19dc325e6559c15f26d8c6d987f622ed3d5ba3d119ab511607528a34264c1dc7

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02-09-2024 23:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-09-02_07e9520d990fcee0baf3b086ea2003eb_xiaoba.exe
Size

1.1MB
MD5

07e9520d990fcee0baf3b086ea2003eb
SHA1

6e9bb31175447774b52ce642d59c4b73bb26d868
SHA256

19dc325e6559c15f26d8c6d987f622ed3d5ba3d119ab511607528a34264c1dc7
SHA512

54532623abd0c57343db0dd1c7eb1f9262fb63188e208171405afeb32406358f6a45228400df341ee3dbdde2ca58dfa90f19b3901379859d241bb41f0d2c232c
SSDEEP

24576:m4d++MTGqgw32ccdl/al3C+qJSbvz1YuG3n:nYTrcday+2Smu4

Score

7^/10

discovery upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x00090000000233cc-2.dat	acprotect

Loads dropped DLL 1 IoCs

pid	Process
1564	2024-09-02_07e9520d990fcee0baf3b086ea2003eb_xiaoba.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x00090000000233cc-2.dat	upx
behavioral2/memory/1564-5-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1564-9-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1564-8-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1564-12-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1564-11-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1564-54-0x0000000010000000-0x000000001003E000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\jedata.dll	2024-09-02_07e9520d990fcee0baf3b086ea2003eb_xiaoba.exe
File created	C:\Windows\win8.she	2024-09-02_07e9520d990fcee0baf3b086ea2003eb_xiaoba.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-09-02_07e9520d990fcee0baf3b086ea2003eb_xiaoba.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3932	msedge.exe
3932	msedge.exe
3784	msedge.exe
3784	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3784	msedge.exe
3784	msedge.exe
3784	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3784	msedge.exe
3784	msedge.exe
3784	msedge.exe
3784	msedge.exe
3784	msedge.exe
3784	msedge.exe
3784	msedge.exe
3784	msedge.exe
3784	msedge.exe
3784	msedge.exe
3784	msedge.exe
3784	msedge.exe
3784	msedge.exe
3784	msedge.exe
3784	msedge.exe
3784	msedge.exe
3784	msedge.exe
3784	msedge.exe
3784	msedge.exe
3784	msedge.exe
3784	msedge.exe
3784	msedge.exe
3784	msedge.exe
3784	msedge.exe
3784	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3784	msedge.exe
3784	msedge.exe
3784	msedge.exe
3784	msedge.exe
3784	msedge.exe
3784	msedge.exe
3784	msedge.exe
3784	msedge.exe
3784	msedge.exe
3784	msedge.exe
3784	msedge.exe
3784	msedge.exe
3784	msedge.exe
3784	msedge.exe
3784	msedge.exe
3784	msedge.exe
3784	msedge.exe
3784	msedge.exe
3784	msedge.exe
3784	msedge.exe
3784	msedge.exe
3784	msedge.exe
3784	msedge.exe
3784	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1564	2024-09-02_07e9520d990fcee0baf3b086ea2003eb_xiaoba.exe
1564	2024-09-02_07e9520d990fcee0baf3b086ea2003eb_xiaoba.exe
1564	2024-09-02_07e9520d990fcee0baf3b086ea2003eb_xiaoba.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1564 wrote to memory of 3784	1564	2024-09-02_07e9520d990fcee0baf3b086ea2003eb_xiaoba.exe	86
PID 1564 wrote to memory of 3784	1564	2024-09-02_07e9520d990fcee0baf3b086ea2003eb_xiaoba.exe	86
PID 3784 wrote to memory of 1060	3784	msedge.exe	87
PID 3784 wrote to memory of 1060	3784	msedge.exe	87
PID 3784 wrote to memory of 2856	3784	msedge.exe	88
PID 3784 wrote to memory of 2856	3784	msedge.exe	88
PID 3784 wrote to memory of 2856	3784	msedge.exe	88
PID 3784 wrote to memory of 2856	3784	msedge.exe	88
PID 3784 wrote to memory of 2856	3784	msedge.exe	88
PID 3784 wrote to memory of 2856	3784	msedge.exe	88
PID 3784 wrote to memory of 2856	3784	msedge.exe	88
PID 3784 wrote to memory of 2856	3784	msedge.exe	88
PID 3784 wrote to memory of 2856	3784	msedge.exe	88
PID 3784 wrote to memory of 2856	3784	msedge.exe	88
PID 3784 wrote to memory of 2856	3784	msedge.exe	88
PID 3784 wrote to memory of 2856	3784	msedge.exe	88
PID 3784 wrote to memory of 2856	3784	msedge.exe	88
PID 3784 wrote to memory of 2856	3784	msedge.exe	88
PID 3784 wrote to memory of 2856	3784	msedge.exe	88
PID 3784 wrote to memory of 2856	3784	msedge.exe	88
PID 3784 wrote to memory of 2856	3784	msedge.exe	88
PID 3784 wrote to memory of 2856	3784	msedge.exe	88
PID 3784 wrote to memory of 2856	3784	msedge.exe	88
PID 3784 wrote to memory of 2856	3784	msedge.exe	88
PID 3784 wrote to memory of 2856	3784	msedge.exe	88
PID 3784 wrote to memory of 2856	3784	msedge.exe	88
PID 3784 wrote to memory of 2856	3784	msedge.exe	88
PID 3784 wrote to memory of 2856	3784	msedge.exe	88
PID 3784 wrote to memory of 2856	3784	msedge.exe	88
PID 3784 wrote to memory of 2856	3784	msedge.exe	88
PID 3784 wrote to memory of 2856	3784	msedge.exe	88
PID 3784 wrote to memory of 2856	3784	msedge.exe	88
PID 3784 wrote to memory of 2856	3784	msedge.exe	88
PID 3784 wrote to memory of 2856	3784	msedge.exe	88
PID 3784 wrote to memory of 2856	3784	msedge.exe	88
PID 3784 wrote to memory of 2856	3784	msedge.exe	88
PID 3784 wrote to memory of 2856	3784	msedge.exe	88
PID 3784 wrote to memory of 2856	3784	msedge.exe	88
PID 3784 wrote to memory of 2856	3784	msedge.exe	88
PID 3784 wrote to memory of 2856	3784	msedge.exe	88
PID 3784 wrote to memory of 2856	3784	msedge.exe	88
PID 3784 wrote to memory of 2856	3784	msedge.exe	88
PID 3784 wrote to memory of 2856	3784	msedge.exe	88
PID 3784 wrote to memory of 2856	3784	msedge.exe	88
PID 3784 wrote to memory of 3932	3784	msedge.exe	89
PID 3784 wrote to memory of 3932	3784	msedge.exe	89
PID 3784 wrote to memory of 2404	3784	msedge.exe	90
PID 3784 wrote to memory of 2404	3784	msedge.exe	90
PID 3784 wrote to memory of 2404	3784	msedge.exe	90
PID 3784 wrote to memory of 2404	3784	msedge.exe	90
PID 3784 wrote to memory of 2404	3784	msedge.exe	90
PID 3784 wrote to memory of 2404	3784	msedge.exe	90
PID 3784 wrote to memory of 2404	3784	msedge.exe	90
PID 3784 wrote to memory of 2404	3784	msedge.exe	90
PID 3784 wrote to memory of 2404	3784	msedge.exe	90
PID 3784 wrote to memory of 2404	3784	msedge.exe	90
PID 3784 wrote to memory of 2404	3784	msedge.exe	90
PID 3784 wrote to memory of 2404	3784	msedge.exe	90
PID 3784 wrote to memory of 2404	3784	msedge.exe	90
PID 3784 wrote to memory of 2404	3784	msedge.exe	90
PID 3784 wrote to memory of 2404	3784	msedge.exe	90
PID 3784 wrote to memory of 2404	3784	msedge.exe	90
PID 3784 wrote to memory of 2404	3784	msedge.exe	90
PID 3784 wrote to memory of 2404	3784	msedge.exe	90

C:\Users\Admin\AppData\Local\Temp\2024-09-02_07e9520d990fcee0baf3b086ea2003eb_xiaoba.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-02_07e9520d990fcee0baf3b086ea2003eb_xiaoba.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.2345.com/?k85724502
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbf06046f8,0x7ffbf0604708,0x7ffbf0604718
    3⤵
    PID:1060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,6300023251957863859,11182111051645719781,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:2
    3⤵
    PID:2856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2196,6300023251957863859,11182111051645719781,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2196,6300023251957863859,11182111051645719781,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
    3⤵
    PID:2404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,6300023251957863859,11182111051645719781,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
    3⤵
    PID:4720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,6300023251957863859,11182111051645719781,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
    3⤵
    PID:4464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,6300023251957863859,11182111051645719781,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
    3⤵
    PID:3120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,6300023251957863859,11182111051645719781,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5136 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4004

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2408

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
9f260f4f35cfd2d70b724544822927e9

SHA1
e299c9bfb46f2dadc960755f66e452f587963087

SHA256
b27acbc39e60d3a3c528a90f528c241bf81464addf49e275c1eabe78a38ac819

SHA512
2930f9e16c5161b865709a673f39aba488697237f7c3e54ec94c347dbf710db1dd44bff1bc9f4f1d5e2b528ec4221867f4dfd2d80757a4ac998ccfbba4f83599

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
260B

MD5
89559be240eada4fd38d28c3eea50f82

SHA1
d3989812b7e702d51b4d73324ed67a209dbe07b9

SHA256
c339a3294aa1d9a4236d9ee9db68d3b61aee812905a367fb49722e1597cc781d

SHA512
86d0264d205809f34a8d08e1814921d842f7b40c30935e6492e6d30afb0af1573aad1507452fb15b81cf28aa9943b699f2d6de1efd38d4ae776bcd6e13244e74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
878fabe0039d50eb3b70eb5e2160cbc3

SHA1
e63a4664afc905200f3da4a53d036fe8550870f4

SHA256
05d93c8dfb9fc929011d34f6840ca7da7c2439964a000e6e678084d1048cf90f

SHA512
5040bb4b4b9b135eaadba3044fdcb192379b91f02365633f31f8e67e52352bc432e25c9152c9d46f16002b7f558efa02f5f07275dc8587829be6b277b912cebe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
279a0d1f4e9379d508d042bc65858b2b

SHA1
6be437fb87b9d143a4d8359f5e57849a90acf872

SHA256
1ea7c633ef56ea2189691eea0fa54a8d4f52da1359bf15af7a2f8e9ba63867fb

SHA512
5e98c16c0917ee3c4be8b664d5963f62c2127f53687e2abd3fd13e57ee5b699304db81294211a55481f1dd7f2d7b8054d11aa2e9dc884a0389f0d45503105945

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
6966b7dcec795d5842dd446e2be49e50

SHA1
36262715d101e42da5d168f77ebedfd8371b6bac

SHA256
b63295ae36eacacfe856eb31fb77735829307d543b9dae010529f4a074cfdad8

SHA512
3cbf7a52da0268315f368b2971c8e462144d252881fa1b407adcdb2359845a06521c9564964d93ed31acadaed4c4668af1ac89560662d6b8dd5111b8007713e6

Download Submit
C:\Windows\jedata.dll

Filesize
86KB

MD5
114054313070472cd1a6d7d28f7c5002

SHA1
9a044986e6101df1a126035da7326a50c3fe9a23

SHA256
e15d9e1b772fed3db19e67b8d54533d1a2d46a37f8b12702a5892c6b886e9db1

SHA512
a2ff8481e89698dae4a1c83404105093472e384d7a3debbd7014e010543e08efc8ebb3f67c8a4ce09029e6b2a8fb7779bb402aae7c9987e61389cd8a72c73522

Download Submit
memory/1564-8-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1564-11-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1564-54-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1564-55-0x0000000010009000-0x000000001000A000-memory.dmp

Filesize
4KB

Download
memory/1564-12-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1564-9-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1564-7-0x0000000010009000-0x000000001000A000-memory.dmp

Filesize
4KB

Download
memory/1564-5-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download