Analysis
- max time kernel
133s - max time network
64s - platform
windows10-1703_x64 - resource
win10-20220901-en - resource tags
- submitted
31/10/2022, 22:08
General
- Target efe361168a9c87687fc0181dfed1977de35a30f488b88f485a02f79a42458f7b.exe
- Size 322KB
- Sample221031-12mb2adef8
- SHA256 efe361168a9c87687fc0181dfed1977de35a30f488b88f485a02f79a42458f7b
Malware Config
Signatures
- Executes dropped EXE 4 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of WriteProcessMemory 33 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\efe361168a9c87687fc0181dfed1977de35a30f488b88f485a02f79a42458f7b.exe"C:\Users\Admin\AppData\Local\Temp\efe361168a9c87687fc0181dfed1977de35a30f488b88f485a02f79a42458f7b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\efe361168a9c87687fc0181dfed1977de35a30f488b88f485a02f79a42458f7b.exeC:\Users\Admin\AppData\Local\Temp\efe361168a9c87687fc0181dfed1977de35a30f488b88f485a02f79a42458f7b.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
oobeldr.exe.log
oobeldr.exe
oobeldr.exe
oobeldr.exe
oobeldr.exe
oobeldr.exe
memory/3048-154-0x0000000077470000-0x00000000775FE000-memory.dmp
memory/3048-167-0x0000000077470000-0x00000000775FE000-memory.dmp
memory/3048-122-0x0000000077470000-0x00000000775FE000-memory.dmp
memory/3048-123-0x0000000077470000-0x00000000775FE000-memory.dmp
memory/3048-124-0x0000000077470000-0x00000000775FE000-memory.dmp
memory/3048-125-0x0000000077470000-0x00000000775FE000-memory.dmp
memory/3048-126-0x0000000077470000-0x00000000775FE000-memory.dmp
memory/3048-127-0x0000000077470000-0x00000000775FE000-memory.dmp
memory/3048-128-0x0000000077470000-0x00000000775FE000-memory.dmp
memory/3048-129-0x0000000077470000-0x00000000775FE000-memory.dmp
memory/3048-130-0x0000000077470000-0x00000000775FE000-memory.dmp
memory/3048-131-0x0000000077470000-0x00000000775FE000-memory.dmp
memory/3048-156-0x0000000077470000-0x00000000775FE000-memory.dmp
memory/3048-133-0x0000000077470000-0x00000000775FE000-memory.dmp
memory/3048-134-0x0000000077470000-0x00000000775FE000-memory.dmp
memory/3048-135-0x0000000077470000-0x00000000775FE000-memory.dmp
memory/3048-136-0x0000000077470000-0x00000000775FE000-memory.dmp
memory/3048-137-0x0000000077470000-0x00000000775FE000-memory.dmp
memory/3048-139-0x0000000077470000-0x00000000775FE000-memory.dmp
memory/3048-138-0x0000000077470000-0x00000000775FE000-memory.dmp
memory/3048-140-0x0000000077470000-0x00000000775FE000-memory.dmp
memory/3048-141-0x0000000077470000-0x00000000775FE000-memory.dmp
memory/3048-142-0x0000000077470000-0x00000000775FE000-memory.dmp
memory/3048-143-0x0000000077470000-0x00000000775FE000-memory.dmp
memory/3048-144-0x0000000077470000-0x00000000775FE000-memory.dmp
memory/3048-145-0x0000000077470000-0x00000000775FE000-memory.dmp
memory/3048-146-0x0000000077470000-0x00000000775FE000-memory.dmp
memory/3048-147-0x0000000077470000-0x00000000775FE000-memory.dmp
memory/3048-148-0x0000000077470000-0x00000000775FE000-memory.dmp
memory/3048-149-0x0000000077470000-0x00000000775FE000-memory.dmp
memory/3048-150-0x0000000077470000-0x00000000775FE000-memory.dmp
memory/3048-151-0x00000000002F0000-0x0000000000346000-memory.dmp
memory/3048-152-0x0000000077470000-0x00000000775FE000-memory.dmp
memory/3048-153-0x0000000077470000-0x00000000775FE000-memory.dmp
memory/3048-121-0x0000000077470000-0x00000000775FE000-memory.dmp
memory/3048-155-0x0000000077470000-0x00000000775FE000-memory.dmp
memory/3048-132-0x0000000077470000-0x00000000775FE000-memory.dmp
memory/3048-120-0x0000000077470000-0x00000000775FE000-memory.dmp
memory/3048-172-0x0000000077470000-0x00000000775FE000-memory.dmp
memory/3048-159-0x00000000075B0000-0x0000000007AAE000-memory.dmp
memory/3048-160-0x0000000077470000-0x00000000775FE000-memory.dmp
memory/3048-161-0x0000000007150000-0x00000000071E2000-memory.dmp
memory/3048-162-0x00000000070B0000-0x00000000070B6000-memory.dmp
memory/3048-163-0x0000000077470000-0x00000000775FE000-memory.dmp
memory/3048-164-0x00000000073F0000-0x0000000007466000-memory.dmp
memory/3048-165-0x0000000077470000-0x00000000775FE000-memory.dmp
memory/3048-166-0x0000000077470000-0x00000000775FE000-memory.dmp
memory/3048-157-0x0000000077470000-0x00000000775FE000-memory.dmp
memory/3048-168-0x0000000007100000-0x000000000711E000-memory.dmp
memory/3048-169-0x0000000077470000-0x00000000775FE000-memory.dmp
memory/3048-170-0x0000000077470000-0x00000000775FE000-memory.dmp
memory/3048-171-0x0000000077470000-0x00000000775FE000-memory.dmp
memory/3048-158-0x0000000006FE0000-0x00000000070AC000-memory.dmp
memory/3048-173-0x0000000077470000-0x00000000775FE000-memory.dmp
memory/3048-174-0x0000000077470000-0x00000000775FE000-memory.dmp
memory/3048-180-0x0000000077470000-0x00000000775FE000-memory.dmp
memory/3048-117-0x0000000077470000-0x00000000775FE000-memory.dmp
memory/3048-118-0x0000000077470000-0x00000000775FE000-memory.dmp
memory/3048-119-0x0000000077470000-0x00000000775FE000-memory.dmp
memory/4600-224-0x0000000000400000-0x0000000000406000-memory.dmp
memory/4600-188-0x0000000077470000-0x00000000775FE000-memory.dmp
memory/4600-183-0x0000000077470000-0x00000000775FE000-memory.dmp
memory/4600-184-0x0000000077470000-0x00000000775FE000-memory.dmp
memory/4600-185-0x0000000077470000-0x00000000775FE000-memory.dmp
memory/4600-186-0x0000000077470000-0x00000000775FE000-memory.dmp
memory/4600-187-0x0000000077470000-0x00000000775FE000-memory.dmp
memory/4600-178-0x0000000077470000-0x00000000775FE000-memory.dmp
memory/4600-181-0x0000000077470000-0x00000000775FE000-memory.dmp
memory/4600-175-0x0000000000400000-0x0000000000406000-memory.dmp
memory/4600-179-0x0000000077470000-0x00000000775FE000-memory.dmp
memory/4600-177-0x0000000077470000-0x00000000775FE000-memory.dmp