Analysis
-
max time kernel
95s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
14-09-2024 19:30
General
-
Target
1d4946ea77a2bcf432f490d0a38429102a51069b.exe
-
Size
151KB
-
MD5
f635582929e0b0f2f18e1ee1fb7a84e9
-
SHA1
1d4946ea77a2bcf432f490d0a38429102a51069b
-
SHA256
583c1eb6360379032d7cf7e6a60e09cfe74c7ecd36174016f293b060537fa52d
-
SHA512
0a4ac0362ebf4ce81fb187d93898e3ffdf74e6a0da96913818ebbb59a236a3897ec680cdc4599a9cf8cee8f8b7d527c4fc0abf89016bab48449995d10065d1e7
-
SSDEEP
3072:mQHKadVFHUg2HiFI9ifi5iLLbyq8QL+wI7BJlwEKctby:BqSF/2HQlLLbyq8QL+wI7BJiEK
Malware Config
Extracted
xehook
2.1.5 Stable
https://t.me/+w897k5UK_jIyNDgy
-
id
208
-
token
xehook208262680500151
Signatures
-
Xehook stealer
Xehook is an infostealer written in C#.
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1d4946ea77a2bcf432f490d0a38429102a51069b.exe"C:\Users\Admin\AppData\Local\Temp\1d4946ea77a2bcf432f490d0a38429102a51069b.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
176KB
-
Filesize
10.8MB
-
Filesize
10.8MB