75e75fe1ebd54217c3d99ef7dceafdad420a29bb01df2ea2d0e71db092623662

General

Target
ae68fce609dfdb34aba9e4d8be5c3f4c.exe
Size 285KB
Sample220331-lbw18adfhq
SHA256 75e75fe1ebd54217c3d99ef7dceafdad420a29bb01df2ea2d0e71db092623662
MD5 ae68fce609dfdb34aba9e4d8be5c3f4c
SHA1 2f23d2abf4aa68941fe4b7ebb3ab6db14f7a0b75
SHA512 843496238b6eaaf5439af459794596c217584ed046a6baf844935eb722aebe30625e188b65bf9a9a927fc6d31de50675a0504d4b205ff4895969cec77e6f09b8
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2392	oobeldr.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1944	408	WerFault.exe	77

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3540	schtasks.exe
2368	schtasks.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 408 wrote to memory of 3540	408	ae68fce609dfdb34aba9e4d8be5c3f4c.exe	78
PID 408 wrote to memory of 3540	408	ae68fce609dfdb34aba9e4d8be5c3f4c.exe	78
PID 408 wrote to memory of 3540	408	ae68fce609dfdb34aba9e4d8be5c3f4c.exe	78
PID 2392 wrote to memory of 2368	2392	oobeldr.exe	98
PID 2392 wrote to memory of 2368	2392	oobeldr.exe	98
PID 2392 wrote to memory of 2368	2392	oobeldr.exe	98

C:\Users\Admin\AppData\Local\Temp\ae68fce609dfdb34aba9e4d8be5c3f4c.exe
"C:\Users\Admin\AppData\Local\Temp\ae68fce609dfdb34aba9e4d8be5c3f4c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:408
- C:\Windows\SysWOW64\schtasks.exe
  /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
  2⤵
  - Creates scheduled task(s)
  PID:3540
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 408 -s 596
  2⤵
  - Program crash
  PID:1944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 408 -ip 408
1⤵
PID:860

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Windows\SysWOW64\schtasks.exe
  /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
  2⤵
  - Creates scheduled task(s)
  PID:2368

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

oobeldr.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
Size 285KB
SHA256 75e75fe1ebd54217c3d99ef7dceafdad420a29bb01df2ea2d0e71db092623662
MD5 ae68fce609dfdb34aba9e4d8be5c3f4c
SHA1 2f23d2abf4aa68941fe4b7ebb3ab6db14f7a0b75
SHA512 843496238b6eaaf5439af459794596c217584ed046a6baf844935eb722aebe30625e188b65bf9a9a927fc6d31de50675a0504d4b205ff4895969cec77e6f09b8
MD5 SHA1 SHA512

Submit Download

oobeldr.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
Size 285KB
SHA256 75e75fe1ebd54217c3d99ef7dceafdad420a29bb01df2ea2d0e71db092623662
MD5 ae68fce609dfdb34aba9e4d8be5c3f4c
SHA1 2f23d2abf4aa68941fe4b7ebb3ab6db14f7a0b75
SHA512 843496238b6eaaf5439af459794596c217584ed046a6baf844935eb722aebe30625e188b65bf9a9a927fc6d31de50675a0504d4b205ff4895969cec77e6f09b8
MD5 SHA1 SHA512

Submit Download

memory/408-130-0x00000000004BC000-0x00000000004C5000-memory.dmp

Download

memory/408-132-0x00000000004BC000-0x00000000004C5000-memory.dmp

Download

memory/408-133-0x0000000000600000-0x0000000000604000-memory.dmp

Download

memory/408-134-0x0000000000400000-0x000000000048B000-memory.dmp

Download

memory/2392-137-0x000000000081C000-0x0000000000825000-memory.dmp

Download

memory/2392-139-0x000000000081C000-0x0000000000825000-memory.dmp

Download

memory/2392-140-0x0000000000400000-0x000000000048B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads