xehook | e3306564878e080f2d3d0c271431f53cf434c5046106a483e095bed1ded33761

Analysis

max time kernel
15s
max time network
18s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20-10-2024 19:05

Target

3bbdaa00d0153f3dd06c1bfb5901c88129bd6692588b2cf9f7aa80836f547b92.exe
Size

151KB
MD5

6e27a30914405fd496fc312e4a867e30
SHA1

72f6b3a73c83b31a22ade0103d53d74d444bcb18
SHA256

3bbdaa00d0153f3dd06c1bfb5901c88129bd6692588b2cf9f7aa80836f547b92
SHA512

f779229af3cce1ee4dafcad697667170cccb0113f96c884593cc8aa425e115813487cb1ccab49df32ccfe79b8eaf8c290a6be3068a429322e3f75dc3a1620f8c
SSDEEP

3072:30z6gqFfzyAy9qngIMZW5qor5H3mqwz+GFj/b1r9TxvcfYxwEKctzk:cifMqm9or5H3mqwz+GFj/b1r9TxvcfYQ

Score

10^/10

xehook stealer

Family

xehook

Version

2.1.5 Stable

https://t.me/+w897k5UK_jIyNDgy

Attributes

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1836	3bbdaa00d0153f3dd06c1bfb5901c88129bd6692588b2cf9f7aa80836f547b92.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1836 wrote to memory of 2132	1836	3bbdaa00d0153f3dd06c1bfb5901c88129bd6692588b2cf9f7aa80836f547b92.exe	31
PID 1836 wrote to memory of 2132	1836	3bbdaa00d0153f3dd06c1bfb5901c88129bd6692588b2cf9f7aa80836f547b92.exe	31
PID 1836 wrote to memory of 2132	1836	3bbdaa00d0153f3dd06c1bfb5901c88129bd6692588b2cf9f7aa80836f547b92.exe	31

C:\Users\Admin\AppData\Local\Temp\3bbdaa00d0153f3dd06c1bfb5901c88129bd6692588b2cf9f7aa80836f547b92.exe
"C:\Users\Admin\AppData\Local\Temp\3bbdaa00d0153f3dd06c1bfb5901c88129bd6692588b2cf9f7aa80836f547b92.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1836
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1836 -s 1064
  2⤵
  PID:2132

memory/1836-0-0x000007FEF5283000-0x000007FEF5284000-memory.dmp

Filesize
4KB

Download
memory/1836-1-0x0000000000080000-0x00000000000AC000-memory.dmp

Filesize
176KB

Download
memory/1836-2-0x000007FEF5280000-0x000007FEF5C6C000-memory.dmp

Filesize
9.9MB

Download
memory/1836-3-0x000007FEF5280000-0x000007FEF5C6C000-memory.dmp

Filesize
9.9MB

Download