Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
10/07/2024, 08:26
General
-
Target
2024-07-10_526e0656fad8028d47d521af42b75593_hacktools_xiaoba.exe
-
Size
3.2MB
-
MD5
526e0656fad8028d47d521af42b75593
-
SHA1
edb27d124cce8ea126d7741b046bca98b49ec14e
-
SHA256
d0ef4b2ab58fe462b4eb6c019042be40242cf34ff9cd995ed93ac4cc90fa4862
-
SHA512
6ad31449721c86c130a2b3bcee94bb921dcf066f6f47b990c68808ac16794cf6946e68ccc767bc793fb9c15c3c18f6bc0b06a1fa032c219cab62464709e10092
-
SSDEEP
49152:6zG1BqCBGJdodXAGRe5CFHRoHgmAZf1NW:DBIKRAGRe5K2UZq
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 9 IoCs
-
Program crash 1 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-10_526e0656fad8028d47d521af42b75593_hacktools_xiaoba.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-10_526e0656fad8028d47d521af42b75593_hacktools_xiaoba.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\f76e5cd.exeC:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\f76e5cd.exe 2594503322⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 5923⤵
- Loads dropped DLL
- Program crash
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.2MB
MD5a7638b6bdeccb3ada9f0e3d8407a1655
SHA1400bba89c9a58c9686346fd2aaad39cd6f897664
SHA2562c0d6c135fb64e76383f7970aab3a2c6be1410e7f27f7293c6809a2dd87360b6
SHA51271160efbcbdab95455109c21bb0366fbd4b42953ad45ea5f07b1959c935106b71542a98e9c009f5688417911f37904045c77673a96441efcef8683fd7fd021cc
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
4KB
-
Filesize
3.6MB
-
Filesize
4KB