Overview

overview

10

Static

static

10

1d4946ea77...9b.exe

windows7-x64

10

1d4946ea77...9b.exe

windows10-2004-x64

10

d1f0f17e91...25.exe

windows7-x64

1

d1f0f17e91...25.exe

windows10-2004-x64

3

Analysis

  • max time kernel
    122s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    14-09-2024 17:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1d4946ea77a2bcf432f490d0a38429102a51069b.exe

  • Size

    151KB

  • MD5

    f635582929e0b0f2f18e1ee1fb7a84e9

  • SHA1

    1d4946ea77a2bcf432f490d0a38429102a51069b

  • SHA256

    583c1eb6360379032d7cf7e6a60e09cfe74c7ecd36174016f293b060537fa52d

  • SHA512

    0a4ac0362ebf4ce81fb187d93898e3ffdf74e6a0da96913818ebbb59a236a3897ec680cdc4599a9cf8cee8f8b7d527c4fc0abf89016bab48449995d10065d1e7

  • SSDEEP

    3072:mQHKadVFHUg2HiFI9ifi5iLLbyq8QL+wI7BJlwEKctby:BqSF/2HQlLLbyq8QL+wI7BJiEK

Score
10/10
xehookstealer

Malware Config

Extracted

Family

xehook

Version

2.1.5 Stable

C2

https://t.me/+w897k5UK_jIyNDgy

Attributes
  • id

    208

  • token

    xehook208262680500151

Signatures

  • Xehook stealer

    Xehook is an infostealer written in C#.

    stealerxehook
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1d4946ea77a2bcf432f490d0a38429102a51069b.exe
    "C:\Users\Admin\AppData\Local\Temp\1d4946ea77a2bcf432f490d0a38429102a51069b.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:604
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 604 -s 1064
      2⤵
        PID:852

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/604-0-0x000007FEF55F3000-0x000007FEF55F4000-memory.dmp
      Filesize

      4KB

      Download
    • memory/604-1-0x00000000013D0000-0x00000000013FC000-memory.dmp
      Filesize

      176KB

      Download
    • memory/604-2-0x000007FEF55F0000-0x000007FEF5FDC000-memory.dmp
      Filesize

      9.9MB

      Download
    • memory/604-3-0x000007FEF55F0000-0x000007FEF5FDC000-memory.dmp
      Filesize

      9.9MB

      Download