Analysis
-
max time kernel
125s -
max time network
74s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
31/10/2022, 22:02
Static task
static1
Behavioral task
behavioral1
Sample
3ae4f65ea0d1b073537e3dc0b2224d0e289865deff5dc281ebb1552b2175b95b.exe
Resource
win10-20220812-en
General
-
Target
3ae4f65ea0d1b073537e3dc0b2224d0e289865deff5dc281ebb1552b2175b95b.exe
-
Size
322KB
-
MD5
8ff56de197351e4f43d211eaffdf1c71
-
SHA1
708d427fb2870b2ba89316c336215daa75ae494c
-
SHA256
3ae4f65ea0d1b073537e3dc0b2224d0e289865deff5dc281ebb1552b2175b95b
-
SHA512
868cc8ea83392d2d6878d38774c912763b925a79d06613ad2202aa0eda6dff7f842b6a41195d85d8ada0e63ecafcc375438555bf99433867ef2b35fe7fc5078d
-
SSDEEP
6144:eKlzr1sYCzek2ciDaP9Xk6Ln1W8W/9InBSkZZmLdGcAdgdY6RKpjS:eGhQ2ciDq9ZL1W8q9InBRqELdolRKpj
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 4060 oobeldr.exe 4992 oobeldr.exe 5048 oobeldr.exe 4472 oobeldr.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2584 set thread context of 2096 2584 3ae4f65ea0d1b073537e3dc0b2224d0e289865deff5dc281ebb1552b2175b95b.exe 66 PID 4060 set thread context of 4992 4060 oobeldr.exe 70 PID 5048 set thread context of 4472 5048 oobeldr.exe 74 -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3408 schtasks.exe 4536 schtasks.exe -
Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 2584 wrote to memory of 2096 2584 3ae4f65ea0d1b073537e3dc0b2224d0e289865deff5dc281ebb1552b2175b95b.exe 66 PID 2584 wrote to memory of 2096 2584 3ae4f65ea0d1b073537e3dc0b2224d0e289865deff5dc281ebb1552b2175b95b.exe 66 PID 2584 wrote to memory of 2096 2584 3ae4f65ea0d1b073537e3dc0b2224d0e289865deff5dc281ebb1552b2175b95b.exe 66 PID 2584 wrote to memory of 2096 2584 3ae4f65ea0d1b073537e3dc0b2224d0e289865deff5dc281ebb1552b2175b95b.exe 66 PID 2584 wrote to memory of 2096 2584 3ae4f65ea0d1b073537e3dc0b2224d0e289865deff5dc281ebb1552b2175b95b.exe 66 PID 2584 wrote to memory of 2096 2584 3ae4f65ea0d1b073537e3dc0b2224d0e289865deff5dc281ebb1552b2175b95b.exe 66 PID 2584 wrote to memory of 2096 2584 3ae4f65ea0d1b073537e3dc0b2224d0e289865deff5dc281ebb1552b2175b95b.exe 66 PID 2584 wrote to memory of 2096 2584 3ae4f65ea0d1b073537e3dc0b2224d0e289865deff5dc281ebb1552b2175b95b.exe 66 PID 2584 wrote to memory of 2096 2584 3ae4f65ea0d1b073537e3dc0b2224d0e289865deff5dc281ebb1552b2175b95b.exe 66 PID 2096 wrote to memory of 3408 2096 3ae4f65ea0d1b073537e3dc0b2224d0e289865deff5dc281ebb1552b2175b95b.exe 67 PID 2096 wrote to memory of 3408 2096 3ae4f65ea0d1b073537e3dc0b2224d0e289865deff5dc281ebb1552b2175b95b.exe 67 PID 2096 wrote to memory of 3408 2096 3ae4f65ea0d1b073537e3dc0b2224d0e289865deff5dc281ebb1552b2175b95b.exe 67 PID 4060 wrote to memory of 4992 4060 oobeldr.exe 70 PID 4060 wrote to memory of 4992 4060 oobeldr.exe 70 PID 4060 wrote to memory of 4992 4060 oobeldr.exe 70 PID 4060 wrote to memory of 4992 4060 oobeldr.exe 70 PID 4060 wrote to memory of 4992 4060 oobeldr.exe 70 PID 4060 wrote to memory of 4992 4060 oobeldr.exe 70 PID 4060 wrote to memory of 4992 4060 oobeldr.exe 70 PID 4060 wrote to memory of 4992 4060 oobeldr.exe 70 PID 4060 wrote to memory of 4992 4060 oobeldr.exe 70 PID 4992 wrote to memory of 4536 4992 oobeldr.exe 71 PID 4992 wrote to memory of 4536 4992 oobeldr.exe 71 PID 4992 wrote to memory of 4536 4992 oobeldr.exe 71 PID 5048 wrote to memory of 4472 5048 oobeldr.exe 74 PID 5048 wrote to memory of 4472 5048 oobeldr.exe 74 PID 5048 wrote to memory of 4472 5048 oobeldr.exe 74 PID 5048 wrote to memory of 4472 5048 oobeldr.exe 74 PID 5048 wrote to memory of 4472 5048 oobeldr.exe 74 PID 5048 wrote to memory of 4472 5048 oobeldr.exe 74 PID 5048 wrote to memory of 4472 5048 oobeldr.exe 74 PID 5048 wrote to memory of 4472 5048 oobeldr.exe 74 PID 5048 wrote to memory of 4472 5048 oobeldr.exe 74
Processes
-
C:\Users\Admin\AppData\Local\Temp\3ae4f65ea0d1b073537e3dc0b2224d0e289865deff5dc281ebb1552b2175b95b.exe"C:\Users\Admin\AppData\Local\Temp\3ae4f65ea0d1b073537e3dc0b2224d0e289865deff5dc281ebb1552b2175b95b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\3ae4f65ea0d1b073537e3dc0b2224d0e289865deff5dc281ebb1552b2175b95b.exeC:\Users\Admin\AppData\Local\Temp\3ae4f65ea0d1b073537e3dc0b2224d0e289865deff5dc281ebb1552b2175b95b.exe2⤵
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
PID:3408
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
PID:4536
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
PID:4472
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
789B
MD5db5ef8d7c51bad129d9097bf953e4913
SHA18439db960aa2d431bf5ec3c37af775b45eb07e06
SHA2561248e67f10b47b397af3c8cbe342bad4be75c68b8e10f4ec6341195cc3138bd9
SHA51204572485790b25e1751347e43b47174051cd153dd75fd55ee5590d25a2579f344cd96cf86cf45bdb7759e3e6d0f734d0ff717148ca70f501b9869e964e036fee
-
Filesize
322KB
MD58ff56de197351e4f43d211eaffdf1c71
SHA1708d427fb2870b2ba89316c336215daa75ae494c
SHA2563ae4f65ea0d1b073537e3dc0b2224d0e289865deff5dc281ebb1552b2175b95b
SHA512868cc8ea83392d2d6878d38774c912763b925a79d06613ad2202aa0eda6dff7f842b6a41195d85d8ada0e63ecafcc375438555bf99433867ef2b35fe7fc5078d
-
Filesize
322KB
MD58ff56de197351e4f43d211eaffdf1c71
SHA1708d427fb2870b2ba89316c336215daa75ae494c
SHA2563ae4f65ea0d1b073537e3dc0b2224d0e289865deff5dc281ebb1552b2175b95b
SHA512868cc8ea83392d2d6878d38774c912763b925a79d06613ad2202aa0eda6dff7f842b6a41195d85d8ada0e63ecafcc375438555bf99433867ef2b35fe7fc5078d
-
Filesize
322KB
MD58ff56de197351e4f43d211eaffdf1c71
SHA1708d427fb2870b2ba89316c336215daa75ae494c
SHA2563ae4f65ea0d1b073537e3dc0b2224d0e289865deff5dc281ebb1552b2175b95b
SHA512868cc8ea83392d2d6878d38774c912763b925a79d06613ad2202aa0eda6dff7f842b6a41195d85d8ada0e63ecafcc375438555bf99433867ef2b35fe7fc5078d
-
Filesize
322KB
MD58ff56de197351e4f43d211eaffdf1c71
SHA1708d427fb2870b2ba89316c336215daa75ae494c
SHA2563ae4f65ea0d1b073537e3dc0b2224d0e289865deff5dc281ebb1552b2175b95b
SHA512868cc8ea83392d2d6878d38774c912763b925a79d06613ad2202aa0eda6dff7f842b6a41195d85d8ada0e63ecafcc375438555bf99433867ef2b35fe7fc5078d
-
Filesize
322KB
MD58ff56de197351e4f43d211eaffdf1c71
SHA1708d427fb2870b2ba89316c336215daa75ae494c
SHA2563ae4f65ea0d1b073537e3dc0b2224d0e289865deff5dc281ebb1552b2175b95b
SHA512868cc8ea83392d2d6878d38774c912763b925a79d06613ad2202aa0eda6dff7f842b6a41195d85d8ada0e63ecafcc375438555bf99433867ef2b35fe7fc5078d