Analysis
-
max time kernel
106s -
max time network
147s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
31/10/2022, 22:06
Static task
static1
Behavioral task
behavioral1
Sample
ecf2f8e6c69e2721d7500f988ce9796ff6f4589aa27be039c5e952485b07a877.exe
Resource
win10-20220812-en
General
-
Target
ecf2f8e6c69e2721d7500f988ce9796ff6f4589aa27be039c5e952485b07a877.exe
-
Size
322KB
-
MD5
0c3344a9e7c367e0108bd1fe6da9d5cd
-
SHA1
dcf2388646558b0a5c5b930e06f70c8a15f3fbbf
-
SHA256
ecf2f8e6c69e2721d7500f988ce9796ff6f4589aa27be039c5e952485b07a877
-
SHA512
7061648db6e5792ab1eb19a01a7a2a28658e4f58c78b9f144808f9e168b22957c22b57b15913b126914be6f788b6be8021a37be775be5a4ec17495e73f97dca3
-
SSDEEP
6144:eKlzr1sYCzek2ciDaP9Xk6Ln1W8W/9InBSkZZmLdGcAdgdY6RKpjS:eGhQ2ciDq9ZL1W8q9InBRqELdolRKpj
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 1292 oobeldr.exe 4780 oobeldr.exe 4920 oobeldr.exe 4308 oobeldr.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2408 set thread context of 4388 2408 ecf2f8e6c69e2721d7500f988ce9796ff6f4589aa27be039c5e952485b07a877.exe 66 PID 1292 set thread context of 4780 1292 oobeldr.exe 70 PID 4920 set thread context of 4308 4920 oobeldr.exe 74 -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 5004 schtasks.exe 3952 schtasks.exe -
Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 2408 wrote to memory of 4388 2408 ecf2f8e6c69e2721d7500f988ce9796ff6f4589aa27be039c5e952485b07a877.exe 66 PID 2408 wrote to memory of 4388 2408 ecf2f8e6c69e2721d7500f988ce9796ff6f4589aa27be039c5e952485b07a877.exe 66 PID 2408 wrote to memory of 4388 2408 ecf2f8e6c69e2721d7500f988ce9796ff6f4589aa27be039c5e952485b07a877.exe 66 PID 2408 wrote to memory of 4388 2408 ecf2f8e6c69e2721d7500f988ce9796ff6f4589aa27be039c5e952485b07a877.exe 66 PID 2408 wrote to memory of 4388 2408 ecf2f8e6c69e2721d7500f988ce9796ff6f4589aa27be039c5e952485b07a877.exe 66 PID 2408 wrote to memory of 4388 2408 ecf2f8e6c69e2721d7500f988ce9796ff6f4589aa27be039c5e952485b07a877.exe 66 PID 2408 wrote to memory of 4388 2408 ecf2f8e6c69e2721d7500f988ce9796ff6f4589aa27be039c5e952485b07a877.exe 66 PID 2408 wrote to memory of 4388 2408 ecf2f8e6c69e2721d7500f988ce9796ff6f4589aa27be039c5e952485b07a877.exe 66 PID 2408 wrote to memory of 4388 2408 ecf2f8e6c69e2721d7500f988ce9796ff6f4589aa27be039c5e952485b07a877.exe 66 PID 4388 wrote to memory of 5004 4388 ecf2f8e6c69e2721d7500f988ce9796ff6f4589aa27be039c5e952485b07a877.exe 68 PID 4388 wrote to memory of 5004 4388 ecf2f8e6c69e2721d7500f988ce9796ff6f4589aa27be039c5e952485b07a877.exe 68 PID 4388 wrote to memory of 5004 4388 ecf2f8e6c69e2721d7500f988ce9796ff6f4589aa27be039c5e952485b07a877.exe 68 PID 1292 wrote to memory of 4780 1292 oobeldr.exe 70 PID 1292 wrote to memory of 4780 1292 oobeldr.exe 70 PID 1292 wrote to memory of 4780 1292 oobeldr.exe 70 PID 1292 wrote to memory of 4780 1292 oobeldr.exe 70 PID 1292 wrote to memory of 4780 1292 oobeldr.exe 70 PID 1292 wrote to memory of 4780 1292 oobeldr.exe 70 PID 1292 wrote to memory of 4780 1292 oobeldr.exe 70 PID 1292 wrote to memory of 4780 1292 oobeldr.exe 70 PID 1292 wrote to memory of 4780 1292 oobeldr.exe 70 PID 4780 wrote to memory of 3952 4780 oobeldr.exe 71 PID 4780 wrote to memory of 3952 4780 oobeldr.exe 71 PID 4780 wrote to memory of 3952 4780 oobeldr.exe 71 PID 4920 wrote to memory of 4308 4920 oobeldr.exe 74 PID 4920 wrote to memory of 4308 4920 oobeldr.exe 74 PID 4920 wrote to memory of 4308 4920 oobeldr.exe 74 PID 4920 wrote to memory of 4308 4920 oobeldr.exe 74 PID 4920 wrote to memory of 4308 4920 oobeldr.exe 74 PID 4920 wrote to memory of 4308 4920 oobeldr.exe 74 PID 4920 wrote to memory of 4308 4920 oobeldr.exe 74 PID 4920 wrote to memory of 4308 4920 oobeldr.exe 74 PID 4920 wrote to memory of 4308 4920 oobeldr.exe 74
Processes
-
C:\Users\Admin\AppData\Local\Temp\ecf2f8e6c69e2721d7500f988ce9796ff6f4589aa27be039c5e952485b07a877.exe"C:\Users\Admin\AppData\Local\Temp\ecf2f8e6c69e2721d7500f988ce9796ff6f4589aa27be039c5e952485b07a877.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\ecf2f8e6c69e2721d7500f988ce9796ff6f4589aa27be039c5e952485b07a877.exeC:\Users\Admin\AppData\Local\Temp\ecf2f8e6c69e2721d7500f988ce9796ff6f4589aa27be039c5e952485b07a877.exe2⤵
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
PID:5004
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
PID:3952
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
PID:4308
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
789B
MD5db5ef8d7c51bad129d9097bf953e4913
SHA18439db960aa2d431bf5ec3c37af775b45eb07e06
SHA2561248e67f10b47b397af3c8cbe342bad4be75c68b8e10f4ec6341195cc3138bd9
SHA51204572485790b25e1751347e43b47174051cd153dd75fd55ee5590d25a2579f344cd96cf86cf45bdb7759e3e6d0f734d0ff717148ca70f501b9869e964e036fee
-
Filesize
322KB
MD50c3344a9e7c367e0108bd1fe6da9d5cd
SHA1dcf2388646558b0a5c5b930e06f70c8a15f3fbbf
SHA256ecf2f8e6c69e2721d7500f988ce9796ff6f4589aa27be039c5e952485b07a877
SHA5127061648db6e5792ab1eb19a01a7a2a28658e4f58c78b9f144808f9e168b22957c22b57b15913b126914be6f788b6be8021a37be775be5a4ec17495e73f97dca3
-
Filesize
322KB
MD50c3344a9e7c367e0108bd1fe6da9d5cd
SHA1dcf2388646558b0a5c5b930e06f70c8a15f3fbbf
SHA256ecf2f8e6c69e2721d7500f988ce9796ff6f4589aa27be039c5e952485b07a877
SHA5127061648db6e5792ab1eb19a01a7a2a28658e4f58c78b9f144808f9e168b22957c22b57b15913b126914be6f788b6be8021a37be775be5a4ec17495e73f97dca3
-
Filesize
322KB
MD50c3344a9e7c367e0108bd1fe6da9d5cd
SHA1dcf2388646558b0a5c5b930e06f70c8a15f3fbbf
SHA256ecf2f8e6c69e2721d7500f988ce9796ff6f4589aa27be039c5e952485b07a877
SHA5127061648db6e5792ab1eb19a01a7a2a28658e4f58c78b9f144808f9e168b22957c22b57b15913b126914be6f788b6be8021a37be775be5a4ec17495e73f97dca3
-
Filesize
322KB
MD50c3344a9e7c367e0108bd1fe6da9d5cd
SHA1dcf2388646558b0a5c5b930e06f70c8a15f3fbbf
SHA256ecf2f8e6c69e2721d7500f988ce9796ff6f4589aa27be039c5e952485b07a877
SHA5127061648db6e5792ab1eb19a01a7a2a28658e4f58c78b9f144808f9e168b22957c22b57b15913b126914be6f788b6be8021a37be775be5a4ec17495e73f97dca3
-
Filesize
322KB
MD50c3344a9e7c367e0108bd1fe6da9d5cd
SHA1dcf2388646558b0a5c5b930e06f70c8a15f3fbbf
SHA256ecf2f8e6c69e2721d7500f988ce9796ff6f4589aa27be039c5e952485b07a877
SHA5127061648db6e5792ab1eb19a01a7a2a28658e4f58c78b9f144808f9e168b22957c22b57b15913b126914be6f788b6be8021a37be775be5a4ec17495e73f97dca3