Analysis
-
max time kernel
51s -
max time network
57s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
16/06/2024, 20:21
General
-
Target
2024-06-16_dc40d4398cbe59213ad9474274512954_hacktools_xiaoba.exe
-
Size
3.2MB
-
MD5
dc40d4398cbe59213ad9474274512954
-
SHA1
4a16e67b380e7773b5b8d4e31b4a834c7ed376e5
-
SHA256
737a422e6b2c6f63a75da73df3cfbf9922649ad8f03b13787812a5daac3b3b02
-
SHA512
273a99bed89101c478dc730366dbd1d4229eb8518fe1a1d2c336ccefdc63c367b3ef11bf29114ea07cabbd55adc01a1b2a5276d5e738e11e11db180be3673302
-
SSDEEP
49152:6zG1BqCBGJdodXAGRe5CFHRoHgmAZf1N3:DBIKRAGRe5K2UZz
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Program crash 1 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-16_dc40d4398cbe59213ad9474274512954_hacktools_xiaoba.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-16_dc40d4398cbe59213ad9474274512954_hacktools_xiaoba.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e573c1e.exeC:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e573c1e.exe 2405980622⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1092 -s 15563⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1092 -ip 10921⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.2MB
MD5c3982d14f189c2ded7432b3e15c279b5
SHA19cbd47166b4847c7c329cba02bf2588795293bcd
SHA2566bec2b941cad290d7dabf0f2c8cb624f8a6f858d02179a60d67ff1ebd866b197
SHA512df2bfaff83f0300160408558255605a2912d6ba03918f063a4e0ac5be0b0231a9ab8535669fd715bc5e66f6b89cdfffabe8e6198c5f3404c8490f5c7ea5a08e6
-
Filesize
4KB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB