1dfd1ac9fa65b1da4070627f9861e0cde2c64b00e2fb46c44a75a736bf55ae7f

Analysis

max time kernel
143s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/08/2024, 18:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-08-14_ac0544f6afeb87316c79ff73dceaa688_hacktools_xiaoba.exe
Size

3.2MB
MD5

ac0544f6afeb87316c79ff73dceaa688
SHA1

ac70c71fce429ca97d08926693f4be122aee155d
SHA256

1dfd1ac9fa65b1da4070627f9861e0cde2c64b00e2fb46c44a75a736bf55ae7f
SHA512

f1e1bd2086817e613e8317f49dd7628ff2dfb3b2f996ab8c0d7d940d9a19904a2ffa220e9f3bff5c5a6df60517c1c6113e69b11b4e56ea417b47dccaee910478
SSDEEP

49152:6zG1BqCBGJdodXAGRe5CFHRoHgmAZf1ND:DBIKRAGRe5K2UZP

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1032	e57903a.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4820	1032	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-08-14_ac0544f6afeb87316c79ff73dceaa688_hacktools_xiaoba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e57903a.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5044	2024-08-14_ac0544f6afeb87316c79ff73dceaa688_hacktools_xiaoba.exe
5044	2024-08-14_ac0544f6afeb87316c79ff73dceaa688_hacktools_xiaoba.exe
1032	e57903a.exe
1032	e57903a.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5044 wrote to memory of 1032	5044	2024-08-14_ac0544f6afeb87316c79ff73dceaa688_hacktools_xiaoba.exe	84
PID 5044 wrote to memory of 1032	5044	2024-08-14_ac0544f6afeb87316c79ff73dceaa688_hacktools_xiaoba.exe	84
PID 5044 wrote to memory of 1032	5044	2024-08-14_ac0544f6afeb87316c79ff73dceaa688_hacktools_xiaoba.exe	84

C:\Users\Admin\AppData\Local\Temp\2024-08-14_ac0544f6afeb87316c79ff73dceaa688_hacktools_xiaoba.exe
"C:\Users\Admin\AppData\Local\Temp\2024-08-14_ac0544f6afeb87316c79ff73dceaa688_hacktools_xiaoba.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5044
- C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e57903a.exe
  C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e57903a.exe 240619593
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1032
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1032 -s 2056
    3⤵
    - Program crash
    PID:4820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1032 -ip 1032
1⤵
PID:2144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e57903a.exe

Filesize
3.2MB

MD5
03d9587aad8a5305ba3b3df02883c2f3

SHA1
732c8d37263ca5606f49b263f854f0ea9cf45427

SHA256
abadd2f33644c9c70f74521c8420ed0534e54fb3a29cc73eac9f3633fda0ba66

SHA512
1434fe8b34eb3a7c57b3f401be75d712545425066247b6b5b8f947f4c49b9ca69480bc3c885f7fe844eb3cedeaf1610b1c085655ec8204e15c1e019e1555778d

Download Submit
memory/1032-18-0x0000000075A6A000-0x0000000075A6B000-memory.dmp

Filesize
4KB

Download
memory/1032-23-0x0000000000400000-0x00000000007A5000-memory.dmp

Filesize
3.6MB

Download
memory/5044-0-0x0000000000400000-0x00000000007A5000-memory.dmp

Filesize
3.6MB

Download
memory/5044-1-0x0000000000400000-0x00000000007A5000-memory.dmp

Filesize
3.6MB

Download
memory/5044-22-0x0000000000400000-0x00000000007A5000-memory.dmp

Filesize
3.6MB

Download