Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
11-12-2024 20:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
xuhu.exe
Resource
win7-20240708-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
xuhu.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
xuhu.exe
-
Size
87.0MB
-
MD5
84f0b3584d52b500e4ebfbf97e02bfa2
-
SHA1
881042aea9717260c2337ae4cbb95097cce2ed74
-
SHA256
a6b44600a77997e6e46bda3f0aa10986127380de91be9ca5aa0713eab42717f0
-
SHA512
f8466287e5df5895e2222c4faad2f59a14dc780daeb43af16c3a71d980df8168b2aced89077940e7870e1395df06a441550844656caa54b7a6970cf18ee4751e
-
SSDEEP
1572864:6dn2MQcEzvgKWogC6eA4ZysnIFJnvGnbZMsWhIk9AQ2qNTaBWaAFG0yegv1kACzz:in2MQcuYKWoP6eNtGBkZnWhIk9B2eOWX
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2756 xuhujob.exe -
Loads dropped DLL 2 IoCs
pid Process 1724 xuhu.exe 2892 Process not Found -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1724 wrote to memory of 2756 1724 xuhu.exe 31 PID 1724 wrote to memory of 2756 1724 xuhu.exe 31 PID 1724 wrote to memory of 2756 1724 xuhu.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\xuhu.exe"C:\Users\Admin\AppData\Local\Temp\xuhu.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\xuhujob.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\xuhujob.exe"2⤵
- Executes dropped EXE
PID:2756
-