Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
05/06/2024, 10:43
General
-
Target
2024-06-05_0ca93e71c883c7fb21a1e8e348b1adcf_hacktools_xiaoba.exe
-
Size
3.2MB
-
MD5
0ca93e71c883c7fb21a1e8e348b1adcf
-
SHA1
f8bac0d7e5c86d53c0122d90864bbc78891c8a58
-
SHA256
8a6b9937308bfd3b4795cc89b22fce3aac150a2d1531563f576a85a3fb4331bd
-
SHA512
49da9fe7a48e7266218d49e63d8701b68f7b90d9dffb9fde312cf6fa71c0d573812ae2e838306487e61cffdfc718cdda14cb83791726f51e40acda93e67cdf27
-
SSDEEP
49152:6zG1BqCBGJdodXAGRe5CFHRoHgmAZf1Nk:DBIKRAGRe5K2UZY
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Program crash 1 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-05_0ca93e71c883c7fb21a1e8e348b1adcf_hacktools_xiaoba.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-05_0ca93e71c883c7fb21a1e8e348b1adcf_hacktools_xiaoba.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e575331.exeC:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e575331.exe 2406042032⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1688 -s 20523⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1688 -ip 16881⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.2MB
MD5a152275f3375a59dbba90cfe5a7ebcdb
SHA1f35559960f4dac47f1cb32ae4f8d2dc2acc83867
SHA256fd2eb16ab5dba16768b2bd7229d7de0281621dc1fd67bc4b21ae6182990162a3
SHA51217a5c45273408ec9b0da01f0c379c9d00c315d7e00816b475797b9ea283fb30c28396168ccfa03a512653d0847b3cc36aa576a72e4b37c7c63db0f3edcbe3ab3
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
4KB
-
Filesize
3.6MB