Analysis
-
max time kernel
14s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
14-09-2024 15:57
General
-
Target
1d4946ea77a2bcf432f490d0a38429102a51069b.exe
-
Size
151KB
-
MD5
f635582929e0b0f2f18e1ee1fb7a84e9
-
SHA1
1d4946ea77a2bcf432f490d0a38429102a51069b
-
SHA256
583c1eb6360379032d7cf7e6a60e09cfe74c7ecd36174016f293b060537fa52d
-
SHA512
0a4ac0362ebf4ce81fb187d93898e3ffdf74e6a0da96913818ebbb59a236a3897ec680cdc4599a9cf8cee8f8b7d527c4fc0abf89016bab48449995d10065d1e7
-
SSDEEP
3072:mQHKadVFHUg2HiFI9ifi5iLLbyq8QL+wI7BJlwEKctby:BqSF/2HQlLLbyq8QL+wI7BJiEK
Score
10/10
Malware Config
Extracted
Family
xehook
Version
2.1.5 Stable
C2
https://t.me/+w897k5UK_jIyNDgy
Attributes
-
id
208
-
token
xehook208262680500151
Signatures
-
Xehook stealer
Xehook is an infostealer written in C#.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1d4946ea77a2bcf432f490d0a38429102a51069b.exe"C:\Users\Admin\AppData\Local\Temp\1d4946ea77a2bcf432f490d0a38429102a51069b.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2716 -s 10602⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
176KB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB