Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
-
submitted
10/07/2024, 18:57
General
-
Target
2024-07-10_2cde54435f51c4045b26690cfad5f3a3_hacktools_xiaoba.exe
-
Size
3.2MB
-
MD5
2cde54435f51c4045b26690cfad5f3a3
-
SHA1
9254808c1f035ac46ffc0d7299dafbf824d7484e
-
SHA256
1cc0271eff4274de65e344877004b2f6a8d37f883b58bb3e3d112b71f2879cbb
-
SHA512
4b654e1934eb29a92aaa881934a451ba18f3c8376d2e2fb4f0073228f1c6e9f4cfced8c09a82b22d2d7444ccd63338b99c69d2fb3bdd697e91723984436c9a99
-
SSDEEP
49152:6zG1BqCBGJdodXAGRe5CFHRoHgmAZf1Nh:DBIKRAGRe5K2UZl
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 9 IoCs
-
Program crash 1 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-10_2cde54435f51c4045b26690cfad5f3a3_hacktools_xiaoba.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-10_2cde54435f51c4045b26690cfad5f3a3_hacktools_xiaoba.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\f76a88f.exeC:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\f76a88f.exe 2594346702⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2100 -s 14523⤵
- Loads dropped DLL
- Program crash
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.2MB
MD5f0731d6b0dd4b4678ec1a8bd312c6f9c
SHA100ab10cd440d197610d1329cd7856d5f5960d207
SHA256686a03caf876eb70ad47e0b0650ffc55a2a8ea5a3150ccd2653154a824ff06cf
SHA5124eb61438db10b07a2925eb673c27551205b19689dd2b23cd2bbc095c9e57b7c369eb6dc9010db4f2b4fd78b17ba7d145a6be060ce3f314d84d69c694e6f6feb4
-
Filesize
4KB
-
Filesize
3.6MB
-
Filesize
4KB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB