d060b669be8c266898f30f2432e6e9969cbc4a133bbf6a8e454ba956c8f029ff

Analysis

max time kernel
93s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/09/2024, 07:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-09-03_694c45647bffc02a07619a7b083820ab_hacktools_xiaoba.exe
Size

3.2MB
MD5

694c45647bffc02a07619a7b083820ab
SHA1

19923f0f5ca2822b6c71d23532b9e15dc94c8110
SHA256

d060b669be8c266898f30f2432e6e9969cbc4a133bbf6a8e454ba956c8f029ff
SHA512

8459cf4812447c8b08077099a7acb01d637c77eca9b1e4824ac3b2332104761f85fe64c24f1affe380b1a86a700482e1598f38b9260470ce8f912e841f60660b
SSDEEP

49152:6zG1BqCBGJdodXAGRe5CFHRoHgmAZf1NR:DBIKRAGRe5K2UZt

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
756	e5760bd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4232	756	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-09-03_694c45647bffc02a07619a7b083820ab_hacktools_xiaoba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e5760bd.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4760	2024-09-03_694c45647bffc02a07619a7b083820ab_hacktools_xiaoba.exe
4760	2024-09-03_694c45647bffc02a07619a7b083820ab_hacktools_xiaoba.exe
756	e5760bd.exe
756	e5760bd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4760 wrote to memory of 756	4760	2024-09-03_694c45647bffc02a07619a7b083820ab_hacktools_xiaoba.exe	84
PID 4760 wrote to memory of 756	4760	2024-09-03_694c45647bffc02a07619a7b083820ab_hacktools_xiaoba.exe	84
PID 4760 wrote to memory of 756	4760	2024-09-03_694c45647bffc02a07619a7b083820ab_hacktools_xiaoba.exe	84

C:\Users\Admin\AppData\Local\Temp\2024-09-03_694c45647bffc02a07619a7b083820ab_hacktools_xiaoba.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-03_694c45647bffc02a07619a7b083820ab_hacktools_xiaoba.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4760
- C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e5760bd.exe
  C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e5760bd.exe 240607453
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:756
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 756 -s 2052
    3⤵
    - Program crash
    PID:4232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 756 -ip 756
1⤵
PID:1964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e5760bd.exe

Filesize
3.2MB

MD5
06bad118189602f4595b417fa18f19e8

SHA1
c1155e12082a30d2150debd0ac5b0a860e8759c7

SHA256
3b792356f5c9f538f9d4b5f5f91fbfa6ab2489839613b8f374ca6ba85fb7ab9b

SHA512
8e0a47f9e5e2375468623bcae4c1fea4ef671161ebf156e1aa68f5b30d992977fd532b50533fee66457d620b79f4ae540662e6ea9fb9b4f0517bfd6e95f31bd4

Download Submit
memory/756-16-0x00000000778AA000-0x00000000778AB000-memory.dmp

Filesize
4KB

Download
memory/756-21-0x0000000000400000-0x00000000007A5000-memory.dmp

Filesize
3.6MB

Download
memory/4760-0-0x0000000000400000-0x00000000007A5000-memory.dmp

Filesize
3.6MB

Download
memory/4760-1-0x0000000000400000-0x00000000007A5000-memory.dmp

Filesize
3.6MB

Download
memory/4760-20-0x0000000000400000-0x00000000007A5000-memory.dmp

Filesize
3.6MB

Download