Analysis
- max time kernel
104s - max time network
59s - platform
windows10-1703_x64 - resource
win10-20220901-en - resource tags
- submitted
31/10/2022, 22:50
General
- Target d565fdb6d920b476441ee86586e2b93facf9dfb39fdde6daa7eef802fd2c7687.exe
- Size 322KB
- Sample221031-2sc8fadhd3
- SHA256 d565fdb6d920b476441ee86586e2b93facf9dfb39fdde6daa7eef802fd2c7687
Malware Config
Signatures
- Executes dropped EXE 4 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of WriteProcessMemory 33 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d565fdb6d920b476441ee86586e2b93facf9dfb39fdde6daa7eef802fd2c7687.exe"C:\Users\Admin\AppData\Local\Temp\d565fdb6d920b476441ee86586e2b93facf9dfb39fdde6daa7eef802fd2c7687.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d565fdb6d920b476441ee86586e2b93facf9dfb39fdde6daa7eef802fd2c7687.exeC:\Users\Admin\AppData\Local\Temp\d565fdb6d920b476441ee86586e2b93facf9dfb39fdde6daa7eef802fd2c7687.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
oobeldr.exe.log
oobeldr.exe
oobeldr.exe
oobeldr.exe
oobeldr.exe
oobeldr.exe
memory/2412-182-0x0000000077DB0000-0x0000000077F3E000-memory.dmp
memory/2412-187-0x0000000077DB0000-0x0000000077F3E000-memory.dmp
memory/2412-232-0x0000000000400000-0x0000000000406000-memory.dmp
memory/2412-191-0x0000000077DB0000-0x0000000077F3E000-memory.dmp
memory/2412-190-0x0000000077DB0000-0x0000000077F3E000-memory.dmp
memory/2412-189-0x0000000077DB0000-0x0000000077F3E000-memory.dmp
memory/2412-188-0x0000000077DB0000-0x0000000077F3E000-memory.dmp
memory/2412-178-0x0000000000400000-0x0000000000406000-memory.dmp
memory/2412-186-0x0000000077DB0000-0x0000000077F3E000-memory.dmp
memory/2412-181-0x0000000077DB0000-0x0000000077F3E000-memory.dmp
memory/2412-184-0x0000000077DB0000-0x0000000077F3E000-memory.dmp
memory/2412-180-0x0000000077DB0000-0x0000000077F3E000-memory.dmp
memory/3068-141-0x0000000077DB0000-0x0000000077F3E000-memory.dmp
memory/3068-172-0x0000000077DB0000-0x0000000077F3E000-memory.dmp
memory/3068-145-0x0000000077DB0000-0x0000000077F3E000-memory.dmp
memory/3068-144-0x0000000077DB0000-0x0000000077F3E000-memory.dmp
memory/3068-139-0x0000000077DB0000-0x0000000077F3E000-memory.dmp
memory/3068-146-0x0000000077DB0000-0x0000000077F3E000-memory.dmp
memory/3068-148-0x0000000077DB0000-0x0000000077F3E000-memory.dmp
memory/3068-149-0x0000000077DB0000-0x0000000077F3E000-memory.dmp
memory/3068-147-0x0000000077DB0000-0x0000000077F3E000-memory.dmp
memory/3068-150-0x0000000077DB0000-0x0000000077F3E000-memory.dmp
memory/3068-151-0x0000000077DB0000-0x0000000077F3E000-memory.dmp
memory/3068-152-0x0000000077DB0000-0x0000000077F3E000-memory.dmp
memory/3068-153-0x0000000077DB0000-0x0000000077F3E000-memory.dmp
memory/3068-154-0x0000000000170000-0x00000000001C6000-memory.dmp
memory/3068-155-0x0000000077DB0000-0x0000000077F3E000-memory.dmp
memory/3068-156-0x0000000077DB0000-0x0000000077F3E000-memory.dmp
memory/3068-157-0x0000000077DB0000-0x0000000077F3E000-memory.dmp
memory/3068-158-0x0000000077DB0000-0x0000000077F3E000-memory.dmp
memory/3068-159-0x0000000077DB0000-0x0000000077F3E000-memory.dmp
memory/3068-160-0x0000000077DB0000-0x0000000077F3E000-memory.dmp
memory/3068-161-0x0000000004940000-0x0000000004A0C000-memory.dmp
memory/3068-162-0x00000000073C0000-0x00000000078BE000-memory.dmp
memory/3068-163-0x0000000077DB0000-0x0000000077F3E000-memory.dmp
memory/3068-164-0x0000000006FA0000-0x0000000007032000-memory.dmp
memory/3068-165-0x0000000006F30000-0x0000000006F36000-memory.dmp
memory/3068-166-0x0000000077DB0000-0x0000000077F3E000-memory.dmp
memory/3068-167-0x00000000072C0000-0x0000000007336000-memory.dmp
memory/3068-168-0x0000000077DB0000-0x0000000077F3E000-memory.dmp
memory/3068-169-0x0000000077DB0000-0x0000000077F3E000-memory.dmp
memory/3068-170-0x0000000077DB0000-0x0000000077F3E000-memory.dmp
memory/3068-171-0x0000000006F80000-0x0000000006F9E000-memory.dmp
memory/3068-143-0x0000000077DB0000-0x0000000077F3E000-memory.dmp
memory/3068-174-0x0000000077DB0000-0x0000000077F3E000-memory.dmp
memory/3068-173-0x0000000077DB0000-0x0000000077F3E000-memory.dmp
memory/3068-175-0x0000000077DB0000-0x0000000077F3E000-memory.dmp
memory/3068-176-0x0000000077DB0000-0x0000000077F3E000-memory.dmp
memory/3068-177-0x0000000077DB0000-0x0000000077F3E000-memory.dmp
memory/3068-142-0x0000000077DB0000-0x0000000077F3E000-memory.dmp
memory/3068-120-0x0000000077DB0000-0x0000000077F3E000-memory.dmp
memory/3068-140-0x0000000077DB0000-0x0000000077F3E000-memory.dmp
memory/3068-183-0x0000000077DB0000-0x0000000077F3E000-memory.dmp
memory/3068-138-0x0000000077DB0000-0x0000000077F3E000-memory.dmp
memory/3068-137-0x0000000077DB0000-0x0000000077F3E000-memory.dmp
memory/3068-136-0x0000000077DB0000-0x0000000077F3E000-memory.dmp
memory/3068-135-0x0000000077DB0000-0x0000000077F3E000-memory.dmp
memory/3068-134-0x0000000077DB0000-0x0000000077F3E000-memory.dmp
memory/3068-133-0x0000000077DB0000-0x0000000077F3E000-memory.dmp
memory/3068-132-0x0000000077DB0000-0x0000000077F3E000-memory.dmp
memory/3068-131-0x0000000077DB0000-0x0000000077F3E000-memory.dmp
memory/3068-130-0x0000000077DB0000-0x0000000077F3E000-memory.dmp
memory/3068-121-0x0000000077DB0000-0x0000000077F3E000-memory.dmp
memory/3068-129-0x0000000077DB0000-0x0000000077F3E000-memory.dmp
memory/3068-128-0x0000000077DB0000-0x0000000077F3E000-memory.dmp
memory/3068-127-0x0000000077DB0000-0x0000000077F3E000-memory.dmp
memory/3068-122-0x0000000077DB0000-0x0000000077F3E000-memory.dmp
memory/3068-126-0x0000000077DB0000-0x0000000077F3E000-memory.dmp
memory/3068-125-0x0000000077DB0000-0x0000000077F3E000-memory.dmp
memory/3068-124-0x0000000077DB0000-0x0000000077F3E000-memory.dmp
memory/3068-123-0x0000000077DB0000-0x0000000077F3E000-memory.dmp