971985df1ffb20f23087e02aa628b1416b922235b31dac00f6928a802bc01987

Analysis

max time kernel
134s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29-08-2024 01:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-08-29_5b6097c43891ce1db862703206005ca9_hacktools_xiaoba.exe
Size

3.2MB
MD5

5b6097c43891ce1db862703206005ca9
SHA1

795f3fe2f3136d9a3fc2675bfa1d60f1243c0f16
SHA256

971985df1ffb20f23087e02aa628b1416b922235b31dac00f6928a802bc01987
SHA512

597fe5346ac398c0b2cb1ab6ac04c8a3613c769c489e90ddd5d8d6ae5e2b4e7f669c523f2027aaa3c5c83816fb6c88c0b4d4ad09f7d941fabd68686c5167f7ed
SSDEEP

49152:6zG1BqCBGJdodXAGRe5CFHRoHgmAZf1N9:DBIKRAGRe5K2UZJ

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1188	e577e19.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
516	1188	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e577e19.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-08-29_5b6097c43891ce1db862703206005ca9_hacktools_xiaoba.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4812	2024-08-29_5b6097c43891ce1db862703206005ca9_hacktools_xiaoba.exe
4812	2024-08-29_5b6097c43891ce1db862703206005ca9_hacktools_xiaoba.exe
1188	e577e19.exe
1188	e577e19.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4812 wrote to memory of 1188	4812	2024-08-29_5b6097c43891ce1db862703206005ca9_hacktools_xiaoba.exe	84
PID 4812 wrote to memory of 1188	4812	2024-08-29_5b6097c43891ce1db862703206005ca9_hacktools_xiaoba.exe	84
PID 4812 wrote to memory of 1188	4812	2024-08-29_5b6097c43891ce1db862703206005ca9_hacktools_xiaoba.exe	84

C:\Users\Admin\AppData\Local\Temp\2024-08-29_5b6097c43891ce1db862703206005ca9_hacktools_xiaoba.exe
"C:\Users\Admin\AppData\Local\Temp\2024-08-29_5b6097c43891ce1db862703206005ca9_hacktools_xiaoba.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4812
- C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e577e19.exe
  C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e577e19.exe 240615125
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1188
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1188 -s 2052
    3⤵
    - Program crash
    PID:516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1188 -ip 1188
1⤵
PID:4488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e577e19.exe

Filesize
3.2MB

MD5
6882134472646166a1dedd57fbe75d7c

SHA1
031e3c8ca00a4009ee5024873223fa8ca3bdc9ae

SHA256
775e596d1a73c3dc2cc244d30e558cb2521faf5aba7b1443ce22c5d4c9914723

SHA512
9cbf5b99f7f9f37cfa2a79e41a9409422c6cbc19464c3eb098db404741a372e04ce5e6fa55c3cac35a2e30ad97b711f14d256679ee0bec3e4ca759ae417a2913

Download Submit
memory/1188-16-0x000000007564A000-0x000000007564B000-memory.dmp

Filesize
4KB

Download
memory/1188-21-0x0000000000400000-0x00000000007A5000-memory.dmp

Filesize
3.6MB

Download
memory/4812-0-0x0000000000400000-0x00000000007A5000-memory.dmp

Filesize
3.6MB

Download
memory/4812-1-0x0000000000400000-0x00000000007A5000-memory.dmp

Filesize
3.6MB

Download
memory/4812-20-0x0000000000400000-0x00000000007A5000-memory.dmp

Filesize
3.6MB

Download