xehook | 17f929c1d40a7fd6f897c0b15ca9c44b2059cbccb3037c31619d87954659478e

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-04-2024 01:05

Target

17f929c1d40a7fd6f897c0b15ca9c44b2059cbccb3037c31619d87954659478e.exe
Size

273KB
MD5

e795115169cc800de0392d6a675d58fd
SHA1

8dd75837e360ba1cb8acf5a3d348dd020a5da482
SHA256

17f929c1d40a7fd6f897c0b15ca9c44b2059cbccb3037c31619d87954659478e
SHA512

5fb6543e91de175bd365462a1cc87d6772e43b0effd3757b3e408b08a4de5a004de9a85e7f1d09578fa3bc6b6486c5f5016c1b879496582dbb39b2e62e168f38
SSDEEP

6144:s/wl9dobdtMJNPX459l2/FpnovRWf1RdSxWbkHg6O0:HdoRtMJRkQp2MY0QO0

Score

10^/10

Detect Xehook Payload 1 IoCs

Processes:

resource yara_rule

behavioral1/memory/2224-0-0x00000000001D0000-0x0000000000218000-memory.dmp family_xehook
Xehook stealer
Xehook is an infostealer written in C#.
stealer xehook
Detect binaries embedding considerable number of MFA browser extension IDs. 1 IoCs

Processes:

resource yara_rule

behavioral1/memory/2224-0-0x00000000001D0000-0x0000000000218000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_MFA_Browser_Extension_IDs
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

Processes:

resource yara_rule

behavioral1/memory/2224-0-0x00000000001D0000-0x0000000000218000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 1 IoCs

Processes:

resource yara_rule

behavioral1/memory/2224-0-0x00000000001D0000-0x0000000000218000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process

2832 2224 WerFault.exe

resource	yara_rule
behavioral1/memory/2224-0-0x00000000001D0000-0x0000000000218000-memory.dmp	family_xehook

resource	yara_rule
behavioral1/memory/2224-0-0x00000000001D0000-0x0000000000218000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_MFA_Browser_Extension_IDs

resource	yara_rule
behavioral1/memory/2224-0-0x00000000001D0000-0x0000000000218000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

resource	yara_rule
behavioral1/memory/2224-0-0x00000000001D0000-0x0000000000218000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

pid	pid_target	process
2832	2224	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

17f929c1d40a7fd6f897c0b15ca9c44b2059cbccb3037c31619d87954659478e.exe

description	pid	process	target process
PID 2224 wrote to memory of 2832	2224	17f929c1d40a7fd6f897c0b15ca9c44b2059cbccb3037c31619d87954659478e.exe	WerFault.exe
PID 2224 wrote to memory of 2832	2224	17f929c1d40a7fd6f897c0b15ca9c44b2059cbccb3037c31619d87954659478e.exe	WerFault.exe
PID 2224 wrote to memory of 2832	2224	17f929c1d40a7fd6f897c0b15ca9c44b2059cbccb3037c31619d87954659478e.exe	WerFault.exe
PID 2224 wrote to memory of 2832	2224	17f929c1d40a7fd6f897c0b15ca9c44b2059cbccb3037c31619d87954659478e.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\17f929c1d40a7fd6f897c0b15ca9c44b2059cbccb3037c31619d87954659478e.exe
"C:\Users\Admin\AppData\Local\Temp\17f929c1d40a7fd6f897c0b15ca9c44b2059cbccb3037c31619d87954659478e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 92
2⤵
- Program crash
PID:2832

memory/2224-0-0x00000000001D0000-0x0000000000218000-memory.dmp

Filesize
288KB

Download