be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d

Analysis

max time kernel
291s
max time network
292s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
21-09-2022 22:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe
Size

171KB
MD5

2dce3da05acacdf790a0e200206fc921
SHA1

8adc6bc3612ce098a230681655cc4a8eaa0338d4
SHA256

be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d
SHA512

762bf52c8ba86d7e4d6ca5aafaa94fefbe4ed23eb07e01e30620c52e00cc9a7d94b36042b4098ddd0c2bb01b84553d2a0d365e2db1fab6a0d1ad7344d38d9c7a
SSDEEP

1536:GVS32qHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHU//rT//j:LVMMMZMMMMMMMMMMMMz

Score

8^/10

agilenet

Malware Config

Signatures

Executes dropped EXE 11 IoCs

Processes:

oobeldr.exeoobeldr.exeoobeldr.exeoobeldr.exeoobeldr.exeoobeldr.exeoobeldr.exeoobeldr.exeoobeldr.exeoobeldr.exeoobeldr.exe

pid	process
2004	oobeldr.exe
432	oobeldr.exe
1568	oobeldr.exe
896	oobeldr.exe
1716	oobeldr.exe
892	oobeldr.exe
788	oobeldr.exe
2000	oobeldr.exe
1808	oobeldr.exe
1456	oobeldr.exe
2044	oobeldr.exe

Loads dropped DLL 6 IoCs

Processes:

oobeldr.exeoobeldr.exeoobeldr.exeoobeldr.exe

pid process

2004 oobeldr.exe
2004 oobeldr.exe
2004 oobeldr.exe
1716 oobeldr.exe
788 oobeldr.exe
1808 oobeldr.exe

Obfuscated with Agile.Net obfuscator 21 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
behavioral1/memory/1284-54-0x0000000000F00000-0x0000000000F30000-memory.dmp	agile_net
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe	agile_net
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe	agile_net
behavioral1/memory/2004-77-0x0000000000310000-0x0000000000340000-memory.dmp	agile_net
\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe	agile_net
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe	agile_net
\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe	agile_net
\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe	agile_net
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe	agile_net
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe	agile_net
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe	agile_net
behavioral1/memory/1716-104-0x0000000000310000-0x0000000000340000-memory.dmp	agile_net
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe	agile_net
\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe	agile_net
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe	agile_net
\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe	agile_net
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe	agile_net
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe	agile_net
\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe	agile_net
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe	agile_net
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe	agile_net

Drops file in System32 directory 5 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exeoobeldr.exeoobeldr.exeoobeldr.exe

description	pid	process	target process
PID 1284 set thread context of 1664	1284	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe
PID 2004 set thread context of 1568	2004	oobeldr.exe	oobeldr.exe
PID 1716 set thread context of 892	1716	oobeldr.exe	oobeldr.exe
PID 788 set thread context of 2000	788	oobeldr.exe	oobeldr.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

928 schtasks.exe
1936 schtasks.exe

pid	process
928	schtasks.exe
1936	schtasks.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

powershell.exebe39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exepowershell.exeoobeldr.exepowershell.exeoobeldr.exepowershell.exeoobeldr.exepowershell.exepowershell.exe

pid	process
560	powershell.exe
1284	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe
1284	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe
1552	powershell.exe
2004	oobeldr.exe
2004	oobeldr.exe
2004	oobeldr.exe
2004	oobeldr.exe
1372	powershell.exe
1716	oobeldr.exe
1716	oobeldr.exe
1388	powershell.exe
788	oobeldr.exe
788	oobeldr.exe
1304	powershell.exe
1868	powershell.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

Processes:

be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exepowershell.exeoobeldr.exepowershell.exeoobeldr.exepowershell.exeoobeldr.exepowershell.exepowershell.exeoobeldr.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	1284	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe
Token: SeDebugPrivilege	560	powershell.exe
Token: SeDebugPrivilege	2004	oobeldr.exe
Token: SeDebugPrivilege	1552	powershell.exe
Token: SeDebugPrivilege	1716	oobeldr.exe
Token: SeDebugPrivilege	1372	powershell.exe
Token: SeDebugPrivilege	788	oobeldr.exe
Token: SeDebugPrivilege	1388	powershell.exe
Token: SeDebugPrivilege	1304	powershell.exe
Token: SeDebugPrivilege	2044	oobeldr.exe
Token: SeDebugPrivilege	1868	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exebe39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exetaskeng.exeoobeldr.exeoobeldr.exe

description	pid	process	target process
PID 1284 wrote to memory of 560	1284	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe	powershell.exe
PID 1284 wrote to memory of 560	1284	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe	powershell.exe
PID 1284 wrote to memory of 560	1284	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe	powershell.exe
PID 1284 wrote to memory of 560	1284	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe	powershell.exe
PID 1284 wrote to memory of 1664	1284	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe
PID 1284 wrote to memory of 1664	1284	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe
PID 1284 wrote to memory of 1664	1284	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe
PID 1284 wrote to memory of 1664	1284	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe
PID 1284 wrote to memory of 1664	1284	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe
PID 1284 wrote to memory of 1664	1284	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe
PID 1284 wrote to memory of 1664	1284	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe
PID 1284 wrote to memory of 1664	1284	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe
PID 1284 wrote to memory of 1664	1284	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe
PID 1284 wrote to memory of 1664	1284	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe
PID 1284 wrote to memory of 1664	1284	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe
PID 1284 wrote to memory of 1664	1284	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe
PID 1664 wrote to memory of 928	1664	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe	schtasks.exe
PID 1664 wrote to memory of 928	1664	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe	schtasks.exe
PID 1664 wrote to memory of 928	1664	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe	schtasks.exe
PID 1664 wrote to memory of 928	1664	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe	schtasks.exe
PID 1656 wrote to memory of 2004	1656	taskeng.exe	oobeldr.exe
PID 1656 wrote to memory of 2004	1656	taskeng.exe	oobeldr.exe
PID 1656 wrote to memory of 2004	1656	taskeng.exe	oobeldr.exe
PID 1656 wrote to memory of 2004	1656	taskeng.exe	oobeldr.exe
PID 1656 wrote to memory of 2004	1656	taskeng.exe	oobeldr.exe
PID 1656 wrote to memory of 2004	1656	taskeng.exe	oobeldr.exe
PID 1656 wrote to memory of 2004	1656	taskeng.exe	oobeldr.exe
PID 2004 wrote to memory of 1552	2004	oobeldr.exe	powershell.exe
PID 2004 wrote to memory of 1552	2004	oobeldr.exe	powershell.exe
PID 2004 wrote to memory of 1552	2004	oobeldr.exe	powershell.exe
PID 2004 wrote to memory of 1552	2004	oobeldr.exe	powershell.exe
PID 2004 wrote to memory of 432	2004	oobeldr.exe	oobeldr.exe
PID 2004 wrote to memory of 432	2004	oobeldr.exe	oobeldr.exe
PID 2004 wrote to memory of 432	2004	oobeldr.exe	oobeldr.exe
PID 2004 wrote to memory of 432	2004	oobeldr.exe	oobeldr.exe
PID 2004 wrote to memory of 432	2004	oobeldr.exe	oobeldr.exe
PID 2004 wrote to memory of 432	2004	oobeldr.exe	oobeldr.exe
PID 2004 wrote to memory of 432	2004	oobeldr.exe	oobeldr.exe
PID 2004 wrote to memory of 896	2004	oobeldr.exe	oobeldr.exe
PID 2004 wrote to memory of 896	2004	oobeldr.exe	oobeldr.exe
PID 2004 wrote to memory of 896	2004	oobeldr.exe	oobeldr.exe
PID 2004 wrote to memory of 896	2004	oobeldr.exe	oobeldr.exe
PID 2004 wrote to memory of 896	2004	oobeldr.exe	oobeldr.exe
PID 2004 wrote to memory of 896	2004	oobeldr.exe	oobeldr.exe
PID 2004 wrote to memory of 896	2004	oobeldr.exe	oobeldr.exe
PID 2004 wrote to memory of 1568	2004	oobeldr.exe	oobeldr.exe
PID 2004 wrote to memory of 1568	2004	oobeldr.exe	oobeldr.exe
PID 2004 wrote to memory of 1568	2004	oobeldr.exe	oobeldr.exe
PID 2004 wrote to memory of 1568	2004	oobeldr.exe	oobeldr.exe
PID 2004 wrote to memory of 1568	2004	oobeldr.exe	oobeldr.exe
PID 2004 wrote to memory of 1568	2004	oobeldr.exe	oobeldr.exe
PID 2004 wrote to memory of 1568	2004	oobeldr.exe	oobeldr.exe
PID 2004 wrote to memory of 1568	2004	oobeldr.exe	oobeldr.exe
PID 2004 wrote to memory of 1568	2004	oobeldr.exe	oobeldr.exe
PID 2004 wrote to memory of 1568	2004	oobeldr.exe	oobeldr.exe
PID 2004 wrote to memory of 1568	2004	oobeldr.exe	oobeldr.exe
PID 2004 wrote to memory of 1568	2004	oobeldr.exe	oobeldr.exe
PID 1568 wrote to memory of 1936	1568	oobeldr.exe	schtasks.exe
PID 1568 wrote to memory of 1936	1568	oobeldr.exe	schtasks.exe
PID 1568 wrote to memory of 1936	1568	oobeldr.exe	schtasks.exe
PID 1568 wrote to memory of 1936	1568	oobeldr.exe	schtasks.exe
PID 1656 wrote to memory of 1716	1656	taskeng.exe	oobeldr.exe
PID 1656 wrote to memory of 1716	1656	taskeng.exe	oobeldr.exe
PID 1656 wrote to memory of 1716	1656	taskeng.exe	oobeldr.exe

C:\Users\Admin\AppData\Local\Temp\be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe
"C:\Users\Admin\AppData\Local\Temp\be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1284

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQA1AA==
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:560

C:\Users\Admin\AppData\Local\Temp\be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe
C:\Users\Admin\AppData\Local\Temp\be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:1664

C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
3⤵
- Creates scheduled task(s)
PID:928

C:\Windows\system32\taskeng.exe
taskeng.exe {FDF4A571-95D1-4D79-BD98-4375D3A0AF57} S-1-5-21-4063495947-34355257-727531523-1000:RYNKSFQE\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1656

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2004

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQA1AA==
3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1552

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
3⤵
- Executes dropped EXE
PID:432

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
3⤵
- Executes dropped EXE
PID:896

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568

C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
4⤵
- Creates scheduled task(s)
PID:1936

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1716

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQA1AA==
3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1372

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
3⤵
- Executes dropped EXE
PID:892

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:788

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQA1AA==
3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1388

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
3⤵
- Executes dropped EXE
PID:2000

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1808

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQA1AA==
3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1304

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
3⤵
- Executes dropped EXE
PID:1456

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2044

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQA1AA==
3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1868

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
Filesize
171KB

MD5
2dce3da05acacdf790a0e200206fc921

SHA1
8adc6bc3612ce098a230681655cc4a8eaa0338d4

SHA256
be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d

SHA512
762bf52c8ba86d7e4d6ca5aafaa94fefbe4ed23eb07e01e30620c52e00cc9a7d94b36042b4098ddd0c2bb01b84553d2a0d365e2db1fab6a0d1ad7344d38d9c7a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
Filesize
171KB

MD5
2dce3da05acacdf790a0e200206fc921

SHA1
8adc6bc3612ce098a230681655cc4a8eaa0338d4

SHA256
be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d

SHA512
762bf52c8ba86d7e4d6ca5aafaa94fefbe4ed23eb07e01e30620c52e00cc9a7d94b36042b4098ddd0c2bb01b84553d2a0d365e2db1fab6a0d1ad7344d38d9c7a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
Filesize
171KB

MD5
2dce3da05acacdf790a0e200206fc921

SHA1
8adc6bc3612ce098a230681655cc4a8eaa0338d4

SHA256
be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d

SHA512
762bf52c8ba86d7e4d6ca5aafaa94fefbe4ed23eb07e01e30620c52e00cc9a7d94b36042b4098ddd0c2bb01b84553d2a0d365e2db1fab6a0d1ad7344d38d9c7a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
Filesize
171KB

MD5
2dce3da05acacdf790a0e200206fc921

SHA1
8adc6bc3612ce098a230681655cc4a8eaa0338d4

SHA256
be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d

SHA512
762bf52c8ba86d7e4d6ca5aafaa94fefbe4ed23eb07e01e30620c52e00cc9a7d94b36042b4098ddd0c2bb01b84553d2a0d365e2db1fab6a0d1ad7344d38d9c7a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
Filesize
171KB

MD5
2dce3da05acacdf790a0e200206fc921

SHA1
8adc6bc3612ce098a230681655cc4a8eaa0338d4

SHA256
be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d

SHA512
762bf52c8ba86d7e4d6ca5aafaa94fefbe4ed23eb07e01e30620c52e00cc9a7d94b36042b4098ddd0c2bb01b84553d2a0d365e2db1fab6a0d1ad7344d38d9c7a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
Filesize
171KB

MD5
2dce3da05acacdf790a0e200206fc921

SHA1
8adc6bc3612ce098a230681655cc4a8eaa0338d4

SHA256
be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d

SHA512
762bf52c8ba86d7e4d6ca5aafaa94fefbe4ed23eb07e01e30620c52e00cc9a7d94b36042b4098ddd0c2bb01b84553d2a0d365e2db1fab6a0d1ad7344d38d9c7a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
Filesize
171KB

MD5
2dce3da05acacdf790a0e200206fc921

SHA1
8adc6bc3612ce098a230681655cc4a8eaa0338d4

SHA256
be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d

SHA512
762bf52c8ba86d7e4d6ca5aafaa94fefbe4ed23eb07e01e30620c52e00cc9a7d94b36042b4098ddd0c2bb01b84553d2a0d365e2db1fab6a0d1ad7344d38d9c7a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
Filesize
171KB

MD5
2dce3da05acacdf790a0e200206fc921

SHA1
8adc6bc3612ce098a230681655cc4a8eaa0338d4

SHA256
be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d

SHA512
762bf52c8ba86d7e4d6ca5aafaa94fefbe4ed23eb07e01e30620c52e00cc9a7d94b36042b4098ddd0c2bb01b84553d2a0d365e2db1fab6a0d1ad7344d38d9c7a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
Filesize
171KB

MD5
2dce3da05acacdf790a0e200206fc921

SHA1
8adc6bc3612ce098a230681655cc4a8eaa0338d4

SHA256
be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d

SHA512
762bf52c8ba86d7e4d6ca5aafaa94fefbe4ed23eb07e01e30620c52e00cc9a7d94b36042b4098ddd0c2bb01b84553d2a0d365e2db1fab6a0d1ad7344d38d9c7a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
Filesize
171KB

MD5
2dce3da05acacdf790a0e200206fc921

SHA1
8adc6bc3612ce098a230681655cc4a8eaa0338d4

SHA256
be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d

SHA512
762bf52c8ba86d7e4d6ca5aafaa94fefbe4ed23eb07e01e30620c52e00cc9a7d94b36042b4098ddd0c2bb01b84553d2a0d365e2db1fab6a0d1ad7344d38d9c7a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
Filesize
171KB

MD5
2dce3da05acacdf790a0e200206fc921

SHA1
8adc6bc3612ce098a230681655cc4a8eaa0338d4

SHA256
be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d

SHA512
762bf52c8ba86d7e4d6ca5aafaa94fefbe4ed23eb07e01e30620c52e00cc9a7d94b36042b4098ddd0c2bb01b84553d2a0d365e2db1fab6a0d1ad7344d38d9c7a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
Filesize
171KB

MD5
2dce3da05acacdf790a0e200206fc921

SHA1
8adc6bc3612ce098a230681655cc4a8eaa0338d4

SHA256
be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d

SHA512
762bf52c8ba86d7e4d6ca5aafaa94fefbe4ed23eb07e01e30620c52e00cc9a7d94b36042b4098ddd0c2bb01b84553d2a0d365e2db1fab6a0d1ad7344d38d9c7a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize
7KB

MD5
3a6b62dfbd93ec35151a47e3cf80ba42

SHA1
617ce5cd2b239d22ba55327ebc451c07e122b0aa

SHA256
a7020cacf3bf8b8ffa0e607d86bef04b70feae58fad8f3b471e1d97bd6af74d1

SHA512
935231f157fe7c0972f670eedb4ec859a32f1334f551ee0a9ea70e887670bf4ae8eec87e3f9dae32b0bd2b1ba3db3c03e811a143b08c7f29498cc94c2fd514a3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize
7KB

MD5
3a6b62dfbd93ec35151a47e3cf80ba42

SHA1
617ce5cd2b239d22ba55327ebc451c07e122b0aa

SHA256
a7020cacf3bf8b8ffa0e607d86bef04b70feae58fad8f3b471e1d97bd6af74d1

SHA512
935231f157fe7c0972f670eedb4ec859a32f1334f551ee0a9ea70e887670bf4ae8eec87e3f9dae32b0bd2b1ba3db3c03e811a143b08c7f29498cc94c2fd514a3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize
7KB

MD5
3a6b62dfbd93ec35151a47e3cf80ba42

SHA1
617ce5cd2b239d22ba55327ebc451c07e122b0aa

SHA256
a7020cacf3bf8b8ffa0e607d86bef04b70feae58fad8f3b471e1d97bd6af74d1

SHA512
935231f157fe7c0972f670eedb4ec859a32f1334f551ee0a9ea70e887670bf4ae8eec87e3f9dae32b0bd2b1ba3db3c03e811a143b08c7f29498cc94c2fd514a3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize
7KB

MD5
3a6b62dfbd93ec35151a47e3cf80ba42

SHA1
617ce5cd2b239d22ba55327ebc451c07e122b0aa

SHA256
a7020cacf3bf8b8ffa0e607d86bef04b70feae58fad8f3b471e1d97bd6af74d1

SHA512
935231f157fe7c0972f670eedb4ec859a32f1334f551ee0a9ea70e887670bf4ae8eec87e3f9dae32b0bd2b1ba3db3c03e811a143b08c7f29498cc94c2fd514a3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize
7KB

MD5
3a6b62dfbd93ec35151a47e3cf80ba42

SHA1
617ce5cd2b239d22ba55327ebc451c07e122b0aa

SHA256
a7020cacf3bf8b8ffa0e607d86bef04b70feae58fad8f3b471e1d97bd6af74d1

SHA512
935231f157fe7c0972f670eedb4ec859a32f1334f551ee0a9ea70e887670bf4ae8eec87e3f9dae32b0bd2b1ba3db3c03e811a143b08c7f29498cc94c2fd514a3

Download Submit
\??\PIPE\srvsvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\srvsvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
Filesize
171KB

MD5
2dce3da05acacdf790a0e200206fc921

SHA1
8adc6bc3612ce098a230681655cc4a8eaa0338d4

SHA256
be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d

SHA512
762bf52c8ba86d7e4d6ca5aafaa94fefbe4ed23eb07e01e30620c52e00cc9a7d94b36042b4098ddd0c2bb01b84553d2a0d365e2db1fab6a0d1ad7344d38d9c7a

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
Filesize
171KB

MD5
2dce3da05acacdf790a0e200206fc921

SHA1
8adc6bc3612ce098a230681655cc4a8eaa0338d4

SHA256
be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d

SHA512
762bf52c8ba86d7e4d6ca5aafaa94fefbe4ed23eb07e01e30620c52e00cc9a7d94b36042b4098ddd0c2bb01b84553d2a0d365e2db1fab6a0d1ad7344d38d9c7a

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
Filesize
171KB

MD5
2dce3da05acacdf790a0e200206fc921

SHA1
8adc6bc3612ce098a230681655cc4a8eaa0338d4

SHA256
be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d

SHA512
762bf52c8ba86d7e4d6ca5aafaa94fefbe4ed23eb07e01e30620c52e00cc9a7d94b36042b4098ddd0c2bb01b84553d2a0d365e2db1fab6a0d1ad7344d38d9c7a

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
Filesize
171KB

MD5
2dce3da05acacdf790a0e200206fc921

SHA1
8adc6bc3612ce098a230681655cc4a8eaa0338d4

SHA256
be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d

SHA512
762bf52c8ba86d7e4d6ca5aafaa94fefbe4ed23eb07e01e30620c52e00cc9a7d94b36042b4098ddd0c2bb01b84553d2a0d365e2db1fab6a0d1ad7344d38d9c7a

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
Filesize
171KB

MD5
2dce3da05acacdf790a0e200206fc921

SHA1
8adc6bc3612ce098a230681655cc4a8eaa0338d4

SHA256
be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d

SHA512
762bf52c8ba86d7e4d6ca5aafaa94fefbe4ed23eb07e01e30620c52e00cc9a7d94b36042b4098ddd0c2bb01b84553d2a0d365e2db1fab6a0d1ad7344d38d9c7a

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
Filesize
171KB

MD5
2dce3da05acacdf790a0e200206fc921

SHA1
8adc6bc3612ce098a230681655cc4a8eaa0338d4

SHA256
be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d

SHA512
762bf52c8ba86d7e4d6ca5aafaa94fefbe4ed23eb07e01e30620c52e00cc9a7d94b36042b4098ddd0c2bb01b84553d2a0d365e2db1fab6a0d1ad7344d38d9c7a

Download Submit
memory/560-58-0x0000000000000000-mapping.dmp

Download
memory/560-61-0x000000006F9B0000-0x000000006FF5B000-memory.dmp

Filesize
5.7MB

Download
memory/560-60-0x000000006F9B0000-0x000000006FF5B000-memory.dmp

Filesize
5.7MB

Download
memory/788-124-0x0000000000000000-mapping.dmp

Download
memory/892-119-0x0000000000402354-mapping.dmp

Download
memory/928-72-0x0000000000000000-mapping.dmp

Download
memory/1284-56-0x0000000005330000-0x00000000053DA000-memory.dmp

Filesize
680KB

Download
memory/1284-57-0x0000000000AD0000-0x0000000000B62000-memory.dmp

Filesize
584KB

Download
memory/1284-54-0x0000000000F00000-0x0000000000F30000-memory.dmp

Filesize
192KB

Download
memory/1284-55-0x00000000762E1000-0x00000000762E3000-memory.dmp

Filesize
8KB

Download
memory/1304-150-0x000000006F970000-0x000000006FF1B000-memory.dmp

Filesize
5.7MB

Download
memory/1304-149-0x000000006F970000-0x000000006FF1B000-memory.dmp

Filesize
5.7MB

Download
memory/1372-106-0x0000000000000000-mapping.dmp

Download
memory/1372-110-0x000000006FBF0000-0x000000007019B000-memory.dmp

Filesize
5.7MB

Download
memory/1372-111-0x000000006FBF0000-0x000000007019B000-memory.dmp

Filesize
5.7MB

Download
memory/1388-130-0x000000006F990000-0x000000006FF3B000-memory.dmp

Filesize
5.7MB

Download
memory/1388-131-0x000000006F990000-0x000000006FF3B000-memory.dmp

Filesize
5.7MB

Download
memory/1388-127-0x0000000000000000-mapping.dmp

Download
memory/1552-84-0x000000006F970000-0x000000006FF1B000-memory.dmp

Filesize
5.7MB

Download
memory/1552-83-0x000000006F970000-0x000000006FF1B000-memory.dmp

Filesize
5.7MB

Download
memory/1552-80-0x0000000000000000-mapping.dmp

Download
memory/1568-95-0x0000000000402354-mapping.dmp

Download
memory/1664-73-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1664-65-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1664-62-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1664-63-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1664-66-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1664-67-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1664-68-0x0000000000402354-mapping.dmp

Download
memory/1664-71-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1716-104-0x0000000000310000-0x0000000000340000-memory.dmp

Filesize
192KB

Download
memory/1716-102-0x0000000000000000-mapping.dmp

Download
memory/1808-144-0x0000000000000000-mapping.dmp

Download
memory/1868-157-0x0000000000000000-mapping.dmp

Download
memory/1868-160-0x000000006F990000-0x000000006FF3B000-memory.dmp

Filesize
5.7MB

Download
memory/1936-101-0x0000000000000000-mapping.dmp

Download
memory/2000-139-0x0000000000402354-mapping.dmp

Download
memory/2004-75-0x0000000000000000-mapping.dmp

Download
memory/2004-77-0x0000000000310000-0x0000000000340000-memory.dmp

Filesize
192KB

Download
memory/2004-79-0x0000000005610000-0x00000000056A2000-memory.dmp

Filesize
584KB

Download
memory/2044-154-0x0000000000000000-mapping.dmp

Download