Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
10-07-2024 18:56
General
-
Target
2024-07-10_29cd2c391afe7d26c23e12ce7f6979cd_hacktools_xiaoba.exe
-
Size
3.2MB
-
MD5
29cd2c391afe7d26c23e12ce7f6979cd
-
SHA1
46b03c8856830b934656dd20e49edad144bfceef
-
SHA256
43aa1001a1a0bf74d37263f0c7115381b6532934bbcbc43316ce24c5bed0a1ed
-
SHA512
a6b81581503fe39a2b17a51a23108325e91ee8af507c99fe9b55535f14b3c140dc586963888463b9ee298713247cd8a74e82e0ee10e0dd68bb1402312772a301
-
SSDEEP
49152:6zG1BqCBGJdodXAGRe5CFHRoHgmAZf1Nt:DBIKRAGRe5K2UZR
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Program crash 1 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-10_29cd2c391afe7d26c23e12ce7f6979cd_hacktools_xiaoba.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-10_29cd2c391afe7d26c23e12ce7f6979cd_hacktools_xiaoba.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e57ccc6.exeC:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e57ccc6.exe 2406350932⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2872 -s 20563⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2872 -ip 28721⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.2MB
MD55790baec862fa94f218de453b2f2bb75
SHA1e55670b4f42537de621a507db678f3dc145f7536
SHA256e90426ae64463b1a2270bebdd3ba0d594b1a2dba4a3e66f498376147e7a4ca74
SHA512c3912d3decc8672f3701f68b8d73dc391c2894190d621f8b70def53d5c0e3e7a64f0646e000d67d3c99f3cafd94a7632a37ca485070f14bdc11bf017a770bc24
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
4KB
-
Filesize
3.6MB