Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
20-06-2024 01:58
General
-
Target
2024-06-20_e91e15678ca0ace19defde13773ab683_hacktools_xiaoba.exe
-
Size
3.2MB
-
MD5
e91e15678ca0ace19defde13773ab683
-
SHA1
49bdccf9c6f2290046c19579c8d53c77c8c3bc62
-
SHA256
3dd558696c57374f712cf775959c0e748c3895a43e15b32b7244023a3cca6584
-
SHA512
3219a1f4ea05a601f3b3f0365ac8d92691a84ddcf1023cbaed690ff52fbb21e4016e0d2388556e2f061ef1443a4433491bd89616f9595dc1d6455bb7ea3a9179
-
SSDEEP
49152:6zG1BqCBGJdodXAGRe5CFHRoHgmAZf1Nc:DBIKRAGRe5K2UZQ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 9 IoCs
-
Program crash 1 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-20_e91e15678ca0ace19defde13773ab683_hacktools_xiaoba.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-20_e91e15678ca0ace19defde13773ab683_hacktools_xiaoba.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\f761f24.exeC:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\f761f24.exe 2593994602⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 320 -s 6003⤵
- Loads dropped DLL
- Program crash
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.2MB
MD521a87cb858266f6cf61e59e3ba444aec
SHA1ba375f8a5c2f2a7d29793a1f9196d0ada462bce0
SHA256efb0804609d332180482ff0647b5be52e1beff9d3225da2e83425d5cfa1aa5da
SHA512c34b5d96c9610bcd71cfce48af8b1cb961b1ea7fc9cccb41e953a3e5b19b9220c7f684e95831779e09e8f8564b71e5c7efab07a5fa43e4b9092a2239683f76c2
-
Filesize
4KB
-
Filesize
3.6MB
-
Filesize
4KB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB