Analysis
-
max time kernel
139s -
max time network
108s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
06/06/2024, 20:17
General
-
Target
2024-06-06_cc2b031d1ce509c58ee02c2ce20d71c2_hacktools_xiaoba.exe
-
Size
3.2MB
-
MD5
cc2b031d1ce509c58ee02c2ce20d71c2
-
SHA1
c9ac48d386c6e555e08dc8e145d0e57454050d23
-
SHA256
e7d65d1205e4336949abf492d8c3b49abad76253053d2db4161a6de30b2aa52b
-
SHA512
75a3e1185a14c365cc07fef7e819fbcc1165aea3ba0ba8ff64ff5e4954398e0a7f788952da0fe3b952fea2bf08f9bc613dca8a3163c8e641d217236f38ad2c9c
-
SSDEEP
49152:6zG1BqCBGJdodXAGRe5CFHRoHgmAZf1N+:DBIKRAGRe5K2UZi
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Program crash 1 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-06_cc2b031d1ce509c58ee02c2ce20d71c2_hacktools_xiaoba.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-06_cc2b031d1ce509c58ee02c2ce20d71c2_hacktools_xiaoba.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e5772bf.exeC:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e5772bf.exe 2406120312⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1860 -s 20563⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1860 -ip 18601⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.2MB
MD5cd02fa0e88eeb3c1f4c292e686c11d05
SHA113f231c3e893e65a4778e40990fa69c2fe293372
SHA2569c04127b923c731bc6dd5bc240a26ffd4f6df4a00038faded34a71d083a35c25
SHA51200720f1f06739ffa19cb2f2e64914f46f2ba64076f6ab158cdbcd48c57cf9e64869bc9ab69744c253a8bc44d08e053883f9456c93c2082e243b30ecc433efaba
-
Filesize
3.6MB
-
Filesize
4KB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB