Analysis
-
max time kernel
94s -
max time network
99s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
10/07/2024, 18:57
General
-
Target
2024-07-10_2cde54435f51c4045b26690cfad5f3a3_hacktools_xiaoba.exe
-
Size
3.2MB
-
MD5
2cde54435f51c4045b26690cfad5f3a3
-
SHA1
9254808c1f035ac46ffc0d7299dafbf824d7484e
-
SHA256
1cc0271eff4274de65e344877004b2f6a8d37f883b58bb3e3d112b71f2879cbb
-
SHA512
4b654e1934eb29a92aaa881934a451ba18f3c8376d2e2fb4f0073228f1c6e9f4cfced8c09a82b22d2d7444ccd63338b99c69d2fb3bdd697e91723984436c9a99
-
SSDEEP
49152:6zG1BqCBGJdodXAGRe5CFHRoHgmAZf1Nh:DBIKRAGRe5K2UZl
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Program crash 1 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-10_2cde54435f51c4045b26690cfad5f3a3_hacktools_xiaoba.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-10_2cde54435f51c4045b26690cfad5f3a3_hacktools_xiaoba.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e57ab05.exeC:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e57ab05.exe 2406265002⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 20563⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 4488 -ip 44881⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.2MB
MD5621f70a88c6f8a0bad7581699ef79c9d
SHA15e8e33f965b9764bedad277eb9688fb086226b96
SHA25653bd27920df884092293ba5b946cd5bcb0c4eab7b2d14194a7e6772b655162cd
SHA512308605c6631ec928871aa4851ba319900c4c4012b36d9c004e02ffddd5816145cc1170e0dfe02fa9e1a6ca3f44e83030635b72765c0eaa11aa2b711e73cfab3a
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
4KB
-
Filesize
3.6MB