Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
28/06/2024, 01:38
General
-
Target
2024-06-28_d172aedd06601de9dda26b2b684054bb_hacktools_xiaoba.exe
-
Size
3.2MB
-
MD5
d172aedd06601de9dda26b2b684054bb
-
SHA1
52ce6306f12905ec386694332358fc9ee8f36d96
-
SHA256
d8e0b6457c6f6615dd7936759ccba74d369947c225384e139c8483d175a286be
-
SHA512
a5532a9b8346c01f495ae85db68fb212428a498469ee8785469e09d542e01ac1706f694fa627aa92a8d0916f605d017debf9fbd0f9bb13ffdb44057f19cd12f7
-
SSDEEP
49152:6zG1BqCBGJdodXAGRe5CFHRoHgmAZf1NV:DBIKRAGRe5K2UZR
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 9 IoCs
-
Program crash 1 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-28_d172aedd06601de9dda26b2b684054bb_hacktools_xiaoba.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-28_d172aedd06601de9dda26b2b684054bb_hacktools_xiaoba.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\f76252d.exeC:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\f76252d.exe 2594010052⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2980 -s 6123⤵
- Loads dropped DLL
- Program crash
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.2MB
MD57e6bdaa8765223ef69228630fd46159e
SHA1b11f70077ad7c1e61067a77a6054c2205de37100
SHA25612ce3679cd1bfd4df0ab265c78db471c0d7374ab897ce4cb8884508ab474cbd1
SHA51239b71d1905225a9a900a0f86f6a1c846b645b92bc1eb274b08870bec7979b676652ab778eb32bc56e90d5d5bacf357c194c7cba97844b34f6c1d851b1389e762
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB