812272d75f25d1ff9c7d2365c8794b8322141f0308e90724331a36a6e0a1eb7d

Analysis

max time kernel
138s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09/08/2024, 19:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-08-09_fff7ea06bb25011c3b9e28cfc0dda456_hacktools_xiaoba.exe
Size

3.2MB
MD5

fff7ea06bb25011c3b9e28cfc0dda456
SHA1

1ceb77f3375449d2d922ebf6f027abd150ab9a96
SHA256

812272d75f25d1ff9c7d2365c8794b8322141f0308e90724331a36a6e0a1eb7d
SHA512

0002f9de548b196a9c4d17584eed3922ee0ffb5754a64311e2a67b8c018d2766b05fa43384da065bbc822657e852776791b381595034e445cb8c8d3849a6d879
SSDEEP

49152:6zG1BqCBGJdodXAGRe5CFHRoHgmAZf1NX:DBIKRAGRe5K2UZD

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
892	e5781f1.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3480	892	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-08-09_fff7ea06bb25011c3b9e28cfc0dda456_hacktools_xiaoba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e5781f1.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3444	2024-08-09_fff7ea06bb25011c3b9e28cfc0dda456_hacktools_xiaoba.exe
3444	2024-08-09_fff7ea06bb25011c3b9e28cfc0dda456_hacktools_xiaoba.exe
892	e5781f1.exe
892	e5781f1.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3444 wrote to memory of 892	3444	2024-08-09_fff7ea06bb25011c3b9e28cfc0dda456_hacktools_xiaoba.exe	83
PID 3444 wrote to memory of 892	3444	2024-08-09_fff7ea06bb25011c3b9e28cfc0dda456_hacktools_xiaoba.exe	83
PID 3444 wrote to memory of 892	3444	2024-08-09_fff7ea06bb25011c3b9e28cfc0dda456_hacktools_xiaoba.exe	83

C:\Users\Admin\AppData\Local\Temp\2024-08-09_fff7ea06bb25011c3b9e28cfc0dda456_hacktools_xiaoba.exe
"C:\Users\Admin\AppData\Local\Temp\2024-08-09_fff7ea06bb25011c3b9e28cfc0dda456_hacktools_xiaoba.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3444
- C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e5781f1.exe
  C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e5781f1.exe 240615937
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:892
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 892 -s 2072
    3⤵
    - Program crash
    PID:3480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 208 -p 892 -ip 892
1⤵
PID:4268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e5781f1.exe

Filesize
3.2MB

MD5
102202bed84d349a9ae6d34f31d0f3cb

SHA1
f248a6eb19b0185e8d29f4af38eb3f605da0e884

SHA256
03616be4932d3b701d8d05c030888437903f92c2b579aa65159f764b815d2166

SHA512
f14ec97de01915b0dc214af2b6b162cbbffc80dc82380846d6040dd1a3fd95f79846c45211354098f4ee876d8cd3d9d4de317caea5b1d732631f4fb49ce3da03

Download Submit
memory/892-7-0x0000000000400000-0x00000000007A5000-memory.dmp

Filesize
3.6MB

Download
memory/892-19-0x00000000770CA000-0x00000000770CB000-memory.dmp

Filesize
4KB

Download
memory/892-24-0x0000000000400000-0x00000000007A5000-memory.dmp

Filesize
3.6MB

Download
memory/3444-0-0x0000000000400000-0x00000000007A5000-memory.dmp

Filesize
3.6MB

Download
memory/3444-1-0x0000000000400000-0x00000000007A5000-memory.dmp

Filesize
3.6MB

Download
memory/3444-23-0x0000000000400000-0x00000000007A5000-memory.dmp

Filesize
3.6MB

Download