Resubmissions
13-09-2024 09:50
240913-lt52vawgrl 1013-09-2024 09:49
240913-ltjtlsxckd 1013-09-2024 09:48
240913-ls2b9swgmp 10Analysis
-
max time kernel
16s -
max time network
17s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
-
submitted
13-09-2024 09:50
General
-
Target
583c1eb6360379032d7cf7e6a60e09cfe74c7ecd36174016f293b060537fa52d.exe
-
Size
151KB
-
MD5
f635582929e0b0f2f18e1ee1fb7a84e9
-
SHA1
1d4946ea77a2bcf432f490d0a38429102a51069b
-
SHA256
583c1eb6360379032d7cf7e6a60e09cfe74c7ecd36174016f293b060537fa52d
-
SHA512
0a4ac0362ebf4ce81fb187d93898e3ffdf74e6a0da96913818ebbb59a236a3897ec680cdc4599a9cf8cee8f8b7d527c4fc0abf89016bab48449995d10065d1e7
-
SSDEEP
3072:mQHKadVFHUg2HiFI9ifi5iLLbyq8QL+wI7BJlwEKctby:BqSF/2HQlLLbyq8QL+wI7BJiEK
Score
10/10
Malware Config
Extracted
Family
xehook
Version
2.1.5 Stable
C2
https://t.me/+w897k5UK_jIyNDgy
Attributes
-
id
208
-
token
xehook208262680500151
Signatures
-
Xehook stealer
Xehook is an infostealer written in C#.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\583c1eb6360379032d7cf7e6a60e09cfe74c7ecd36174016f293b060537fa52d.exe"C:\Users\Admin\AppData\Local\Temp\583c1eb6360379032d7cf7e6a60e09cfe74c7ecd36174016f293b060537fa52d.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
176KB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB