oblique | 7f15302860082e1a580961f72519fd50d29a1c89f08b2a8d7182059690f6be2a

General

Target

7f15302860082e1a580961f72519fd50d29a1c89f08b2a8d7182059690f6be2a.exe
Size

498KB
MD5

d24f971437f93caf9e6497f7ece0ce1c
SHA1

224a2aab2aba68c5635b0ea3b68512551bc0a055
SHA256

7f15302860082e1a580961f72519fd50d29a1c89f08b2a8d7182059690f6be2a
SHA512

1dfa91aa466381bfca283f556e68754bb8445bc199c270d362d033cd86705f4e1a86f4b514128502a61b2285e3e68b9b35a45eec83321cb0f69663990ab116ed

Score

10^/10

oblique trojan

Malware Config

Signatures

ObliqueRAT
Remote Access Trojan discovered in early 2020.
trojan oblique
Executes dropped EXE 2 IoCs

Processes:

lphsi.exehrss.exe

pid process

1128 lphsi.exe
1372 hrss.exe
Drops startup file 1 IoCs

Processes:

hrss.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\script.lnk hrss.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
1128	lphsi.exe
1372	hrss.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\script.lnk	hrss.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

7f15302860082e1a580961f72519fd50d29a1c89f08b2a8d7182059690f6be2a.exe

description	pid	process	target process
PID 3176 wrote to memory of 1128	3176	7f15302860082e1a580961f72519fd50d29a1c89f08b2a8d7182059690f6be2a.exe	lphsi.exe
PID 3176 wrote to memory of 1128	3176	7f15302860082e1a580961f72519fd50d29a1c89f08b2a8d7182059690f6be2a.exe	lphsi.exe
PID 3176 wrote to memory of 1128	3176	7f15302860082e1a580961f72519fd50d29a1c89f08b2a8d7182059690f6be2a.exe	lphsi.exe
PID 3176 wrote to memory of 1372	3176	7f15302860082e1a580961f72519fd50d29a1c89f08b2a8d7182059690f6be2a.exe	hrss.exe
PID 3176 wrote to memory of 1372	3176	7f15302860082e1a580961f72519fd50d29a1c89f08b2a8d7182059690f6be2a.exe	hrss.exe
PID 3176 wrote to memory of 1372	3176	7f15302860082e1a580961f72519fd50d29a1c89f08b2a8d7182059690f6be2a.exe	hrss.exe

C:\Users\Admin\AppData\Local\Temp\7f15302860082e1a580961f72519fd50d29a1c89f08b2a8d7182059690f6be2a.exe
"C:\Users\Admin\AppData\Local\Temp\7f15302860082e1a580961f72519fd50d29a1c89f08b2a8d7182059690f6be2a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3176
- C:\Users\Public\Video\lphsi.exe
  "C:\Users\Public\Video\lphsi.exe"
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Users\Public\Video\hrss.exe
  "C:\Users\Public\Video\hrss.exe"
  2⤵
  - Executes dropped EXE
  - Drops startup file
  PID:1372

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\Video\hrss.exe

MD5
5de79fd53f3ec570969d404469d3acfb

SHA1
d2fc0fc28650609641169ef43ab6ba27ba1c268b

SHA256
d0db839579dead9fea0feb383ccd57e7b394b3670c3f7240ddec8a4fbf7afe14

SHA512
d19b130eda365e9d2625231113ca65a6543bcd56f9b9727cb17c859a68f2f678be0495f84ae0f17867fda3ff3325f2fe211e4a00fb3d6c8aee41c1f4864be05c

Download Submit
C:\Users\Public\Video\hrss.exe

MD5
5de79fd53f3ec570969d404469d3acfb

SHA1
d2fc0fc28650609641169ef43ab6ba27ba1c268b

SHA256
d0db839579dead9fea0feb383ccd57e7b394b3670c3f7240ddec8a4fbf7afe14

SHA512
d19b130eda365e9d2625231113ca65a6543bcd56f9b9727cb17c859a68f2f678be0495f84ae0f17867fda3ff3325f2fe211e4a00fb3d6c8aee41c1f4864be05c

Download Submit
C:\Users\Public\Video\lphsi.exe

MD5
0bafccfaec9c7d45ce491e4b0ddc1bdf

SHA1
f0fa26da45d04ca36e9eb0acbc2d8ddce881e096

SHA256
9da1a55b88bda3810ccd482051dc7e0088e8539ef8da5ddd29c583f593244e1c

SHA512
c32b734420be1ee3a54dfea117f2fb14353fbd39831d8bbe8a4515c983f0781c38d4bcc8a6c5fd0785693fa3a16add499387bd8add21f706c9927d537e38184e

Download Submit
C:\Users\Public\Video\lphsi.exe

MD5
0bafccfaec9c7d45ce491e4b0ddc1bdf

SHA1
f0fa26da45d04ca36e9eb0acbc2d8ddce881e096

SHA256
9da1a55b88bda3810ccd482051dc7e0088e8539ef8da5ddd29c583f593244e1c

SHA512
c32b734420be1ee3a54dfea117f2fb14353fbd39831d8bbe8a4515c983f0781c38d4bcc8a6c5fd0785693fa3a16add499387bd8add21f706c9927d537e38184e

Download Submit
memory/1128-114-0x0000000000000000-mapping.dmp

Download
memory/1372-117-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing