oblique | b218fb4573b6c8fff51870de463a793238a4f317ce9abdcf8352954f92328eac

Analysis

Target

frame.bin.exe
Size

498KB
MD5

2d411dc28a5faeb5893d7769b7c3b8a4
SHA1

1db46d9a9e27146ca12dcc9caff51ede700cf026
SHA256

b218fb4573b6c8fff51870de463a793238a4f317ce9abdcf8352954f92328eac
SHA512

5aab004d78dc87528f8965426d446dde68f8c8ff4a34cfecf1b69ade65b625f15d34fccbf4629ff42e49410379bd447eaa4f2339f11483d950e174a7d5aa8804

Score

10^/10

trojan oblique

ObliqueRAT
Remote Access Trojan discovered in early 2020.
trojan oblique
Executes dropped EXE 2 IoCs

Processes:

lphsi.exehrss.exe

pid process

2180 lphsi.exe
2384 hrss.exe
Drops startup file 1 IoCs

Processes:

hrss.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\script.lnk hrss.exe
Drops file in Windows directory 1 IoCs

Processes:

svchost.exe

description ioc process

File opened for modification C:\Windows\ServiceProfiles\LocalService\winhttp\cachev3.dat svchost.exe

pid	process
2180	lphsi.exe
2384	hrss.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\script.lnk	hrss.exe

description	ioc	process
File opened for modification	C:\Windows\ServiceProfiles\LocalService\winhttp\cachev3.dat	svchost.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

svchost.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionTime = 8da747b84b7dd601	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecision = "0"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionReason = "1"	svchost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

svchost.exe

description pid process

Token: SeShutdownPrivilege 1780 svchost.exe
Token: SeCreatePagefilePrivilege 1780 svchost.exe

description	pid	process
Token: SeShutdownPrivilege	1780	svchost.exe
Token: SeCreatePagefilePrivilege	1780	svchost.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

frame.bin.exe

description	pid	process	target process
PID 3816 wrote to memory of 2180	3816	frame.bin.exe	lphsi.exe
PID 3816 wrote to memory of 2180	3816	frame.bin.exe	lphsi.exe
PID 3816 wrote to memory of 2180	3816	frame.bin.exe	lphsi.exe
PID 3816 wrote to memory of 2384	3816	frame.bin.exe	hrss.exe
PID 3816 wrote to memory of 2384	3816	frame.bin.exe	hrss.exe
PID 3816 wrote to memory of 2384	3816	frame.bin.exe	hrss.exe

C:\Users\Admin\AppData\Local\Temp\frame.bin.exe
"C:\Users\Admin\AppData\Local\Temp\frame.bin.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3816
- C:\Users\Public\Video\lphsi.exe
  "C:\Users\Public\Video\lphsi.exe"
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Users\Public\Video\hrss.exe
  "C:\Users\Public\Video\hrss.exe"
  2⤵
  - Executes dropped EXE
  - Drops startup file
  PID:2384