024-06-05_20b6034073d947bcb5c4dc9b1708b65d_xiaoba.exe 2084 2024-06-05_20b6034073d947bcb5c4dc9b1708b65d_xiaoba.exe 2084 2024-06-05_20b6034073d947bcb5c4dc9b1708b65d_xiaoba.exe 2084 2024-06-05_20b6034073d947bcb5c4dc9b1708b65d_xiaoba.exe 2084 2024-06-05_20b6034073d947bcb5c4dc9b1708b65d_xiaoba.exe 2084 2024-06-05_20b6034073d947bcb5c4dc9b1708b65d_xiaoba.exe 2084 2024-06-05_20b6034073d947bcb5c4dc9b1708b65d_xiaoba.exe 2084 2024-06-05_20b6034073d947bcb5c4dc9b1708b65d_xiaoba.exe 2084 2024-06-05_20b6034073d947bcb5c4dc9b1708b65d_xiaoba.exe 2084 2024-06-05_20b6034073d947bcb5c4dc9b1708b65d_xiaoba.exe 2084 2024-06-05_20b6034073d947bcb5c4dc9b1708b65d_xiaoba.exe 2084 2024-06-05_20b6034073d947bcb5c4dc9b1708b65d_xiaoba.exe 2084 2024-06-05_20b6034073d947bcb5c4dc9b1708b65d_xiaoba.exe 2084 2024-06-05_20b6034073d947bcb5c4dc9b1708b65d_xiaoba.exe 2084 2024-06-05_20b6034073d947bcb5c4dc9b1708b65d_xiaoba.exe 2084 2024-06-05_20b6034073d947bcb5c4dc9b1708b65d_xiaoba.exe 2084 2024-06-05_20b6034073d947bcb5c4dc9b1708b65d_xiaoba.exe 2084 2024-06-05_20b6034073d947bcb5c4dc9b1708b65d_xiaoba.exe 2084 2024-06-05_20b6034073d947bcb5c4dc9b1708b65d_xiaoba.exe 2084 2024-06-05_20b6034073d947bcb5c4dc9b1708b65d_xiaoba.exe 2084 2024-06-05_20b6034073d947bcb5c4dc9b1708b65d_xiaoba.exe 2084 2024-06-05_20b6034073d947bcb5c4dc9b1708b65d_xiaoba.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2084 2024-06-05_20b6034073d947bcb5c4dc9b1708b65d_xiaoba.exe 2084 2024-06-05_20b6034073d947bcb5c4dc9b1708b65d_xiaoba.exe 2084 2024-06-05_20b6034073d947bcb5c4dc9b1708b65d_xiaoba.exe