xehook | 676498f292b3a47c39fadd65d8400735c92d0453aa627b1013cb4fe5a100be2d

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14-09-2024 19:30

Target

1d4946ea77a2bcf432f490d0a38429102a51069b.exe
Size

151KB
MD5

f635582929e0b0f2f18e1ee1fb7a84e9
SHA1

1d4946ea77a2bcf432f490d0a38429102a51069b
SHA256

583c1eb6360379032d7cf7e6a60e09cfe74c7ecd36174016f293b060537fa52d
SHA512

0a4ac0362ebf4ce81fb187d93898e3ffdf74e6a0da96913818ebbb59a236a3897ec680cdc4599a9cf8cee8f8b7d527c4fc0abf89016bab48449995d10065d1e7
SSDEEP

3072:mQHKadVFHUg2HiFI9ifi5iLLbyq8QL+wI7BJlwEKctby:BqSF/2HQlLLbyq8QL+wI7BJiEK

Score

10^/10

xehook stealer

Family

xehook

Version

2.1.5 Stable

https://t.me/+w897k5UK_jIyNDgy

Attributes

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

1d4946ea77a2bcf432f490d0a38429102a51069b.exe

description	pid	Process
Token: SeDebugPrivilege	3000	1d4946ea77a2bcf432f490d0a38429102a51069b.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

1d4946ea77a2bcf432f490d0a38429102a51069b.exe

description	pid	Process	procid_target
PID 3000 wrote to memory of 1936	3000	1d4946ea77a2bcf432f490d0a38429102a51069b.exe	30
PID 3000 wrote to memory of 1936	3000	1d4946ea77a2bcf432f490d0a38429102a51069b.exe	30
PID 3000 wrote to memory of 1936	3000	1d4946ea77a2bcf432f490d0a38429102a51069b.exe	30

C:\Users\Admin\AppData\Local\Temp\1d4946ea77a2bcf432f490d0a38429102a51069b.exe
"C:\Users\Admin\AppData\Local\Temp\1d4946ea77a2bcf432f490d0a38429102a51069b.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3000 -s 1064
  2⤵
  PID:1936

memory/3000-0-0x000007FEF5103000-0x000007FEF5104000-memory.dmp

Filesize
4KB

Download
memory/3000-1-0x0000000001170000-0x000000000119C000-memory.dmp

Filesize
176KB

Download
memory/3000-2-0x000007FEF5100000-0x000007FEF5AEC000-memory.dmp

Filesize
9.9MB

Download
memory/3000-3-0x000007FEF5103000-0x000007FEF5104000-memory.dmp

Filesize
4KB

Download
memory/3000-4-0x000007FEF5100000-0x000007FEF5AEC000-memory.dmp

Filesize
9.9MB

Download