Analysis
-
max time kernel
149s -
max time network
144s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
31/10/2022, 22:07
Static task
static1
Behavioral task
behavioral1
Sample
a5ad4f2278b36c0c50dfcd4c5ccdc25808707ef4c80e8e11c286d93859c137f6.exe
Resource
win10-20220812-en
General
-
Target
a5ad4f2278b36c0c50dfcd4c5ccdc25808707ef4c80e8e11c286d93859c137f6.exe
-
Size
322KB
-
MD5
9adb6aeea617fad0256cd0926ff7ca09
-
SHA1
5b78fe73d6d0cf33a2762203f3c5f6a2e809b3c9
-
SHA256
a5ad4f2278b36c0c50dfcd4c5ccdc25808707ef4c80e8e11c286d93859c137f6
-
SHA512
db269b6d425dc8b2af29e96b9a29c16d3cb242a6bc4a9fc30805a216a3b8664215e885644353cf7d1079af443f406d2801801d2ed92e9ba37a5fd9661d5e98cb
-
SSDEEP
6144:eKlzr1sYCzek2ciDaP9Xk6Ln1W8W/9InBSkZZmLdGcAdgdY6RKpjS:eGhQ2ciDq9ZL1W8q9InBRqELdolRKpj
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 4288 oobeldr.exe 4944 oobeldr.exe 3980 oobeldr.exe 4900 oobeldr.exe 784 oobeldr.exe 924 oobeldr.exe 2432 oobeldr.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2668 set thread context of 1824 2668 a5ad4f2278b36c0c50dfcd4c5ccdc25808707ef4c80e8e11c286d93859c137f6.exe 66 PID 4288 set thread context of 3980 4288 oobeldr.exe 71 PID 4900 set thread context of 784 4900 oobeldr.exe 75 -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4312 schtasks.exe 4524 schtasks.exe -
Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 2668 wrote to memory of 1824 2668 a5ad4f2278b36c0c50dfcd4c5ccdc25808707ef4c80e8e11c286d93859c137f6.exe 66 PID 2668 wrote to memory of 1824 2668 a5ad4f2278b36c0c50dfcd4c5ccdc25808707ef4c80e8e11c286d93859c137f6.exe 66 PID 2668 wrote to memory of 1824 2668 a5ad4f2278b36c0c50dfcd4c5ccdc25808707ef4c80e8e11c286d93859c137f6.exe 66 PID 2668 wrote to memory of 1824 2668 a5ad4f2278b36c0c50dfcd4c5ccdc25808707ef4c80e8e11c286d93859c137f6.exe 66 PID 2668 wrote to memory of 1824 2668 a5ad4f2278b36c0c50dfcd4c5ccdc25808707ef4c80e8e11c286d93859c137f6.exe 66 PID 2668 wrote to memory of 1824 2668 a5ad4f2278b36c0c50dfcd4c5ccdc25808707ef4c80e8e11c286d93859c137f6.exe 66 PID 2668 wrote to memory of 1824 2668 a5ad4f2278b36c0c50dfcd4c5ccdc25808707ef4c80e8e11c286d93859c137f6.exe 66 PID 2668 wrote to memory of 1824 2668 a5ad4f2278b36c0c50dfcd4c5ccdc25808707ef4c80e8e11c286d93859c137f6.exe 66 PID 2668 wrote to memory of 1824 2668 a5ad4f2278b36c0c50dfcd4c5ccdc25808707ef4c80e8e11c286d93859c137f6.exe 66 PID 1824 wrote to memory of 4312 1824 a5ad4f2278b36c0c50dfcd4c5ccdc25808707ef4c80e8e11c286d93859c137f6.exe 68 PID 1824 wrote to memory of 4312 1824 a5ad4f2278b36c0c50dfcd4c5ccdc25808707ef4c80e8e11c286d93859c137f6.exe 68 PID 1824 wrote to memory of 4312 1824 a5ad4f2278b36c0c50dfcd4c5ccdc25808707ef4c80e8e11c286d93859c137f6.exe 68 PID 4288 wrote to memory of 4944 4288 oobeldr.exe 70 PID 4288 wrote to memory of 4944 4288 oobeldr.exe 70 PID 4288 wrote to memory of 4944 4288 oobeldr.exe 70 PID 4288 wrote to memory of 3980 4288 oobeldr.exe 71 PID 4288 wrote to memory of 3980 4288 oobeldr.exe 71 PID 4288 wrote to memory of 3980 4288 oobeldr.exe 71 PID 4288 wrote to memory of 3980 4288 oobeldr.exe 71 PID 4288 wrote to memory of 3980 4288 oobeldr.exe 71 PID 4288 wrote to memory of 3980 4288 oobeldr.exe 71 PID 4288 wrote to memory of 3980 4288 oobeldr.exe 71 PID 4288 wrote to memory of 3980 4288 oobeldr.exe 71 PID 4288 wrote to memory of 3980 4288 oobeldr.exe 71 PID 3980 wrote to memory of 4524 3980 oobeldr.exe 72 PID 3980 wrote to memory of 4524 3980 oobeldr.exe 72 PID 3980 wrote to memory of 4524 3980 oobeldr.exe 72 PID 4900 wrote to memory of 784 4900 oobeldr.exe 75 PID 4900 wrote to memory of 784 4900 oobeldr.exe 75 PID 4900 wrote to memory of 784 4900 oobeldr.exe 75 PID 4900 wrote to memory of 784 4900 oobeldr.exe 75 PID 4900 wrote to memory of 784 4900 oobeldr.exe 75 PID 4900 wrote to memory of 784 4900 oobeldr.exe 75 PID 4900 wrote to memory of 784 4900 oobeldr.exe 75 PID 4900 wrote to memory of 784 4900 oobeldr.exe 75 PID 4900 wrote to memory of 784 4900 oobeldr.exe 75 PID 924 wrote to memory of 2432 924 oobeldr.exe 77 PID 924 wrote to memory of 2432 924 oobeldr.exe 77 PID 924 wrote to memory of 2432 924 oobeldr.exe 77 PID 924 wrote to memory of 2900 924 oobeldr.exe 78 PID 924 wrote to memory of 2900 924 oobeldr.exe 78 PID 924 wrote to memory of 2900 924 oobeldr.exe 78
Processes
-
C:\Users\Admin\AppData\Local\Temp\a5ad4f2278b36c0c50dfcd4c5ccdc25808707ef4c80e8e11c286d93859c137f6.exe"C:\Users\Admin\AppData\Local\Temp\a5ad4f2278b36c0c50dfcd4c5ccdc25808707ef4c80e8e11c286d93859c137f6.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\a5ad4f2278b36c0c50dfcd4c5ccdc25808707ef4c80e8e11c286d93859c137f6.exeC:\Users\Admin\AppData\Local\Temp\a5ad4f2278b36c0c50dfcd4c5ccdc25808707ef4c80e8e11c286d93859c137f6.exe2⤵
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
PID:4312
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
PID:4944
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
PID:4524
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
PID:784
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
PID:2432
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵PID:2900
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
789B
MD5db5ef8d7c51bad129d9097bf953e4913
SHA18439db960aa2d431bf5ec3c37af775b45eb07e06
SHA2561248e67f10b47b397af3c8cbe342bad4be75c68b8e10f4ec6341195cc3138bd9
SHA51204572485790b25e1751347e43b47174051cd153dd75fd55ee5590d25a2579f344cd96cf86cf45bdb7759e3e6d0f734d0ff717148ca70f501b9869e964e036fee
-
Filesize
322KB
MD59adb6aeea617fad0256cd0926ff7ca09
SHA15b78fe73d6d0cf33a2762203f3c5f6a2e809b3c9
SHA256a5ad4f2278b36c0c50dfcd4c5ccdc25808707ef4c80e8e11c286d93859c137f6
SHA512db269b6d425dc8b2af29e96b9a29c16d3cb242a6bc4a9fc30805a216a3b8664215e885644353cf7d1079af443f406d2801801d2ed92e9ba37a5fd9661d5e98cb
-
Filesize
322KB
MD59adb6aeea617fad0256cd0926ff7ca09
SHA15b78fe73d6d0cf33a2762203f3c5f6a2e809b3c9
SHA256a5ad4f2278b36c0c50dfcd4c5ccdc25808707ef4c80e8e11c286d93859c137f6
SHA512db269b6d425dc8b2af29e96b9a29c16d3cb242a6bc4a9fc30805a216a3b8664215e885644353cf7d1079af443f406d2801801d2ed92e9ba37a5fd9661d5e98cb
-
Filesize
322KB
MD59adb6aeea617fad0256cd0926ff7ca09
SHA15b78fe73d6d0cf33a2762203f3c5f6a2e809b3c9
SHA256a5ad4f2278b36c0c50dfcd4c5ccdc25808707ef4c80e8e11c286d93859c137f6
SHA512db269b6d425dc8b2af29e96b9a29c16d3cb242a6bc4a9fc30805a216a3b8664215e885644353cf7d1079af443f406d2801801d2ed92e9ba37a5fd9661d5e98cb
-
Filesize
322KB
MD59adb6aeea617fad0256cd0926ff7ca09
SHA15b78fe73d6d0cf33a2762203f3c5f6a2e809b3c9
SHA256a5ad4f2278b36c0c50dfcd4c5ccdc25808707ef4c80e8e11c286d93859c137f6
SHA512db269b6d425dc8b2af29e96b9a29c16d3cb242a6bc4a9fc30805a216a3b8664215e885644353cf7d1079af443f406d2801801d2ed92e9ba37a5fd9661d5e98cb
-
Filesize
322KB
MD59adb6aeea617fad0256cd0926ff7ca09
SHA15b78fe73d6d0cf33a2762203f3c5f6a2e809b3c9
SHA256a5ad4f2278b36c0c50dfcd4c5ccdc25808707ef4c80e8e11c286d93859c137f6
SHA512db269b6d425dc8b2af29e96b9a29c16d3cb242a6bc4a9fc30805a216a3b8664215e885644353cf7d1079af443f406d2801801d2ed92e9ba37a5fd9661d5e98cb
-
Filesize
322KB
MD59adb6aeea617fad0256cd0926ff7ca09
SHA15b78fe73d6d0cf33a2762203f3c5f6a2e809b3c9
SHA256a5ad4f2278b36c0c50dfcd4c5ccdc25808707ef4c80e8e11c286d93859c137f6
SHA512db269b6d425dc8b2af29e96b9a29c16d3cb242a6bc4a9fc30805a216a3b8664215e885644353cf7d1079af443f406d2801801d2ed92e9ba37a5fd9661d5e98cb
-
Filesize
322KB
MD59adb6aeea617fad0256cd0926ff7ca09
SHA15b78fe73d6d0cf33a2762203f3c5f6a2e809b3c9
SHA256a5ad4f2278b36c0c50dfcd4c5ccdc25808707ef4c80e8e11c286d93859c137f6
SHA512db269b6d425dc8b2af29e96b9a29c16d3cb242a6bc4a9fc30805a216a3b8664215e885644353cf7d1079af443f406d2801801d2ed92e9ba37a5fd9661d5e98cb
-
Filesize
322KB
MD59adb6aeea617fad0256cd0926ff7ca09
SHA15b78fe73d6d0cf33a2762203f3c5f6a2e809b3c9
SHA256a5ad4f2278b36c0c50dfcd4c5ccdc25808707ef4c80e8e11c286d93859c137f6
SHA512db269b6d425dc8b2af29e96b9a29c16d3cb242a6bc4a9fc30805a216a3b8664215e885644353cf7d1079af443f406d2801801d2ed92e9ba37a5fd9661d5e98cb