Analysis

  • max time kernel
    120s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    18-08-2024 18:46

General

  • Target

    2024-08-18_17904bde3b77f4c94b9ff10bd0e91a2a_hacktools_xiaoba.exe

  • Size

    3.2MB

  • MD5

    17904bde3b77f4c94b9ff10bd0e91a2a

  • SHA1

    82055187573cbd1f98cc53c11f544ad890caacbd

  • SHA256

    58b66f87c14bb70b113525667163dde3cc591cf929c0ec978779df184b884f08

  • SHA512

    8deb6536b0522668a4adc675b2ffb1cd4a4675c626d9776558a30551ced5320982e8c05b371f0f8515822da928a038bc5e30887d1a2a214ab758665a9923a0a9

  • SSDEEP

    49152:6zG1BqCBGJdodXAGRe5CFHRoHgmAZf1NF:DBIKRAGRe5K2UZJ

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 9 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-08-18_17904bde3b77f4c94b9ff10bd0e91a2a_hacktools_xiaoba.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-08-18_17904bde3b77f4c94b9ff10bd0e91a2a_hacktools_xiaoba.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1792
    • C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\f77422e.exe
      C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\f77422e.exe 259473998
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2328
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2328 -s 596
        3⤵
        • Loads dropped DLL
        • Program crash
        PID:3068

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\ÅäÖÃ\f77422e.exe

    Filesize

    3.2MB

    MD5

    adc69324bc2809edbb6e2361b86ff186

    SHA1

    806172d82ca4d22190d6f0b5d9a8fd993a6a702f

    SHA256

    116a5b5144672e99cdf7a1641c90f1d1b40bf86c4a906a311b66aa01a4ef3607

    SHA512

    0607425ce779e01b0f062fbf824e62d7a412c4ea20e167df130bf8a51979928e333f065f2304b57104512f595eb5823ed108cb1d17290289049a2429cd657f6b

  • memory/1792-0-0x0000000000400000-0x00000000007A5000-memory.dmp

    Filesize

    3.6MB

  • memory/1792-1-0x0000000000400000-0x00000000007A5000-memory.dmp

    Filesize

    3.6MB

  • memory/1792-9-0x0000000003020000-0x00000000033C5000-memory.dmp

    Filesize

    3.6MB

  • memory/1792-11-0x0000000003020000-0x00000000033C5000-memory.dmp

    Filesize

    3.6MB

  • memory/1792-34-0x0000000000400000-0x00000000007A5000-memory.dmp

    Filesize

    3.6MB

  • memory/2328-13-0x0000000075F0D000-0x0000000075F0E000-memory.dmp

    Filesize

    4KB

  • memory/2328-43-0x0000000000400000-0x00000000007A5000-memory.dmp

    Filesize

    3.6MB

  • memory/2328-44-0x0000000075F0D000-0x0000000075F0E000-memory.dmp

    Filesize

    4KB