Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
09/07/2024, 11:59
General
-
Target
2024-07-09_826c5c908ab09682cf57d52ba487d374_hacktools_xiaoba.exe
-
Size
3.2MB
-
MD5
826c5c908ab09682cf57d52ba487d374
-
SHA1
61fb1dc97ea79c80efdad78de975f57ebcec5692
-
SHA256
fbaf81001f43bc46d735d6c6488e9236b972b602ae65d4686006036876cd21d8
-
SHA512
e0abf74a14ac1678fb02192c9a13922742f0ef5422d38660f1143e3e163c0e01238343cee004bdc341c60bf31f34ae854e1c3ee3e23948ea97128c852bc63d8f
-
SSDEEP
49152:6zG1BqCBGJdodXAGRe5CFHRoHgmAZf1N4:DBIKRAGRe5K2UZk
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 9 IoCs
-
Program crash 1 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-09_826c5c908ab09682cf57d52ba487d374_hacktools_xiaoba.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-09_826c5c908ab09682cf57d52ba487d374_hacktools_xiaoba.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\f76ed7a.exeC:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\f76ed7a.exe 2594522822⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2676 -s 6003⤵
- Loads dropped DLL
- Program crash
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.2MB
MD501eb57114d90c5d6b125d964acde9949
SHA1df293b412605962c73534be756ac464e778fe561
SHA2561fc1073c14ea7711652ff36d32c6a4bc651c9f45c84326233d1bd091725f3629
SHA512ed1638062551c917e76bb9b935d328c53bc412fcb570c7e5d8e42fcb76d083d2287af07aef253602bdbf0dd0cac2f0bf6276cc361d976e2d79717766caf8884d
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
4KB
-
Filesize
3.6MB
-
Filesize
4KB