be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d

Analysis

max time kernel
270s
max time network
273s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
21-09-2022 10:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe
Size

171KB
MD5

2dce3da05acacdf790a0e200206fc921
SHA1

8adc6bc3612ce098a230681655cc4a8eaa0338d4
SHA256

be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d
SHA512

762bf52c8ba86d7e4d6ca5aafaa94fefbe4ed23eb07e01e30620c52e00cc9a7d94b36042b4098ddd0c2bb01b84553d2a0d365e2db1fab6a0d1ad7344d38d9c7a
SSDEEP

1536:GVS32qHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHU//rT//j:LVMMMZMMMMMMMMMMMMz

Score

8^/10

agilenet

Malware Config

Signatures

Executes dropped EXE 10 IoCs

Processes:

oobeldr.exeoobeldr.exeoobeldr.exeoobeldr.exeoobeldr.exeoobeldr.exeoobeldr.exeoobeldr.exeoobeldr.exeoobeldr.exe

pid	process
1084	oobeldr.exe
1112	oobeldr.exe
1576	oobeldr.exe
588	oobeldr.exe
996	oobeldr.exe
772	oobeldr.exe
584	oobeldr.exe
1596	oobeldr.exe
1240	oobeldr.exe
1788	oobeldr.exe

Loads dropped DLL 6 IoCs

Processes:

oobeldr.exeoobeldr.exeoobeldr.exeoobeldr.exe

pid process

1084 oobeldr.exe
1576 oobeldr.exe
1576 oobeldr.exe
772 oobeldr.exe
1596 oobeldr.exe
1596 oobeldr.exe

Obfuscated with Agile.Net obfuscator 20 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
behavioral1/memory/1960-54-0x0000000000F80000-0x0000000000FB0000-memory.dmp	agile_net
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe	agile_net
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe	agile_net
behavioral1/memory/1084-77-0x0000000000190000-0x00000000001C0000-memory.dmp	agile_net
\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe	agile_net
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe	agile_net
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe	agile_net
behavioral1/memory/1576-99-0x0000000000190000-0x00000000001C0000-memory.dmp	agile_net
\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe	agile_net
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe	agile_net
\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe	agile_net
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe	agile_net
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe	agile_net
\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe	agile_net
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe	agile_net
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe	agile_net
\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe	agile_net
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe	agile_net
\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe	agile_net
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe	agile_net

Drops file in System32 directory 4 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of SetThreadContext 5 IoCs

Processes:

be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exeoobeldr.exeoobeldr.exeoobeldr.exeoobeldr.exe

description	pid	process	target process
PID 1960 set thread context of 1272	1960	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe
PID 1084 set thread context of 1112	1084	oobeldr.exe	oobeldr.exe
PID 1576 set thread context of 996	1576	oobeldr.exe	oobeldr.exe
PID 772 set thread context of 584	772	oobeldr.exe	oobeldr.exe
PID 1596 set thread context of 1788	1596	oobeldr.exe	oobeldr.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

1660 schtasks.exe
1056 schtasks.exe

pid	process
1660	schtasks.exe
1056	schtasks.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

Processes:

powershell.exebe39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exepowershell.exeoobeldr.exepowershell.exeoobeldr.exepowershell.exeoobeldr.exepowershell.exeoobeldr.exe

pid	process
1616	powershell.exe
1960	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe
1960	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe
1960	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe
112	powershell.exe
1084	oobeldr.exe
1084	oobeldr.exe
1980	powershell.exe
1576	oobeldr.exe
1576	oobeldr.exe
1576	oobeldr.exe
1696	powershell.exe
772	oobeldr.exe
772	oobeldr.exe
1556	powershell.exe
1596	oobeldr.exe
1596	oobeldr.exe
1596	oobeldr.exe
1596	oobeldr.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

Processes:

be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exepowershell.exeoobeldr.exepowershell.exeoobeldr.exepowershell.exeoobeldr.exepowershell.exeoobeldr.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	1960	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe
Token: SeDebugPrivilege	1616	powershell.exe
Token: SeDebugPrivilege	1084	oobeldr.exe
Token: SeDebugPrivilege	112	powershell.exe
Token: SeDebugPrivilege	1576	oobeldr.exe
Token: SeDebugPrivilege	1980	powershell.exe
Token: SeDebugPrivilege	772	oobeldr.exe
Token: SeDebugPrivilege	1696	powershell.exe
Token: SeDebugPrivilege	1596	oobeldr.exe
Token: SeDebugPrivilege	1556	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exebe39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exetaskeng.exeoobeldr.exeoobeldr.exeoobeldr.exe

description	pid	process	target process
PID 1960 wrote to memory of 1616	1960	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe	powershell.exe
PID 1960 wrote to memory of 1616	1960	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe	powershell.exe
PID 1960 wrote to memory of 1616	1960	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe	powershell.exe
PID 1960 wrote to memory of 1616	1960	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe	powershell.exe
PID 1960 wrote to memory of 596	1960	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe
PID 1960 wrote to memory of 596	1960	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe
PID 1960 wrote to memory of 596	1960	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe
PID 1960 wrote to memory of 596	1960	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe
PID 1960 wrote to memory of 596	1960	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe
PID 1960 wrote to memory of 596	1960	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe
PID 1960 wrote to memory of 596	1960	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe
PID 1960 wrote to memory of 1272	1960	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe
PID 1960 wrote to memory of 1272	1960	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe
PID 1960 wrote to memory of 1272	1960	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe
PID 1960 wrote to memory of 1272	1960	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe
PID 1960 wrote to memory of 1272	1960	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe
PID 1960 wrote to memory of 1272	1960	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe
PID 1960 wrote to memory of 1272	1960	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe
PID 1960 wrote to memory of 1272	1960	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe
PID 1960 wrote to memory of 1272	1960	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe
PID 1960 wrote to memory of 1272	1960	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe
PID 1960 wrote to memory of 1272	1960	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe
PID 1960 wrote to memory of 1272	1960	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe
PID 1272 wrote to memory of 1660	1272	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe	schtasks.exe
PID 1272 wrote to memory of 1660	1272	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe	schtasks.exe
PID 1272 wrote to memory of 1660	1272	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe	schtasks.exe
PID 1272 wrote to memory of 1660	1272	be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe	schtasks.exe
PID 1928 wrote to memory of 1084	1928	taskeng.exe	oobeldr.exe
PID 1928 wrote to memory of 1084	1928	taskeng.exe	oobeldr.exe
PID 1928 wrote to memory of 1084	1928	taskeng.exe	oobeldr.exe
PID 1928 wrote to memory of 1084	1928	taskeng.exe	oobeldr.exe
PID 1928 wrote to memory of 1084	1928	taskeng.exe	oobeldr.exe
PID 1928 wrote to memory of 1084	1928	taskeng.exe	oobeldr.exe
PID 1928 wrote to memory of 1084	1928	taskeng.exe	oobeldr.exe
PID 1084 wrote to memory of 112	1084	oobeldr.exe	powershell.exe
PID 1084 wrote to memory of 112	1084	oobeldr.exe	powershell.exe
PID 1084 wrote to memory of 112	1084	oobeldr.exe	powershell.exe
PID 1084 wrote to memory of 112	1084	oobeldr.exe	powershell.exe
PID 1084 wrote to memory of 1112	1084	oobeldr.exe	oobeldr.exe
PID 1084 wrote to memory of 1112	1084	oobeldr.exe	oobeldr.exe
PID 1084 wrote to memory of 1112	1084	oobeldr.exe	oobeldr.exe
PID 1084 wrote to memory of 1112	1084	oobeldr.exe	oobeldr.exe
PID 1084 wrote to memory of 1112	1084	oobeldr.exe	oobeldr.exe
PID 1084 wrote to memory of 1112	1084	oobeldr.exe	oobeldr.exe
PID 1084 wrote to memory of 1112	1084	oobeldr.exe	oobeldr.exe
PID 1084 wrote to memory of 1112	1084	oobeldr.exe	oobeldr.exe
PID 1084 wrote to memory of 1112	1084	oobeldr.exe	oobeldr.exe
PID 1084 wrote to memory of 1112	1084	oobeldr.exe	oobeldr.exe
PID 1084 wrote to memory of 1112	1084	oobeldr.exe	oobeldr.exe
PID 1084 wrote to memory of 1112	1084	oobeldr.exe	oobeldr.exe
PID 1112 wrote to memory of 1056	1112	oobeldr.exe	schtasks.exe
PID 1112 wrote to memory of 1056	1112	oobeldr.exe	schtasks.exe
PID 1112 wrote to memory of 1056	1112	oobeldr.exe	schtasks.exe
PID 1112 wrote to memory of 1056	1112	oobeldr.exe	schtasks.exe
PID 1928 wrote to memory of 1576	1928	taskeng.exe	oobeldr.exe
PID 1928 wrote to memory of 1576	1928	taskeng.exe	oobeldr.exe
PID 1928 wrote to memory of 1576	1928	taskeng.exe	oobeldr.exe
PID 1928 wrote to memory of 1576	1928	taskeng.exe	oobeldr.exe
PID 1928 wrote to memory of 1576	1928	taskeng.exe	oobeldr.exe
PID 1928 wrote to memory of 1576	1928	taskeng.exe	oobeldr.exe
PID 1928 wrote to memory of 1576	1928	taskeng.exe	oobeldr.exe
PID 1576 wrote to memory of 1980	1576	oobeldr.exe	powershell.exe
PID 1576 wrote to memory of 1980	1576	oobeldr.exe	powershell.exe
PID 1576 wrote to memory of 1980	1576	oobeldr.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe
"C:\Users\Admin\AppData\Local\Temp\be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1960

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQA1AA==
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1616

C:\Users\Admin\AppData\Local\Temp\be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe
C:\Users\Admin\AppData\Local\Temp\be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe
2⤵
PID:596

C:\Users\Admin\AppData\Local\Temp\be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe
C:\Users\Admin\AppData\Local\Temp\be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:1272

C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
3⤵
- Creates scheduled task(s)
PID:1660

C:\Windows\system32\taskeng.exe
taskeng.exe {74BBE7E2-E9F8-4FAB-8887-1838F2878A7E} S-1-5-21-3845472200-3839195424-595303356-1000:ZERMMMDR\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1928

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1084

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQA1AA==
3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:112

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1576

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQA1AA==
3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1980

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
3⤵
- Executes dropped EXE
PID:588

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
3⤵
- Executes dropped EXE
PID:996

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:772

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQA1AA==
3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1696

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
3⤵
- Executes dropped EXE
PID:584

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1596

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQA1AA==
3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1556

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
3⤵
- Executes dropped EXE
PID:1240

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
3⤵
- Executes dropped EXE
PID:1788

C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
1⤵
- Creates scheduled task(s)
PID:1056

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
Filesize
171KB

MD5
2dce3da05acacdf790a0e200206fc921

SHA1
8adc6bc3612ce098a230681655cc4a8eaa0338d4

SHA256
be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d

SHA512
762bf52c8ba86d7e4d6ca5aafaa94fefbe4ed23eb07e01e30620c52e00cc9a7d94b36042b4098ddd0c2bb01b84553d2a0d365e2db1fab6a0d1ad7344d38d9c7a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
Filesize
171KB

MD5
2dce3da05acacdf790a0e200206fc921

SHA1
8adc6bc3612ce098a230681655cc4a8eaa0338d4

SHA256
be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d

SHA512
762bf52c8ba86d7e4d6ca5aafaa94fefbe4ed23eb07e01e30620c52e00cc9a7d94b36042b4098ddd0c2bb01b84553d2a0d365e2db1fab6a0d1ad7344d38d9c7a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
Filesize
171KB

MD5
2dce3da05acacdf790a0e200206fc921

SHA1
8adc6bc3612ce098a230681655cc4a8eaa0338d4

SHA256
be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d

SHA512
762bf52c8ba86d7e4d6ca5aafaa94fefbe4ed23eb07e01e30620c52e00cc9a7d94b36042b4098ddd0c2bb01b84553d2a0d365e2db1fab6a0d1ad7344d38d9c7a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
Filesize
171KB

MD5
2dce3da05acacdf790a0e200206fc921

SHA1
8adc6bc3612ce098a230681655cc4a8eaa0338d4

SHA256
be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d

SHA512
762bf52c8ba86d7e4d6ca5aafaa94fefbe4ed23eb07e01e30620c52e00cc9a7d94b36042b4098ddd0c2bb01b84553d2a0d365e2db1fab6a0d1ad7344d38d9c7a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
Filesize
171KB

MD5
2dce3da05acacdf790a0e200206fc921

SHA1
8adc6bc3612ce098a230681655cc4a8eaa0338d4

SHA256
be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d

SHA512
762bf52c8ba86d7e4d6ca5aafaa94fefbe4ed23eb07e01e30620c52e00cc9a7d94b36042b4098ddd0c2bb01b84553d2a0d365e2db1fab6a0d1ad7344d38d9c7a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
Filesize
171KB

MD5
2dce3da05acacdf790a0e200206fc921

SHA1
8adc6bc3612ce098a230681655cc4a8eaa0338d4

SHA256
be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d

SHA512
762bf52c8ba86d7e4d6ca5aafaa94fefbe4ed23eb07e01e30620c52e00cc9a7d94b36042b4098ddd0c2bb01b84553d2a0d365e2db1fab6a0d1ad7344d38d9c7a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
Filesize
171KB

MD5
2dce3da05acacdf790a0e200206fc921

SHA1
8adc6bc3612ce098a230681655cc4a8eaa0338d4

SHA256
be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d

SHA512
762bf52c8ba86d7e4d6ca5aafaa94fefbe4ed23eb07e01e30620c52e00cc9a7d94b36042b4098ddd0c2bb01b84553d2a0d365e2db1fab6a0d1ad7344d38d9c7a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
Filesize
171KB

MD5
2dce3da05acacdf790a0e200206fc921

SHA1
8adc6bc3612ce098a230681655cc4a8eaa0338d4

SHA256
be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d

SHA512
762bf52c8ba86d7e4d6ca5aafaa94fefbe4ed23eb07e01e30620c52e00cc9a7d94b36042b4098ddd0c2bb01b84553d2a0d365e2db1fab6a0d1ad7344d38d9c7a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
Filesize
171KB

MD5
2dce3da05acacdf790a0e200206fc921

SHA1
8adc6bc3612ce098a230681655cc4a8eaa0338d4

SHA256
be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d

SHA512
762bf52c8ba86d7e4d6ca5aafaa94fefbe4ed23eb07e01e30620c52e00cc9a7d94b36042b4098ddd0c2bb01b84553d2a0d365e2db1fab6a0d1ad7344d38d9c7a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
Filesize
171KB

MD5
2dce3da05acacdf790a0e200206fc921

SHA1
8adc6bc3612ce098a230681655cc4a8eaa0338d4

SHA256
be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d

SHA512
762bf52c8ba86d7e4d6ca5aafaa94fefbe4ed23eb07e01e30620c52e00cc9a7d94b36042b4098ddd0c2bb01b84553d2a0d365e2db1fab6a0d1ad7344d38d9c7a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
Filesize
171KB

MD5
2dce3da05acacdf790a0e200206fc921

SHA1
8adc6bc3612ce098a230681655cc4a8eaa0338d4

SHA256
be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d

SHA512
762bf52c8ba86d7e4d6ca5aafaa94fefbe4ed23eb07e01e30620c52e00cc9a7d94b36042b4098ddd0c2bb01b84553d2a0d365e2db1fab6a0d1ad7344d38d9c7a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize
7KB

MD5
b36a53f18b51b48ce5b4b98fc03a9cfe

SHA1
eb9fc70fefbec7259645fe1b599ac754c631f919

SHA256
7f50abfe483c91e361a0fdc72984a89d42e9a09d40fae8c33bf0257a5324428e

SHA512
488fd15765990a589cd01320eea98fa44b1b09698f91777d09de3b7dd5dece91cb8cc84db25a19dc6e664b1a0e5cb804f8773ebf90d66a809335d64ba0a9e650

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize
7KB

MD5
b36a53f18b51b48ce5b4b98fc03a9cfe

SHA1
eb9fc70fefbec7259645fe1b599ac754c631f919

SHA256
7f50abfe483c91e361a0fdc72984a89d42e9a09d40fae8c33bf0257a5324428e

SHA512
488fd15765990a589cd01320eea98fa44b1b09698f91777d09de3b7dd5dece91cb8cc84db25a19dc6e664b1a0e5cb804f8773ebf90d66a809335d64ba0a9e650

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize
7KB

MD5
b36a53f18b51b48ce5b4b98fc03a9cfe

SHA1
eb9fc70fefbec7259645fe1b599ac754c631f919

SHA256
7f50abfe483c91e361a0fdc72984a89d42e9a09d40fae8c33bf0257a5324428e

SHA512
488fd15765990a589cd01320eea98fa44b1b09698f91777d09de3b7dd5dece91cb8cc84db25a19dc6e664b1a0e5cb804f8773ebf90d66a809335d64ba0a9e650

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize
7KB

MD5
b36a53f18b51b48ce5b4b98fc03a9cfe

SHA1
eb9fc70fefbec7259645fe1b599ac754c631f919

SHA256
7f50abfe483c91e361a0fdc72984a89d42e9a09d40fae8c33bf0257a5324428e

SHA512
488fd15765990a589cd01320eea98fa44b1b09698f91777d09de3b7dd5dece91cb8cc84db25a19dc6e664b1a0e5cb804f8773ebf90d66a809335d64ba0a9e650

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
Filesize
171KB

MD5
2dce3da05acacdf790a0e200206fc921

SHA1
8adc6bc3612ce098a230681655cc4a8eaa0338d4

SHA256
be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d

SHA512
762bf52c8ba86d7e4d6ca5aafaa94fefbe4ed23eb07e01e30620c52e00cc9a7d94b36042b4098ddd0c2bb01b84553d2a0d365e2db1fab6a0d1ad7344d38d9c7a

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
Filesize
171KB

MD5
2dce3da05acacdf790a0e200206fc921

SHA1
8adc6bc3612ce098a230681655cc4a8eaa0338d4

SHA256
be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d

SHA512
762bf52c8ba86d7e4d6ca5aafaa94fefbe4ed23eb07e01e30620c52e00cc9a7d94b36042b4098ddd0c2bb01b84553d2a0d365e2db1fab6a0d1ad7344d38d9c7a

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
Filesize
171KB

MD5
2dce3da05acacdf790a0e200206fc921

SHA1
8adc6bc3612ce098a230681655cc4a8eaa0338d4

SHA256
be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d

SHA512
762bf52c8ba86d7e4d6ca5aafaa94fefbe4ed23eb07e01e30620c52e00cc9a7d94b36042b4098ddd0c2bb01b84553d2a0d365e2db1fab6a0d1ad7344d38d9c7a

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
Filesize
171KB

MD5
2dce3da05acacdf790a0e200206fc921

SHA1
8adc6bc3612ce098a230681655cc4a8eaa0338d4

SHA256
be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d

SHA512
762bf52c8ba86d7e4d6ca5aafaa94fefbe4ed23eb07e01e30620c52e00cc9a7d94b36042b4098ddd0c2bb01b84553d2a0d365e2db1fab6a0d1ad7344d38d9c7a

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
Filesize
171KB

MD5
2dce3da05acacdf790a0e200206fc921

SHA1
8adc6bc3612ce098a230681655cc4a8eaa0338d4

SHA256
be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d

SHA512
762bf52c8ba86d7e4d6ca5aafaa94fefbe4ed23eb07e01e30620c52e00cc9a7d94b36042b4098ddd0c2bb01b84553d2a0d365e2db1fab6a0d1ad7344d38d9c7a

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
Filesize
171KB

MD5
2dce3da05acacdf790a0e200206fc921

SHA1
8adc6bc3612ce098a230681655cc4a8eaa0338d4

SHA256
be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d

SHA512
762bf52c8ba86d7e4d6ca5aafaa94fefbe4ed23eb07e01e30620c52e00cc9a7d94b36042b4098ddd0c2bb01b84553d2a0d365e2db1fab6a0d1ad7344d38d9c7a

Download Submit
memory/112-79-0x0000000000000000-mapping.dmp

Download
memory/112-82-0x000000006EE20000-0x000000006F3CB000-memory.dmp

Filesize
5.7MB

Download
memory/112-83-0x000000006EE20000-0x000000006F3CB000-memory.dmp

Filesize
5.7MB

Download
memory/584-135-0x0000000000402354-mapping.dmp

Download
memory/772-120-0x0000000000000000-mapping.dmp

Download
memory/996-115-0x0000000000402354-mapping.dmp

Download
memory/1056-96-0x0000000000000000-mapping.dmp

Download
memory/1084-77-0x0000000000190000-0x00000000001C0000-memory.dmp

Filesize
192KB

Download
memory/1084-75-0x0000000000000000-mapping.dmp

Download
memory/1112-91-0x0000000000402354-mapping.dmp

Download
memory/1272-65-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1272-63-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1272-62-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1272-66-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1272-67-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1272-71-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1272-68-0x0000000000402354-mapping.dmp

Download
memory/1272-73-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1556-146-0x000000006F2D0000-0x000000006F87B000-memory.dmp

Filesize
5.7MB

Download
memory/1556-143-0x0000000000000000-mapping.dmp

Download
memory/1556-147-0x000000006F2D0000-0x000000006F87B000-memory.dmp

Filesize
5.7MB

Download
memory/1576-99-0x0000000000190000-0x00000000001C0000-memory.dmp

Filesize
192KB

Download
memory/1576-97-0x0000000000000000-mapping.dmp

Download
memory/1596-140-0x0000000000000000-mapping.dmp

Download
memory/1616-58-0x0000000000000000-mapping.dmp

Download
memory/1616-60-0x000000006F300000-0x000000006F8AB000-memory.dmp

Filesize
5.7MB

Download
memory/1616-61-0x000000006F300000-0x000000006F8AB000-memory.dmp

Filesize
5.7MB

Download
memory/1660-72-0x0000000000000000-mapping.dmp

Download
memory/1696-127-0x000000006EE20000-0x000000006F3CB000-memory.dmp

Filesize
5.7MB

Download
memory/1696-126-0x000000006EE20000-0x000000006F3CB000-memory.dmp

Filesize
5.7MB

Download
memory/1696-123-0x0000000000000000-mapping.dmp

Download
memory/1788-157-0x0000000000402354-mapping.dmp

Download
memory/1960-54-0x0000000000F80000-0x0000000000FB0000-memory.dmp

Filesize
192KB

Download
memory/1960-57-0x00000000056D0000-0x0000000005762000-memory.dmp

Filesize
584KB

Download
memory/1960-56-0x0000000005510000-0x00000000055BA000-memory.dmp

Filesize
680KB

Download
memory/1960-55-0x00000000751A1000-0x00000000751A3000-memory.dmp

Filesize
8KB

Download
memory/1980-105-0x000000006F2E0000-0x000000006F88B000-memory.dmp

Filesize
5.7MB

Download
memory/1980-101-0x0000000000000000-mapping.dmp

Download
memory/1980-104-0x000000006F2E0000-0x000000006F88B000-memory.dmp

Filesize
5.7MB

Download