Analysis
-
max time kernel
144s -
max time network
147s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
31/10/2022, 22:05
Static task
static1
Behavioral task
behavioral1
Sample
8521c51a30f05b56c2a3c1ace9603ca7d54ec538ff44a0cd1b5f100e58da7323.exe
Resource
win10-20220812-en
General
-
Target
8521c51a30f05b56c2a3c1ace9603ca7d54ec538ff44a0cd1b5f100e58da7323.exe
-
Size
322KB
-
MD5
d0685ec186aeff2be9060012e656bee4
-
SHA1
2e1111fd146a44534ff291aa5c43e6fa5514cd29
-
SHA256
8521c51a30f05b56c2a3c1ace9603ca7d54ec538ff44a0cd1b5f100e58da7323
-
SHA512
880f5a9a76ffc3cc45cddc0f68147a502dd89fa4a3ac0d66f93207c4d7bff5a26019507408dc6fb064716081e6d57a52faf10f62251742c227d584631e2bebb2
-
SSDEEP
6144:eKlzr1sYCzek2ciDaP9Xk6Ln1W8W/9InBSkZZmLdGcAdgdY6RKpjS:eGhQ2ciDq9ZL1W8q9InBRqELdolRKpj
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 4384 oobeldr.exe 4324 oobeldr.exe 5072 oobeldr.exe 4436 oobeldr.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2808 set thread context of 4780 2808 8521c51a30f05b56c2a3c1ace9603ca7d54ec538ff44a0cd1b5f100e58da7323.exe 66 PID 4384 set thread context of 4324 4384 oobeldr.exe 70 PID 5072 set thread context of 4436 5072 oobeldr.exe 74 -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3580 schtasks.exe 3216 schtasks.exe -
Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 2808 wrote to memory of 4780 2808 8521c51a30f05b56c2a3c1ace9603ca7d54ec538ff44a0cd1b5f100e58da7323.exe 66 PID 2808 wrote to memory of 4780 2808 8521c51a30f05b56c2a3c1ace9603ca7d54ec538ff44a0cd1b5f100e58da7323.exe 66 PID 2808 wrote to memory of 4780 2808 8521c51a30f05b56c2a3c1ace9603ca7d54ec538ff44a0cd1b5f100e58da7323.exe 66 PID 2808 wrote to memory of 4780 2808 8521c51a30f05b56c2a3c1ace9603ca7d54ec538ff44a0cd1b5f100e58da7323.exe 66 PID 2808 wrote to memory of 4780 2808 8521c51a30f05b56c2a3c1ace9603ca7d54ec538ff44a0cd1b5f100e58da7323.exe 66 PID 2808 wrote to memory of 4780 2808 8521c51a30f05b56c2a3c1ace9603ca7d54ec538ff44a0cd1b5f100e58da7323.exe 66 PID 2808 wrote to memory of 4780 2808 8521c51a30f05b56c2a3c1ace9603ca7d54ec538ff44a0cd1b5f100e58da7323.exe 66 PID 2808 wrote to memory of 4780 2808 8521c51a30f05b56c2a3c1ace9603ca7d54ec538ff44a0cd1b5f100e58da7323.exe 66 PID 2808 wrote to memory of 4780 2808 8521c51a30f05b56c2a3c1ace9603ca7d54ec538ff44a0cd1b5f100e58da7323.exe 66 PID 4780 wrote to memory of 3580 4780 8521c51a30f05b56c2a3c1ace9603ca7d54ec538ff44a0cd1b5f100e58da7323.exe 68 PID 4780 wrote to memory of 3580 4780 8521c51a30f05b56c2a3c1ace9603ca7d54ec538ff44a0cd1b5f100e58da7323.exe 68 PID 4780 wrote to memory of 3580 4780 8521c51a30f05b56c2a3c1ace9603ca7d54ec538ff44a0cd1b5f100e58da7323.exe 68 PID 4384 wrote to memory of 4324 4384 oobeldr.exe 70 PID 4384 wrote to memory of 4324 4384 oobeldr.exe 70 PID 4384 wrote to memory of 4324 4384 oobeldr.exe 70 PID 4384 wrote to memory of 4324 4384 oobeldr.exe 70 PID 4384 wrote to memory of 4324 4384 oobeldr.exe 70 PID 4384 wrote to memory of 4324 4384 oobeldr.exe 70 PID 4384 wrote to memory of 4324 4384 oobeldr.exe 70 PID 4384 wrote to memory of 4324 4384 oobeldr.exe 70 PID 4384 wrote to memory of 4324 4384 oobeldr.exe 70 PID 4324 wrote to memory of 3216 4324 oobeldr.exe 72 PID 4324 wrote to memory of 3216 4324 oobeldr.exe 72 PID 4324 wrote to memory of 3216 4324 oobeldr.exe 72 PID 5072 wrote to memory of 4436 5072 oobeldr.exe 74 PID 5072 wrote to memory of 4436 5072 oobeldr.exe 74 PID 5072 wrote to memory of 4436 5072 oobeldr.exe 74 PID 5072 wrote to memory of 4436 5072 oobeldr.exe 74 PID 5072 wrote to memory of 4436 5072 oobeldr.exe 74 PID 5072 wrote to memory of 4436 5072 oobeldr.exe 74 PID 5072 wrote to memory of 4436 5072 oobeldr.exe 74 PID 5072 wrote to memory of 4436 5072 oobeldr.exe 74 PID 5072 wrote to memory of 4436 5072 oobeldr.exe 74
Processes
-
C:\Users\Admin\AppData\Local\Temp\8521c51a30f05b56c2a3c1ace9603ca7d54ec538ff44a0cd1b5f100e58da7323.exe"C:\Users\Admin\AppData\Local\Temp\8521c51a30f05b56c2a3c1ace9603ca7d54ec538ff44a0cd1b5f100e58da7323.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\8521c51a30f05b56c2a3c1ace9603ca7d54ec538ff44a0cd1b5f100e58da7323.exeC:\Users\Admin\AppData\Local\Temp\8521c51a30f05b56c2a3c1ace9603ca7d54ec538ff44a0cd1b5f100e58da7323.exe2⤵
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
PID:3580
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
PID:3216
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
PID:4436
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
789B
MD5db5ef8d7c51bad129d9097bf953e4913
SHA18439db960aa2d431bf5ec3c37af775b45eb07e06
SHA2561248e67f10b47b397af3c8cbe342bad4be75c68b8e10f4ec6341195cc3138bd9
SHA51204572485790b25e1751347e43b47174051cd153dd75fd55ee5590d25a2579f344cd96cf86cf45bdb7759e3e6d0f734d0ff717148ca70f501b9869e964e036fee
-
Filesize
322KB
MD5d0685ec186aeff2be9060012e656bee4
SHA12e1111fd146a44534ff291aa5c43e6fa5514cd29
SHA2568521c51a30f05b56c2a3c1ace9603ca7d54ec538ff44a0cd1b5f100e58da7323
SHA512880f5a9a76ffc3cc45cddc0f68147a502dd89fa4a3ac0d66f93207c4d7bff5a26019507408dc6fb064716081e6d57a52faf10f62251742c227d584631e2bebb2
-
Filesize
322KB
MD5d0685ec186aeff2be9060012e656bee4
SHA12e1111fd146a44534ff291aa5c43e6fa5514cd29
SHA2568521c51a30f05b56c2a3c1ace9603ca7d54ec538ff44a0cd1b5f100e58da7323
SHA512880f5a9a76ffc3cc45cddc0f68147a502dd89fa4a3ac0d66f93207c4d7bff5a26019507408dc6fb064716081e6d57a52faf10f62251742c227d584631e2bebb2
-
Filesize
322KB
MD5d0685ec186aeff2be9060012e656bee4
SHA12e1111fd146a44534ff291aa5c43e6fa5514cd29
SHA2568521c51a30f05b56c2a3c1ace9603ca7d54ec538ff44a0cd1b5f100e58da7323
SHA512880f5a9a76ffc3cc45cddc0f68147a502dd89fa4a3ac0d66f93207c4d7bff5a26019507408dc6fb064716081e6d57a52faf10f62251742c227d584631e2bebb2
-
Filesize
322KB
MD5d0685ec186aeff2be9060012e656bee4
SHA12e1111fd146a44534ff291aa5c43e6fa5514cd29
SHA2568521c51a30f05b56c2a3c1ace9603ca7d54ec538ff44a0cd1b5f100e58da7323
SHA512880f5a9a76ffc3cc45cddc0f68147a502dd89fa4a3ac0d66f93207c4d7bff5a26019507408dc6fb064716081e6d57a52faf10f62251742c227d584631e2bebb2
-
Filesize
322KB
MD5d0685ec186aeff2be9060012e656bee4
SHA12e1111fd146a44534ff291aa5c43e6fa5514cd29
SHA2568521c51a30f05b56c2a3c1ace9603ca7d54ec538ff44a0cd1b5f100e58da7323
SHA512880f5a9a76ffc3cc45cddc0f68147a502dd89fa4a3ac0d66f93207c4d7bff5a26019507408dc6fb064716081e6d57a52faf10f62251742c227d584631e2bebb2