Analysis
-
max time kernel
139s -
max time network
147s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
31/10/2022, 22:06
Static task
static1
Behavioral task
behavioral1
Sample
d2c7b686b8beb967da1e9928d53720f74150cd68959d07230befd88e1b696107.exe
Resource
win10-20220812-en
General
-
Target
d2c7b686b8beb967da1e9928d53720f74150cd68959d07230befd88e1b696107.exe
-
Size
322KB
-
MD5
76521b8a6bb6305dbe12cac8de1dfb79
-
SHA1
aeb107f63f72ac779395c68e08463c18d7e02eb0
-
SHA256
d2c7b686b8beb967da1e9928d53720f74150cd68959d07230befd88e1b696107
-
SHA512
33644369a8306ab3f98721eae5da84ab5d4e754d6ce6f32e32b4ea55c934c7383407905277179998a57ecdf2feb6f389d32c2b9551956f01b33a2f4aa5c0ebc8
-
SSDEEP
6144:eKlzr1sYCzek2ciDaP9Xk6Ln1W8W/9InBSkZZmLdGcAdgdY6RKpjS:eGhQ2ciDq9ZL1W8q9InBRqELdolRKpj
Malware Config
Signatures
-
Executes dropped EXE 6 IoCs
pid Process 4800 oobeldr.exe 2884 oobeldr.exe 4548 oobeldr.exe 3164 oobeldr.exe 1820 oobeldr.exe 2760 oobeldr.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 2700 set thread context of 4776 2700 d2c7b686b8beb967da1e9928d53720f74150cd68959d07230befd88e1b696107.exe 67 PID 4800 set thread context of 2884 4800 oobeldr.exe 71 PID 4548 set thread context of 3164 4548 oobeldr.exe 75 PID 1820 set thread context of 2760 1820 oobeldr.exe 77 -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1364 schtasks.exe 3256 schtasks.exe -
Suspicious use of WriteProcessMemory 45 IoCs
description pid Process procid_target PID 2700 wrote to memory of 4772 2700 d2c7b686b8beb967da1e9928d53720f74150cd68959d07230befd88e1b696107.exe 66 PID 2700 wrote to memory of 4772 2700 d2c7b686b8beb967da1e9928d53720f74150cd68959d07230befd88e1b696107.exe 66 PID 2700 wrote to memory of 4772 2700 d2c7b686b8beb967da1e9928d53720f74150cd68959d07230befd88e1b696107.exe 66 PID 2700 wrote to memory of 4776 2700 d2c7b686b8beb967da1e9928d53720f74150cd68959d07230befd88e1b696107.exe 67 PID 2700 wrote to memory of 4776 2700 d2c7b686b8beb967da1e9928d53720f74150cd68959d07230befd88e1b696107.exe 67 PID 2700 wrote to memory of 4776 2700 d2c7b686b8beb967da1e9928d53720f74150cd68959d07230befd88e1b696107.exe 67 PID 2700 wrote to memory of 4776 2700 d2c7b686b8beb967da1e9928d53720f74150cd68959d07230befd88e1b696107.exe 67 PID 2700 wrote to memory of 4776 2700 d2c7b686b8beb967da1e9928d53720f74150cd68959d07230befd88e1b696107.exe 67 PID 2700 wrote to memory of 4776 2700 d2c7b686b8beb967da1e9928d53720f74150cd68959d07230befd88e1b696107.exe 67 PID 2700 wrote to memory of 4776 2700 d2c7b686b8beb967da1e9928d53720f74150cd68959d07230befd88e1b696107.exe 67 PID 2700 wrote to memory of 4776 2700 d2c7b686b8beb967da1e9928d53720f74150cd68959d07230befd88e1b696107.exe 67 PID 2700 wrote to memory of 4776 2700 d2c7b686b8beb967da1e9928d53720f74150cd68959d07230befd88e1b696107.exe 67 PID 4776 wrote to memory of 1364 4776 d2c7b686b8beb967da1e9928d53720f74150cd68959d07230befd88e1b696107.exe 68 PID 4776 wrote to memory of 1364 4776 d2c7b686b8beb967da1e9928d53720f74150cd68959d07230befd88e1b696107.exe 68 PID 4776 wrote to memory of 1364 4776 d2c7b686b8beb967da1e9928d53720f74150cd68959d07230befd88e1b696107.exe 68 PID 4800 wrote to memory of 2884 4800 oobeldr.exe 71 PID 4800 wrote to memory of 2884 4800 oobeldr.exe 71 PID 4800 wrote to memory of 2884 4800 oobeldr.exe 71 PID 4800 wrote to memory of 2884 4800 oobeldr.exe 71 PID 4800 wrote to memory of 2884 4800 oobeldr.exe 71 PID 4800 wrote to memory of 2884 4800 oobeldr.exe 71 PID 4800 wrote to memory of 2884 4800 oobeldr.exe 71 PID 4800 wrote to memory of 2884 4800 oobeldr.exe 71 PID 4800 wrote to memory of 2884 4800 oobeldr.exe 71 PID 2884 wrote to memory of 3256 2884 oobeldr.exe 72 PID 2884 wrote to memory of 3256 2884 oobeldr.exe 72 PID 2884 wrote to memory of 3256 2884 oobeldr.exe 72 PID 4548 wrote to memory of 3164 4548 oobeldr.exe 75 PID 4548 wrote to memory of 3164 4548 oobeldr.exe 75 PID 4548 wrote to memory of 3164 4548 oobeldr.exe 75 PID 4548 wrote to memory of 3164 4548 oobeldr.exe 75 PID 4548 wrote to memory of 3164 4548 oobeldr.exe 75 PID 4548 wrote to memory of 3164 4548 oobeldr.exe 75 PID 4548 wrote to memory of 3164 4548 oobeldr.exe 75 PID 4548 wrote to memory of 3164 4548 oobeldr.exe 75 PID 4548 wrote to memory of 3164 4548 oobeldr.exe 75 PID 1820 wrote to memory of 2760 1820 oobeldr.exe 77 PID 1820 wrote to memory of 2760 1820 oobeldr.exe 77 PID 1820 wrote to memory of 2760 1820 oobeldr.exe 77 PID 1820 wrote to memory of 2760 1820 oobeldr.exe 77 PID 1820 wrote to memory of 2760 1820 oobeldr.exe 77 PID 1820 wrote to memory of 2760 1820 oobeldr.exe 77 PID 1820 wrote to memory of 2760 1820 oobeldr.exe 77 PID 1820 wrote to memory of 2760 1820 oobeldr.exe 77 PID 1820 wrote to memory of 2760 1820 oobeldr.exe 77
Processes
-
C:\Users\Admin\AppData\Local\Temp\d2c7b686b8beb967da1e9928d53720f74150cd68959d07230befd88e1b696107.exe"C:\Users\Admin\AppData\Local\Temp\d2c7b686b8beb967da1e9928d53720f74150cd68959d07230befd88e1b696107.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\d2c7b686b8beb967da1e9928d53720f74150cd68959d07230befd88e1b696107.exeC:\Users\Admin\AppData\Local\Temp\d2c7b686b8beb967da1e9928d53720f74150cd68959d07230befd88e1b696107.exe2⤵PID:4772
-
-
C:\Users\Admin\AppData\Local\Temp\d2c7b686b8beb967da1e9928d53720f74150cd68959d07230befd88e1b696107.exeC:\Users\Admin\AppData\Local\Temp\d2c7b686b8beb967da1e9928d53720f74150cd68959d07230befd88e1b696107.exe2⤵
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
PID:1364
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
PID:3256
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
PID:3164
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
PID:2760
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
789B
MD5db5ef8d7c51bad129d9097bf953e4913
SHA18439db960aa2d431bf5ec3c37af775b45eb07e06
SHA2561248e67f10b47b397af3c8cbe342bad4be75c68b8e10f4ec6341195cc3138bd9
SHA51204572485790b25e1751347e43b47174051cd153dd75fd55ee5590d25a2579f344cd96cf86cf45bdb7759e3e6d0f734d0ff717148ca70f501b9869e964e036fee
-
Filesize
322KB
MD576521b8a6bb6305dbe12cac8de1dfb79
SHA1aeb107f63f72ac779395c68e08463c18d7e02eb0
SHA256d2c7b686b8beb967da1e9928d53720f74150cd68959d07230befd88e1b696107
SHA51233644369a8306ab3f98721eae5da84ab5d4e754d6ce6f32e32b4ea55c934c7383407905277179998a57ecdf2feb6f389d32c2b9551956f01b33a2f4aa5c0ebc8
-
Filesize
322KB
MD576521b8a6bb6305dbe12cac8de1dfb79
SHA1aeb107f63f72ac779395c68e08463c18d7e02eb0
SHA256d2c7b686b8beb967da1e9928d53720f74150cd68959d07230befd88e1b696107
SHA51233644369a8306ab3f98721eae5da84ab5d4e754d6ce6f32e32b4ea55c934c7383407905277179998a57ecdf2feb6f389d32c2b9551956f01b33a2f4aa5c0ebc8
-
Filesize
322KB
MD576521b8a6bb6305dbe12cac8de1dfb79
SHA1aeb107f63f72ac779395c68e08463c18d7e02eb0
SHA256d2c7b686b8beb967da1e9928d53720f74150cd68959d07230befd88e1b696107
SHA51233644369a8306ab3f98721eae5da84ab5d4e754d6ce6f32e32b4ea55c934c7383407905277179998a57ecdf2feb6f389d32c2b9551956f01b33a2f4aa5c0ebc8
-
Filesize
322KB
MD576521b8a6bb6305dbe12cac8de1dfb79
SHA1aeb107f63f72ac779395c68e08463c18d7e02eb0
SHA256d2c7b686b8beb967da1e9928d53720f74150cd68959d07230befd88e1b696107
SHA51233644369a8306ab3f98721eae5da84ab5d4e754d6ce6f32e32b4ea55c934c7383407905277179998a57ecdf2feb6f389d32c2b9551956f01b33a2f4aa5c0ebc8
-
Filesize
322KB
MD576521b8a6bb6305dbe12cac8de1dfb79
SHA1aeb107f63f72ac779395c68e08463c18d7e02eb0
SHA256d2c7b686b8beb967da1e9928d53720f74150cd68959d07230befd88e1b696107
SHA51233644369a8306ab3f98721eae5da84ab5d4e754d6ce6f32e32b4ea55c934c7383407905277179998a57ecdf2feb6f389d32c2b9551956f01b33a2f4aa5c0ebc8
-
Filesize
322KB
MD576521b8a6bb6305dbe12cac8de1dfb79
SHA1aeb107f63f72ac779395c68e08463c18d7e02eb0
SHA256d2c7b686b8beb967da1e9928d53720f74150cd68959d07230befd88e1b696107
SHA51233644369a8306ab3f98721eae5da84ab5d4e754d6ce6f32e32b4ea55c934c7383407905277179998a57ecdf2feb6f389d32c2b9551956f01b33a2f4aa5c0ebc8
-
Filesize
322KB
MD576521b8a6bb6305dbe12cac8de1dfb79
SHA1aeb107f63f72ac779395c68e08463c18d7e02eb0
SHA256d2c7b686b8beb967da1e9928d53720f74150cd68959d07230befd88e1b696107
SHA51233644369a8306ab3f98721eae5da84ab5d4e754d6ce6f32e32b4ea55c934c7383407905277179998a57ecdf2feb6f389d32c2b9551956f01b33a2f4aa5c0ebc8