xehook | 17f929c1d40a7fd6f897c0b15ca9c44b2059cbccb3037c31619d87954659478e | Triage

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
23-04-2024 09:55

Sharing

Report Analysis Logs

General

Target

tmp.exe
Size

273KB
MD5

e795115169cc800de0392d6a675d58fd
SHA1

8dd75837e360ba1cb8acf5a3d348dd020a5da482
SHA256

17f929c1d40a7fd6f897c0b15ca9c44b2059cbccb3037c31619d87954659478e
SHA512

5fb6543e91de175bd365462a1cc87d6772e43b0effd3757b3e408b08a4de5a004de9a85e7f1d09578fa3bc6b6486c5f5016c1b879496582dbb39b2e62e168f38
SSDEEP

6144:s/wl9dobdtMJNPX459l2/FpnovRWf1RdSxWbkHg6O0:HdoRtMJRkQp2MY0QO0

Score

10^/10

Malware Config

Signatures

Detect Xehook Payload 1 IoCs

Processes:

resource yara_rule

behavioral1/memory/2332-0-0x0000000000FE0000-0x0000000001028000-memory.dmp family_xehook
Xehook stealer
Xehook is an infostealer written in C#.
stealer xehook
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2952 2332 WerFault.exe tmp.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

tmp.exe

description	pid	process	target process
PID 2332 wrote to memory of 2952	2332	tmp.exe	WerFault.exe
PID 2332 wrote to memory of 2952	2332	tmp.exe	WerFault.exe
PID 2332 wrote to memory of 2952	2332	tmp.exe	WerFault.exe
PID 2332 wrote to memory of 2952	2332	tmp.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2332 -s 92
2⤵
- Program crash
PID:2952

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2332-0-0x0000000000FE0000-0x0000000001028000-memory.dmp

Filesize
288KB

Download