Analysis
-
max time kernel
146s -
max time network
149s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
31/10/2022, 22:51
Static task
static1
Behavioral task
behavioral1
Sample
d489e06e4e952a636272cb97204eaf1c6ced503ee602a91357cacfd3dbf57dd1.exe
Resource
win10-20220812-en
General
-
Target
d489e06e4e952a636272cb97204eaf1c6ced503ee602a91357cacfd3dbf57dd1.exe
-
Size
322KB
-
MD5
a580532ba1760b46afd76630327e4bf3
-
SHA1
026fb71ca830b9f708f8588be9351a3005b2d5a2
-
SHA256
d489e06e4e952a636272cb97204eaf1c6ced503ee602a91357cacfd3dbf57dd1
-
SHA512
d255bfd74da25e3140aff5edd8d6ab695828a9f088f00a15a8760000fe3525056a3fbffaa16c3276818e89151a1811475e9077e99ef2837e0a10692d570d5b1d
-
SSDEEP
6144:eKlzr1sYCzek2ciDaP9Xk6Ln1W8W/9InBSkZZmLdGcAdgdY6RKpjS:eGhQ2ciDq9ZL1W8q9InBRqELdolRKpj
Malware Config
Signatures
-
Executes dropped EXE 6 IoCs
pid Process 4892 oobeldr.exe 4792 oobeldr.exe 4872 oobeldr.exe 3140 oobeldr.exe 428 oobeldr.exe 2720 oobeldr.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 2620 set thread context of 2148 2620 d489e06e4e952a636272cb97204eaf1c6ced503ee602a91357cacfd3dbf57dd1.exe 66 PID 4892 set thread context of 4792 4892 oobeldr.exe 70 PID 4872 set thread context of 3140 4872 oobeldr.exe 74 PID 428 set thread context of 2720 428 oobeldr.exe 76 -
Program crash 1 IoCs
pid pid_target Process procid_target 3824 2720 WerFault.exe 76 -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1504 schtasks.exe 4568 schtasks.exe -
Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 2620 wrote to memory of 2148 2620 d489e06e4e952a636272cb97204eaf1c6ced503ee602a91357cacfd3dbf57dd1.exe 66 PID 2620 wrote to memory of 2148 2620 d489e06e4e952a636272cb97204eaf1c6ced503ee602a91357cacfd3dbf57dd1.exe 66 PID 2620 wrote to memory of 2148 2620 d489e06e4e952a636272cb97204eaf1c6ced503ee602a91357cacfd3dbf57dd1.exe 66 PID 2620 wrote to memory of 2148 2620 d489e06e4e952a636272cb97204eaf1c6ced503ee602a91357cacfd3dbf57dd1.exe 66 PID 2620 wrote to memory of 2148 2620 d489e06e4e952a636272cb97204eaf1c6ced503ee602a91357cacfd3dbf57dd1.exe 66 PID 2620 wrote to memory of 2148 2620 d489e06e4e952a636272cb97204eaf1c6ced503ee602a91357cacfd3dbf57dd1.exe 66 PID 2620 wrote to memory of 2148 2620 d489e06e4e952a636272cb97204eaf1c6ced503ee602a91357cacfd3dbf57dd1.exe 66 PID 2620 wrote to memory of 2148 2620 d489e06e4e952a636272cb97204eaf1c6ced503ee602a91357cacfd3dbf57dd1.exe 66 PID 2620 wrote to memory of 2148 2620 d489e06e4e952a636272cb97204eaf1c6ced503ee602a91357cacfd3dbf57dd1.exe 66 PID 2148 wrote to memory of 1504 2148 d489e06e4e952a636272cb97204eaf1c6ced503ee602a91357cacfd3dbf57dd1.exe 67 PID 2148 wrote to memory of 1504 2148 d489e06e4e952a636272cb97204eaf1c6ced503ee602a91357cacfd3dbf57dd1.exe 67 PID 2148 wrote to memory of 1504 2148 d489e06e4e952a636272cb97204eaf1c6ced503ee602a91357cacfd3dbf57dd1.exe 67 PID 4892 wrote to memory of 4792 4892 oobeldr.exe 70 PID 4892 wrote to memory of 4792 4892 oobeldr.exe 70 PID 4892 wrote to memory of 4792 4892 oobeldr.exe 70 PID 4892 wrote to memory of 4792 4892 oobeldr.exe 70 PID 4892 wrote to memory of 4792 4892 oobeldr.exe 70 PID 4892 wrote to memory of 4792 4892 oobeldr.exe 70 PID 4892 wrote to memory of 4792 4892 oobeldr.exe 70 PID 4892 wrote to memory of 4792 4892 oobeldr.exe 70 PID 4892 wrote to memory of 4792 4892 oobeldr.exe 70 PID 4792 wrote to memory of 4568 4792 oobeldr.exe 71 PID 4792 wrote to memory of 4568 4792 oobeldr.exe 71 PID 4792 wrote to memory of 4568 4792 oobeldr.exe 71 PID 4872 wrote to memory of 3140 4872 oobeldr.exe 74 PID 4872 wrote to memory of 3140 4872 oobeldr.exe 74 PID 4872 wrote to memory of 3140 4872 oobeldr.exe 74 PID 4872 wrote to memory of 3140 4872 oobeldr.exe 74 PID 4872 wrote to memory of 3140 4872 oobeldr.exe 74 PID 4872 wrote to memory of 3140 4872 oobeldr.exe 74 PID 4872 wrote to memory of 3140 4872 oobeldr.exe 74 PID 4872 wrote to memory of 3140 4872 oobeldr.exe 74 PID 4872 wrote to memory of 3140 4872 oobeldr.exe 74 PID 428 wrote to memory of 2720 428 oobeldr.exe 76 PID 428 wrote to memory of 2720 428 oobeldr.exe 76 PID 428 wrote to memory of 2720 428 oobeldr.exe 76 PID 428 wrote to memory of 2720 428 oobeldr.exe 76 PID 428 wrote to memory of 2720 428 oobeldr.exe 76 PID 428 wrote to memory of 2720 428 oobeldr.exe 76 PID 428 wrote to memory of 2720 428 oobeldr.exe 76 PID 428 wrote to memory of 2720 428 oobeldr.exe 76 PID 428 wrote to memory of 2720 428 oobeldr.exe 76
Processes
-
C:\Users\Admin\AppData\Local\Temp\d489e06e4e952a636272cb97204eaf1c6ced503ee602a91357cacfd3dbf57dd1.exe"C:\Users\Admin\AppData\Local\Temp\d489e06e4e952a636272cb97204eaf1c6ced503ee602a91357cacfd3dbf57dd1.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\d489e06e4e952a636272cb97204eaf1c6ced503ee602a91357cacfd3dbf57dd1.exeC:\Users\Admin\AppData\Local\Temp\d489e06e4e952a636272cb97204eaf1c6ced503ee602a91357cacfd3dbf57dd1.exe2⤵
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
PID:1504
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
PID:4568
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
PID:3140
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:428 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
PID:2720 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2720 -s 1523⤵
- Program crash
PID:3824
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
789B
MD5db5ef8d7c51bad129d9097bf953e4913
SHA18439db960aa2d431bf5ec3c37af775b45eb07e06
SHA2561248e67f10b47b397af3c8cbe342bad4be75c68b8e10f4ec6341195cc3138bd9
SHA51204572485790b25e1751347e43b47174051cd153dd75fd55ee5590d25a2579f344cd96cf86cf45bdb7759e3e6d0f734d0ff717148ca70f501b9869e964e036fee
-
Filesize
322KB
MD5a580532ba1760b46afd76630327e4bf3
SHA1026fb71ca830b9f708f8588be9351a3005b2d5a2
SHA256d489e06e4e952a636272cb97204eaf1c6ced503ee602a91357cacfd3dbf57dd1
SHA512d255bfd74da25e3140aff5edd8d6ab695828a9f088f00a15a8760000fe3525056a3fbffaa16c3276818e89151a1811475e9077e99ef2837e0a10692d570d5b1d
-
Filesize
322KB
MD5a580532ba1760b46afd76630327e4bf3
SHA1026fb71ca830b9f708f8588be9351a3005b2d5a2
SHA256d489e06e4e952a636272cb97204eaf1c6ced503ee602a91357cacfd3dbf57dd1
SHA512d255bfd74da25e3140aff5edd8d6ab695828a9f088f00a15a8760000fe3525056a3fbffaa16c3276818e89151a1811475e9077e99ef2837e0a10692d570d5b1d
-
Filesize
322KB
MD5a580532ba1760b46afd76630327e4bf3
SHA1026fb71ca830b9f708f8588be9351a3005b2d5a2
SHA256d489e06e4e952a636272cb97204eaf1c6ced503ee602a91357cacfd3dbf57dd1
SHA512d255bfd74da25e3140aff5edd8d6ab695828a9f088f00a15a8760000fe3525056a3fbffaa16c3276818e89151a1811475e9077e99ef2837e0a10692d570d5b1d
-
Filesize
322KB
MD5a580532ba1760b46afd76630327e4bf3
SHA1026fb71ca830b9f708f8588be9351a3005b2d5a2
SHA256d489e06e4e952a636272cb97204eaf1c6ced503ee602a91357cacfd3dbf57dd1
SHA512d255bfd74da25e3140aff5edd8d6ab695828a9f088f00a15a8760000fe3525056a3fbffaa16c3276818e89151a1811475e9077e99ef2837e0a10692d570d5b1d
-
Filesize
322KB
MD5a580532ba1760b46afd76630327e4bf3
SHA1026fb71ca830b9f708f8588be9351a3005b2d5a2
SHA256d489e06e4e952a636272cb97204eaf1c6ced503ee602a91357cacfd3dbf57dd1
SHA512d255bfd74da25e3140aff5edd8d6ab695828a9f088f00a15a8760000fe3525056a3fbffaa16c3276818e89151a1811475e9077e99ef2837e0a10692d570d5b1d
-
Filesize
322KB
MD5a580532ba1760b46afd76630327e4bf3
SHA1026fb71ca830b9f708f8588be9351a3005b2d5a2
SHA256d489e06e4e952a636272cb97204eaf1c6ced503ee602a91357cacfd3dbf57dd1
SHA512d255bfd74da25e3140aff5edd8d6ab695828a9f088f00a15a8760000fe3525056a3fbffaa16c3276818e89151a1811475e9077e99ef2837e0a10692d570d5b1d
-
Filesize
322KB
MD5a580532ba1760b46afd76630327e4bf3
SHA1026fb71ca830b9f708f8588be9351a3005b2d5a2
SHA256d489e06e4e952a636272cb97204eaf1c6ced503ee602a91357cacfd3dbf57dd1
SHA512d255bfd74da25e3140aff5edd8d6ab695828a9f088f00a15a8760000fe3525056a3fbffaa16c3276818e89151a1811475e9077e99ef2837e0a10692d570d5b1d