Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
05/06/2024, 10:43
General
-
Target
2024-06-05_0ca93e71c883c7fb21a1e8e348b1adcf_hacktools_xiaoba.exe
-
Size
3.2MB
-
MD5
0ca93e71c883c7fb21a1e8e348b1adcf
-
SHA1
f8bac0d7e5c86d53c0122d90864bbc78891c8a58
-
SHA256
8a6b9937308bfd3b4795cc89b22fce3aac150a2d1531563f576a85a3fb4331bd
-
SHA512
49da9fe7a48e7266218d49e63d8701b68f7b90d9dffb9fde312cf6fa71c0d573812ae2e838306487e61cffdfc718cdda14cb83791726f51e40acda93e67cdf27
-
SSDEEP
49152:6zG1BqCBGJdodXAGRe5CFHRoHgmAZf1Nk:DBIKRAGRe5K2UZY
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 9 IoCs
-
Program crash 1 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-05_0ca93e71c883c7fb21a1e8e348b1adcf_hacktools_xiaoba.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-05_0ca93e71c883c7fb21a1e8e348b1adcf_hacktools_xiaoba.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\f761ee6.exeC:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\f761ee6.exe 2593994142⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2240 -s 6003⤵
- Loads dropped DLL
- Program crash
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.2MB
MD587f572baf13d5e4d550d2b84c34ffc6a
SHA14be5a71e9866e277b8819cfafe54de964de9c886
SHA25627ab488f3c4bdb551eba15c1492a9c9968251bd9312b5cfbdfb6507ba406429a
SHA5127cdf625bb24d701d287f157008ae82cdff236eb0eb528f41799fea831b6e550f02d021cbd7b18ce647c82dee073a82309b5bbb843cf4f9af6faf97ad423944a5
-
Filesize
3.6MB
-
Filesize
4KB
-
Filesize
3.6MB
-
Filesize
4KB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB