Analysis
-
max time kernel
114s -
max time network
112s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
31/10/2022, 22:51
Static task
static1
Behavioral task
behavioral1
Sample
32d34ee25139ce3ab217e4edc7f5c4d8797ed4ff0a7bc36b5127afaf3aa9bf3b.exe
Resource
win10-20220812-en
General
-
Target
32d34ee25139ce3ab217e4edc7f5c4d8797ed4ff0a7bc36b5127afaf3aa9bf3b.exe
-
Size
322KB
-
MD5
3be55c53fdf88cae6d90504981a45a9e
-
SHA1
c5e18f7232066748a023bee46fa2813fe973c6b6
-
SHA256
32d34ee25139ce3ab217e4edc7f5c4d8797ed4ff0a7bc36b5127afaf3aa9bf3b
-
SHA512
52ddb71186d3edc69533ad3511744fa3eefc03ac6932b32f21c3da2cc95b451ba55d617029cf3e717fad11ede12879529ae9483836d389d973607544e8b318e3
-
SSDEEP
6144:eKlzr1sYCzek2ciDaP9Xk6Ln1W8W/9InBSkZZmLdGcAdgdY6RKpjS:eGhQ2ciDq9ZL1W8q9InBRqELdolRKpj
Malware Config
Signatures
-
Executes dropped EXE 5 IoCs
pid Process 4544 oobeldr.exe 3764 oobeldr.exe 4732 oobeldr.exe 3844 oobeldr.exe 4948 oobeldr.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2300 set thread context of 5116 2300 32d34ee25139ce3ab217e4edc7f5c4d8797ed4ff0a7bc36b5127afaf3aa9bf3b.exe 66 PID 4544 set thread context of 4732 4544 oobeldr.exe 71 PID 3844 set thread context of 4948 3844 oobeldr.exe 75 -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3324 schtasks.exe 1904 schtasks.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 2300 wrote to memory of 5116 2300 32d34ee25139ce3ab217e4edc7f5c4d8797ed4ff0a7bc36b5127afaf3aa9bf3b.exe 66 PID 2300 wrote to memory of 5116 2300 32d34ee25139ce3ab217e4edc7f5c4d8797ed4ff0a7bc36b5127afaf3aa9bf3b.exe 66 PID 2300 wrote to memory of 5116 2300 32d34ee25139ce3ab217e4edc7f5c4d8797ed4ff0a7bc36b5127afaf3aa9bf3b.exe 66 PID 2300 wrote to memory of 5116 2300 32d34ee25139ce3ab217e4edc7f5c4d8797ed4ff0a7bc36b5127afaf3aa9bf3b.exe 66 PID 2300 wrote to memory of 5116 2300 32d34ee25139ce3ab217e4edc7f5c4d8797ed4ff0a7bc36b5127afaf3aa9bf3b.exe 66 PID 2300 wrote to memory of 5116 2300 32d34ee25139ce3ab217e4edc7f5c4d8797ed4ff0a7bc36b5127afaf3aa9bf3b.exe 66 PID 2300 wrote to memory of 5116 2300 32d34ee25139ce3ab217e4edc7f5c4d8797ed4ff0a7bc36b5127afaf3aa9bf3b.exe 66 PID 2300 wrote to memory of 5116 2300 32d34ee25139ce3ab217e4edc7f5c4d8797ed4ff0a7bc36b5127afaf3aa9bf3b.exe 66 PID 2300 wrote to memory of 5116 2300 32d34ee25139ce3ab217e4edc7f5c4d8797ed4ff0a7bc36b5127afaf3aa9bf3b.exe 66 PID 5116 wrote to memory of 3324 5116 32d34ee25139ce3ab217e4edc7f5c4d8797ed4ff0a7bc36b5127afaf3aa9bf3b.exe 67 PID 5116 wrote to memory of 3324 5116 32d34ee25139ce3ab217e4edc7f5c4d8797ed4ff0a7bc36b5127afaf3aa9bf3b.exe 67 PID 5116 wrote to memory of 3324 5116 32d34ee25139ce3ab217e4edc7f5c4d8797ed4ff0a7bc36b5127afaf3aa9bf3b.exe 67 PID 4544 wrote to memory of 3764 4544 oobeldr.exe 70 PID 4544 wrote to memory of 3764 4544 oobeldr.exe 70 PID 4544 wrote to memory of 3764 4544 oobeldr.exe 70 PID 4544 wrote to memory of 4732 4544 oobeldr.exe 71 PID 4544 wrote to memory of 4732 4544 oobeldr.exe 71 PID 4544 wrote to memory of 4732 4544 oobeldr.exe 71 PID 4544 wrote to memory of 4732 4544 oobeldr.exe 71 PID 4544 wrote to memory of 4732 4544 oobeldr.exe 71 PID 4544 wrote to memory of 4732 4544 oobeldr.exe 71 PID 4544 wrote to memory of 4732 4544 oobeldr.exe 71 PID 4544 wrote to memory of 4732 4544 oobeldr.exe 71 PID 4544 wrote to memory of 4732 4544 oobeldr.exe 71 PID 4732 wrote to memory of 1904 4732 oobeldr.exe 72 PID 4732 wrote to memory of 1904 4732 oobeldr.exe 72 PID 4732 wrote to memory of 1904 4732 oobeldr.exe 72 PID 3844 wrote to memory of 4948 3844 oobeldr.exe 75 PID 3844 wrote to memory of 4948 3844 oobeldr.exe 75 PID 3844 wrote to memory of 4948 3844 oobeldr.exe 75 PID 3844 wrote to memory of 4948 3844 oobeldr.exe 75 PID 3844 wrote to memory of 4948 3844 oobeldr.exe 75 PID 3844 wrote to memory of 4948 3844 oobeldr.exe 75 PID 3844 wrote to memory of 4948 3844 oobeldr.exe 75 PID 3844 wrote to memory of 4948 3844 oobeldr.exe 75 PID 3844 wrote to memory of 4948 3844 oobeldr.exe 75
Processes
-
C:\Users\Admin\AppData\Local\Temp\32d34ee25139ce3ab217e4edc7f5c4d8797ed4ff0a7bc36b5127afaf3aa9bf3b.exe"C:\Users\Admin\AppData\Local\Temp\32d34ee25139ce3ab217e4edc7f5c4d8797ed4ff0a7bc36b5127afaf3aa9bf3b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\32d34ee25139ce3ab217e4edc7f5c4d8797ed4ff0a7bc36b5127afaf3aa9bf3b.exeC:\Users\Admin\AppData\Local\Temp\32d34ee25139ce3ab217e4edc7f5c4d8797ed4ff0a7bc36b5127afaf3aa9bf3b.exe2⤵
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
PID:3324
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
PID:3764
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
PID:1904
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
PID:4948
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
789B
MD5db5ef8d7c51bad129d9097bf953e4913
SHA18439db960aa2d431bf5ec3c37af775b45eb07e06
SHA2561248e67f10b47b397af3c8cbe342bad4be75c68b8e10f4ec6341195cc3138bd9
SHA51204572485790b25e1751347e43b47174051cd153dd75fd55ee5590d25a2579f344cd96cf86cf45bdb7759e3e6d0f734d0ff717148ca70f501b9869e964e036fee
-
Filesize
322KB
MD53be55c53fdf88cae6d90504981a45a9e
SHA1c5e18f7232066748a023bee46fa2813fe973c6b6
SHA25632d34ee25139ce3ab217e4edc7f5c4d8797ed4ff0a7bc36b5127afaf3aa9bf3b
SHA51252ddb71186d3edc69533ad3511744fa3eefc03ac6932b32f21c3da2cc95b451ba55d617029cf3e717fad11ede12879529ae9483836d389d973607544e8b318e3
-
Filesize
322KB
MD53be55c53fdf88cae6d90504981a45a9e
SHA1c5e18f7232066748a023bee46fa2813fe973c6b6
SHA25632d34ee25139ce3ab217e4edc7f5c4d8797ed4ff0a7bc36b5127afaf3aa9bf3b
SHA51252ddb71186d3edc69533ad3511744fa3eefc03ac6932b32f21c3da2cc95b451ba55d617029cf3e717fad11ede12879529ae9483836d389d973607544e8b318e3
-
Filesize
322KB
MD53be55c53fdf88cae6d90504981a45a9e
SHA1c5e18f7232066748a023bee46fa2813fe973c6b6
SHA25632d34ee25139ce3ab217e4edc7f5c4d8797ed4ff0a7bc36b5127afaf3aa9bf3b
SHA51252ddb71186d3edc69533ad3511744fa3eefc03ac6932b32f21c3da2cc95b451ba55d617029cf3e717fad11ede12879529ae9483836d389d973607544e8b318e3
-
Filesize
322KB
MD53be55c53fdf88cae6d90504981a45a9e
SHA1c5e18f7232066748a023bee46fa2813fe973c6b6
SHA25632d34ee25139ce3ab217e4edc7f5c4d8797ed4ff0a7bc36b5127afaf3aa9bf3b
SHA51252ddb71186d3edc69533ad3511744fa3eefc03ac6932b32f21c3da2cc95b451ba55d617029cf3e717fad11ede12879529ae9483836d389d973607544e8b318e3
-
Filesize
322KB
MD53be55c53fdf88cae6d90504981a45a9e
SHA1c5e18f7232066748a023bee46fa2813fe973c6b6
SHA25632d34ee25139ce3ab217e4edc7f5c4d8797ed4ff0a7bc36b5127afaf3aa9bf3b
SHA51252ddb71186d3edc69533ad3511744fa3eefc03ac6932b32f21c3da2cc95b451ba55d617029cf3e717fad11ede12879529ae9483836d389d973607544e8b318e3
-
Filesize
322KB
MD53be55c53fdf88cae6d90504981a45a9e
SHA1c5e18f7232066748a023bee46fa2813fe973c6b6
SHA25632d34ee25139ce3ab217e4edc7f5c4d8797ed4ff0a7bc36b5127afaf3aa9bf3b
SHA51252ddb71186d3edc69533ad3511744fa3eefc03ac6932b32f21c3da2cc95b451ba55d617029cf3e717fad11ede12879529ae9483836d389d973607544e8b318e3