Overview

overview

7

Static

static

3

2024-06-25...ba.exe

windows7-x64

7

2024-06-25...ba.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    140s
  • max time network
    163s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-06-2024 20:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-06-25_ec68a49d2021cfc194979584b0775d08_hacktools_xiaoba.exe

  • Size

    3.2MB

  • MD5

    ec68a49d2021cfc194979584b0775d08

  • SHA1

    ae28f3d59be13aee9e41c402ec63f9db847e21df

  • SHA256

    d94666c7261ea88fad7d3b2eda8b84ee9c0a18558ef75bbde055a347704eeb83

  • SHA512

    424e42599f7c3f5d2b21ba5c2a5ce573c48685d189ad6690ec293a51a0dc7c3d90f603e618d904def499d9f2e9c8cea70b89dfdf09164c9c766724393f153b9f

  • SSDEEP

    49152:6zG1BqCBGJdodXAGRe5CFHRoHgmAZf1NJ:DBIKRAGRe5K2UZl

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Program crash 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-25_ec68a49d2021cfc194979584b0775d08_hacktools_xiaoba.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-25_ec68a49d2021cfc194979584b0775d08_hacktools_xiaoba.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4740
    • C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e5873c4.exe
      C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e5873c4.exe 240677843
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:3456
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3456 -s 2068
        3⤵
        • Program crash
        PID:3420
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4472 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:4124
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3456 -ip 3456
      1⤵
        PID:628

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e5873c4.exe
        Filesize

        3.2MB

        MD5

        b351fd1af3de0c3f03dbf14050ab87e9

        SHA1

        b4453935baf766e551b3bb12fc5779d72fea9636

        SHA256

        dbaee0d43df48b7ccf65fd125122e0b35b7f024d9ef4b52e56a44bff4bf7c806

        SHA512

        c86b7013a4ef54bd48cd259d0ad69e6d06e5988300dc2cad79ea1c9220c7af2b35345091dd0f7c317123be7095cb0b68b195c4cbb101cdb6a1cc017f4131d3cd

        Download Submit

      • memory/3456-8-0x0000000000400000-0x00000000007A5000-memory.dmp

        Filesize

        3.6MB

        Download

      • memory/3456-18-0x0000000076A9A000-0x0000000076A9B000-memory.dmp

        Filesize

        4KB

        Download

      • memory/3456-22-0x0000000000400000-0x00000000007A5000-memory.dmp

        Filesize

        3.6MB

        Download

      • memory/4740-0-0x0000000000400000-0x00000000007A5000-memory.dmp

        Filesize

        3.6MB

        Download

      • memory/4740-1-0x0000000000400000-0x00000000007A5000-memory.dmp

        Filesize

        3.6MB

        Download

      • memory/4740-7-0x0000000000400000-0x00000000007A5000-memory.dmp

        Filesize

        3.6MB

        Download