Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
06/07/2024, 01:27
General
-
Target
2024-07-06_36c20ca1dca27532bf2059d552ed1bdc_hacktools_xiaoba.exe
-
Size
3.2MB
-
MD5
36c20ca1dca27532bf2059d552ed1bdc
-
SHA1
6991aa213a03e9d744c0a9331cc59231bf3d1605
-
SHA256
1995fa580442929c9f3c9bd7967492cfcc8030bbe51d029b049c2e62c67bfc9e
-
SHA512
2371f76311454ceebe95b1045a2e1a12c25c23256d3911a0ce6c306f9390a28e02ae986cea472ec6606a59bcc50f41e2d501d1a6d913b468605374955edeb5c8
-
SSDEEP
49152:6zG1BqCBGJdodXAGRe5CFHRoHgmAZf1Nr:DBIKRAGRe5K2UZv
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 9 IoCs
-
Program crash 1 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-06_36c20ca1dca27532bf2059d552ed1bdc_hacktools_xiaoba.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-06_36c20ca1dca27532bf2059d552ed1bdc_hacktools_xiaoba.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\f76142c.exeC:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\f76142c.exe 2593966682⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 8283⤵
- Loads dropped DLL
- Program crash
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.2MB
MD5e72a38734f9940b1cee3039f7907f86c
SHA106a3a564b9f6d90617f409fad2b4c8eaab06f48a
SHA2561f148af1b9f87ea2e3c17b81533d9298c5ee4c953b31e2d2273a6211a2607f94
SHA512f15d8e429a8e3dcc8f00e5c2654d34b95135863dd49d9fd2de14388264ebc44accbf680979b08e8c4458ad5f2f61b9ede2ca40c8ab65aa6d13b5dd4f8c028742
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
4KB
-
Filesize
3.6MB
-
Filesize
4KB