Analysis
-
max time kernel
144s -
max time network
74s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
31/10/2022, 22:04
Static task
static1
Behavioral task
behavioral1
Sample
33d6c817933bcb2b2999386277e6d832f0dd687438c37e331933dff08e05b13e.exe
Resource
win10-20220812-en
General
-
Target
33d6c817933bcb2b2999386277e6d832f0dd687438c37e331933dff08e05b13e.exe
-
Size
322KB
-
MD5
932d1f73961437633a79d17d72e92cd8
-
SHA1
bbd38fa8557953f47fc91b4f84d14bf214a5655c
-
SHA256
33d6c817933bcb2b2999386277e6d832f0dd687438c37e331933dff08e05b13e
-
SHA512
06bbc91e904c7cebf50a71bf5bea2d1813cba3573f4e14f6061c06430f7f7fa44c6f42ee0102fb92f4ccb09ab96a9a1976e7056e5577505562ee35945b81365c
-
SSDEEP
6144:eKlzr1sYCzek2ciDaP9Xk6Ln1W8W/9InBSkZZmLdGcAdgdY6RKpjS:eGhQ2ciDq9ZL1W8q9InBRqELdolRKpj
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 1000 oobeldr.exe 5028 oobeldr.exe 5104 oobeldr.exe 4568 oobeldr.exe 4472 oobeldr.exe 912 oobeldr.exe 752 oobeldr.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 2676 set thread context of 4832 2676 33d6c817933bcb2b2999386277e6d832f0dd687438c37e331933dff08e05b13e.exe 66 PID 1000 set thread context of 5028 1000 oobeldr.exe 70 PID 5104 set thread context of 4472 5104 oobeldr.exe 75 PID 912 set thread context of 752 912 oobeldr.exe 77 -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4292 schtasks.exe 4336 schtasks.exe -
Suspicious use of WriteProcessMemory 45 IoCs
description pid Process procid_target PID 2676 wrote to memory of 4832 2676 33d6c817933bcb2b2999386277e6d832f0dd687438c37e331933dff08e05b13e.exe 66 PID 2676 wrote to memory of 4832 2676 33d6c817933bcb2b2999386277e6d832f0dd687438c37e331933dff08e05b13e.exe 66 PID 2676 wrote to memory of 4832 2676 33d6c817933bcb2b2999386277e6d832f0dd687438c37e331933dff08e05b13e.exe 66 PID 2676 wrote to memory of 4832 2676 33d6c817933bcb2b2999386277e6d832f0dd687438c37e331933dff08e05b13e.exe 66 PID 2676 wrote to memory of 4832 2676 33d6c817933bcb2b2999386277e6d832f0dd687438c37e331933dff08e05b13e.exe 66 PID 2676 wrote to memory of 4832 2676 33d6c817933bcb2b2999386277e6d832f0dd687438c37e331933dff08e05b13e.exe 66 PID 2676 wrote to memory of 4832 2676 33d6c817933bcb2b2999386277e6d832f0dd687438c37e331933dff08e05b13e.exe 66 PID 2676 wrote to memory of 4832 2676 33d6c817933bcb2b2999386277e6d832f0dd687438c37e331933dff08e05b13e.exe 66 PID 2676 wrote to memory of 4832 2676 33d6c817933bcb2b2999386277e6d832f0dd687438c37e331933dff08e05b13e.exe 66 PID 4832 wrote to memory of 4292 4832 33d6c817933bcb2b2999386277e6d832f0dd687438c37e331933dff08e05b13e.exe 67 PID 4832 wrote to memory of 4292 4832 33d6c817933bcb2b2999386277e6d832f0dd687438c37e331933dff08e05b13e.exe 67 PID 4832 wrote to memory of 4292 4832 33d6c817933bcb2b2999386277e6d832f0dd687438c37e331933dff08e05b13e.exe 67 PID 1000 wrote to memory of 5028 1000 oobeldr.exe 70 PID 1000 wrote to memory of 5028 1000 oobeldr.exe 70 PID 1000 wrote to memory of 5028 1000 oobeldr.exe 70 PID 1000 wrote to memory of 5028 1000 oobeldr.exe 70 PID 1000 wrote to memory of 5028 1000 oobeldr.exe 70 PID 1000 wrote to memory of 5028 1000 oobeldr.exe 70 PID 1000 wrote to memory of 5028 1000 oobeldr.exe 70 PID 1000 wrote to memory of 5028 1000 oobeldr.exe 70 PID 1000 wrote to memory of 5028 1000 oobeldr.exe 70 PID 5028 wrote to memory of 4336 5028 oobeldr.exe 71 PID 5028 wrote to memory of 4336 5028 oobeldr.exe 71 PID 5028 wrote to memory of 4336 5028 oobeldr.exe 71 PID 5104 wrote to memory of 4568 5104 oobeldr.exe 74 PID 5104 wrote to memory of 4568 5104 oobeldr.exe 74 PID 5104 wrote to memory of 4568 5104 oobeldr.exe 74 PID 5104 wrote to memory of 4472 5104 oobeldr.exe 75 PID 5104 wrote to memory of 4472 5104 oobeldr.exe 75 PID 5104 wrote to memory of 4472 5104 oobeldr.exe 75 PID 5104 wrote to memory of 4472 5104 oobeldr.exe 75 PID 5104 wrote to memory of 4472 5104 oobeldr.exe 75 PID 5104 wrote to memory of 4472 5104 oobeldr.exe 75 PID 5104 wrote to memory of 4472 5104 oobeldr.exe 75 PID 5104 wrote to memory of 4472 5104 oobeldr.exe 75 PID 5104 wrote to memory of 4472 5104 oobeldr.exe 75 PID 912 wrote to memory of 752 912 oobeldr.exe 77 PID 912 wrote to memory of 752 912 oobeldr.exe 77 PID 912 wrote to memory of 752 912 oobeldr.exe 77 PID 912 wrote to memory of 752 912 oobeldr.exe 77 PID 912 wrote to memory of 752 912 oobeldr.exe 77 PID 912 wrote to memory of 752 912 oobeldr.exe 77 PID 912 wrote to memory of 752 912 oobeldr.exe 77 PID 912 wrote to memory of 752 912 oobeldr.exe 77 PID 912 wrote to memory of 752 912 oobeldr.exe 77
Processes
-
C:\Users\Admin\AppData\Local\Temp\33d6c817933bcb2b2999386277e6d832f0dd687438c37e331933dff08e05b13e.exe"C:\Users\Admin\AppData\Local\Temp\33d6c817933bcb2b2999386277e6d832f0dd687438c37e331933dff08e05b13e.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\33d6c817933bcb2b2999386277e6d832f0dd687438c37e331933dff08e05b13e.exeC:\Users\Admin\AppData\Local\Temp\33d6c817933bcb2b2999386277e6d832f0dd687438c37e331933dff08e05b13e.exe2⤵
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
PID:4292
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
PID:4336
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
PID:4568
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
PID:4472
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
PID:752
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
789B
MD5db5ef8d7c51bad129d9097bf953e4913
SHA18439db960aa2d431bf5ec3c37af775b45eb07e06
SHA2561248e67f10b47b397af3c8cbe342bad4be75c68b8e10f4ec6341195cc3138bd9
SHA51204572485790b25e1751347e43b47174051cd153dd75fd55ee5590d25a2579f344cd96cf86cf45bdb7759e3e6d0f734d0ff717148ca70f501b9869e964e036fee
-
Filesize
322KB
MD5932d1f73961437633a79d17d72e92cd8
SHA1bbd38fa8557953f47fc91b4f84d14bf214a5655c
SHA25633d6c817933bcb2b2999386277e6d832f0dd687438c37e331933dff08e05b13e
SHA51206bbc91e904c7cebf50a71bf5bea2d1813cba3573f4e14f6061c06430f7f7fa44c6f42ee0102fb92f4ccb09ab96a9a1976e7056e5577505562ee35945b81365c
-
Filesize
322KB
MD5932d1f73961437633a79d17d72e92cd8
SHA1bbd38fa8557953f47fc91b4f84d14bf214a5655c
SHA25633d6c817933bcb2b2999386277e6d832f0dd687438c37e331933dff08e05b13e
SHA51206bbc91e904c7cebf50a71bf5bea2d1813cba3573f4e14f6061c06430f7f7fa44c6f42ee0102fb92f4ccb09ab96a9a1976e7056e5577505562ee35945b81365c
-
Filesize
322KB
MD5932d1f73961437633a79d17d72e92cd8
SHA1bbd38fa8557953f47fc91b4f84d14bf214a5655c
SHA25633d6c817933bcb2b2999386277e6d832f0dd687438c37e331933dff08e05b13e
SHA51206bbc91e904c7cebf50a71bf5bea2d1813cba3573f4e14f6061c06430f7f7fa44c6f42ee0102fb92f4ccb09ab96a9a1976e7056e5577505562ee35945b81365c
-
Filesize
322KB
MD5932d1f73961437633a79d17d72e92cd8
SHA1bbd38fa8557953f47fc91b4f84d14bf214a5655c
SHA25633d6c817933bcb2b2999386277e6d832f0dd687438c37e331933dff08e05b13e
SHA51206bbc91e904c7cebf50a71bf5bea2d1813cba3573f4e14f6061c06430f7f7fa44c6f42ee0102fb92f4ccb09ab96a9a1976e7056e5577505562ee35945b81365c
-
Filesize
322KB
MD5932d1f73961437633a79d17d72e92cd8
SHA1bbd38fa8557953f47fc91b4f84d14bf214a5655c
SHA25633d6c817933bcb2b2999386277e6d832f0dd687438c37e331933dff08e05b13e
SHA51206bbc91e904c7cebf50a71bf5bea2d1813cba3573f4e14f6061c06430f7f7fa44c6f42ee0102fb92f4ccb09ab96a9a1976e7056e5577505562ee35945b81365c
-
Filesize
322KB
MD5932d1f73961437633a79d17d72e92cd8
SHA1bbd38fa8557953f47fc91b4f84d14bf214a5655c
SHA25633d6c817933bcb2b2999386277e6d832f0dd687438c37e331933dff08e05b13e
SHA51206bbc91e904c7cebf50a71bf5bea2d1813cba3573f4e14f6061c06430f7f7fa44c6f42ee0102fb92f4ccb09ab96a9a1976e7056e5577505562ee35945b81365c
-
Filesize
322KB
MD5932d1f73961437633a79d17d72e92cd8
SHA1bbd38fa8557953f47fc91b4f84d14bf214a5655c
SHA25633d6c817933bcb2b2999386277e6d832f0dd687438c37e331933dff08e05b13e
SHA51206bbc91e904c7cebf50a71bf5bea2d1813cba3573f4e14f6061c06430f7f7fa44c6f42ee0102fb92f4ccb09ab96a9a1976e7056e5577505562ee35945b81365c
-
Filesize
322KB
MD5932d1f73961437633a79d17d72e92cd8
SHA1bbd38fa8557953f47fc91b4f84d14bf214a5655c
SHA25633d6c817933bcb2b2999386277e6d832f0dd687438c37e331933dff08e05b13e
SHA51206bbc91e904c7cebf50a71bf5bea2d1813cba3573f4e14f6061c06430f7f7fa44c6f42ee0102fb92f4ccb09ab96a9a1976e7056e5577505562ee35945b81365c