789807b0ca834e616552a1cf8157090601fd9c1fc4671cbd02aacb1d143f6f8a

Analysis

max time kernel
94s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02-10-2024 19:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-10-02_dfa8bbf37abf4083222fb6e45c38641a_hacktools_xiaoba.exe
Size

3.2MB
MD5

dfa8bbf37abf4083222fb6e45c38641a
SHA1

7ccb718921de31e649029043e1ad074651c4619f
SHA256

789807b0ca834e616552a1cf8157090601fd9c1fc4671cbd02aacb1d143f6f8a
SHA512

66b0ee402479b4ac419d4ce836bfd358f012946b953fc33f20b6ef3ee647a3f74b5583bacd02b6e3223757a574ae04ff6dea1bafb49d142bbf729088ec45d0c2
SSDEEP

49152:6zG1BqCBGJdodXAGRe5CFHRoHgmAZf1Nv:DBIKRAGRe5K2UZL

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3536	e57df44.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2572	3536	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-02_dfa8bbf37abf4083222fb6e45c38641a_hacktools_xiaoba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e57df44.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4664	2024-10-02_dfa8bbf37abf4083222fb6e45c38641a_hacktools_xiaoba.exe
4664	2024-10-02_dfa8bbf37abf4083222fb6e45c38641a_hacktools_xiaoba.exe
3536	e57df44.exe
3536	e57df44.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4664 wrote to memory of 3536	4664	2024-10-02_dfa8bbf37abf4083222fb6e45c38641a_hacktools_xiaoba.exe	82
PID 4664 wrote to memory of 3536	4664	2024-10-02_dfa8bbf37abf4083222fb6e45c38641a_hacktools_xiaoba.exe	82
PID 4664 wrote to memory of 3536	4664	2024-10-02_dfa8bbf37abf4083222fb6e45c38641a_hacktools_xiaoba.exe	82

C:\Users\Admin\AppData\Local\Temp\2024-10-02_dfa8bbf37abf4083222fb6e45c38641a_hacktools_xiaoba.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-02_dfa8bbf37abf4083222fb6e45c38641a_hacktools_xiaoba.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4664
- C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e57df44.exe
  C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e57df44.exe 240639828
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3536
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3536 -s 2056
    3⤵
    - Program crash
    PID:2572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3536 -ip 3536
1⤵
PID:4916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e57df44.exe

Filesize
3.2MB

MD5
9b2da605b00d97ffe2975bd13ba26e65

SHA1
33f0bc1eca5bcb14def75e64e2db7337cc98e1b8

SHA256
0852a56d6cb7224fed0dc23a2868f1c5567ee5ac2e456f582793b1a75c35fb76

SHA512
ef9cd36a6a520075ccb3d0f657dca73f55b4974171896166f03471ff6c5449eed8ac0af853cef3b7b4ebf99a069db2b8096250e023b739099a844e1a129804e3

Download Submit
memory/3536-16-0x000000007644A000-0x000000007644B000-memory.dmp

Filesize
4KB

Download
memory/3536-21-0x0000000000400000-0x00000000007A5000-memory.dmp

Filesize
3.6MB

Download
memory/4664-0-0x0000000000400000-0x00000000007A5000-memory.dmp

Filesize
3.6MB

Download
memory/4664-1-0x0000000000400000-0x00000000007A5000-memory.dmp

Filesize
3.6MB

Download
memory/4664-20-0x0000000000400000-0x00000000007A5000-memory.dmp

Filesize
3.6MB

Download