Overview

overview

7

Static

static

3

2024-07-01...ba.exe

windows7-x64

7

2024-07-01...ba.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    140s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-07-2024 01:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-07-01_fe2fde5a696e8437d1bfe4dfbeb96815_hacktools_xiaoba.exe

  • Size

    3.2MB

  • MD5

    fe2fde5a696e8437d1bfe4dfbeb96815

  • SHA1

    8fb6ca8a9bc579f1ba9170f94b587c989a6e4043

  • SHA256

    c2fb0368d41cb474da2ffe8483a5212a9847dee1f3ce99695730f5d29ec98ead

  • SHA512

    ee3de2f9608bd8ac2c477a773a319d628c205dec510c31ee26ff3b11cd76884d348048664581938d78a79a81da45de8153459d10577f7851ed6bc633e151f101

  • SSDEEP

    49152:6zG1BqCBGJdodXAGRe5CFHRoHgmAZf1NL:DBIKRAGRe5K2UZH

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Program crash 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-07-01_fe2fde5a696e8437d1bfe4dfbeb96815_hacktools_xiaoba.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-07-01_fe2fde5a696e8437d1bfe4dfbeb96815_hacktools_xiaoba.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2368
    • C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e588354.exe
      C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e588354.exe 240681828
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:2088
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2088 -s 2060
        3⤵
        • Program crash
        PID:1004
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3860 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:2932
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2088 -ip 2088
      1⤵
        PID:2876

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e588354.exe
        Filesize

        3.2MB

        MD5

        e40ff4d5187df93e7519f379c92cef76

        SHA1

        671ea3f2abd8a9d67eca37af89dde6fa34b873d3

        SHA256

        c8e4666f6c105f51b984626190b300c485ec848dfbdeab2e34924528ca16eeab

        SHA512

        8250e99838d6f3311926513e12b88d8040ee5d66988c3f3d2d81f16bcb4d60bb015b85ddff612d409b6df4378ba3fa0f3cd70a3342c7e16b25c49a5552882f2d

        Download Submit

      • memory/2088-11-0x0000000000400000-0x00000000007A5000-memory.dmp

        Filesize

        3.6MB

        Download

      • memory/2088-19-0x0000000076CBA000-0x0000000076CBB000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2088-23-0x0000000000400000-0x00000000007A5000-memory.dmp

        Filesize

        3.6MB

        Download

      • memory/2368-0-0x0000000000400000-0x00000000007A5000-memory.dmp

        Filesize

        3.6MB

        Download

      • memory/2368-1-0x0000000000400000-0x00000000007A5000-memory.dmp

        Filesize

        3.6MB

        Download

      • memory/2368-2-0x0000000000400000-0x00000000007A5000-memory.dmp

        Filesize

        3.6MB

        Download

      • memory/2368-8-0x0000000000400000-0x00000000007A5000-memory.dmp

        Filesize

        3.6MB

        Download