Analysis
-
max time kernel
123s -
max time network
146s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
31/10/2022, 22:51
Static task
static1
Behavioral task
behavioral1
Sample
5f88b53875cd796e472627811d99ee611730a291f42d31d0dc38eb59e385c7d1.exe
Resource
win10-20220812-en
General
-
Target
5f88b53875cd796e472627811d99ee611730a291f42d31d0dc38eb59e385c7d1.exe
-
Size
322KB
-
MD5
7e2202a4fe6215f7e8c2523716624fa2
-
SHA1
618f7148df9d5ac1370c7a79e8caed32545163ce
-
SHA256
5f88b53875cd796e472627811d99ee611730a291f42d31d0dc38eb59e385c7d1
-
SHA512
b61ea3a72d9d562bd68f7c244548d6fef5d372aefbb38b594555365dd1097b27366e72d8edea28f0dd788c196799be8bf2d8cb96c6175e80d189655485a80870
-
SSDEEP
6144:eKlzr1sYCzek2ciDaP9Xk6Ln1W8W/9InBSkZZmLdGcAdgdY6RKpjS:eGhQ2ciDq9ZL1W8q9InBRqELdolRKpj
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 3416 oobeldr.exe 4244 oobeldr.exe 3976 oobeldr.exe 1332 oobeldr.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1776 set thread context of 2576 1776 5f88b53875cd796e472627811d99ee611730a291f42d31d0dc38eb59e385c7d1.exe 66 PID 3416 set thread context of 4244 3416 oobeldr.exe 70 PID 3976 set thread context of 1332 3976 oobeldr.exe 74 -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3404 schtasks.exe 4012 schtasks.exe -
Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 1776 wrote to memory of 2576 1776 5f88b53875cd796e472627811d99ee611730a291f42d31d0dc38eb59e385c7d1.exe 66 PID 1776 wrote to memory of 2576 1776 5f88b53875cd796e472627811d99ee611730a291f42d31d0dc38eb59e385c7d1.exe 66 PID 1776 wrote to memory of 2576 1776 5f88b53875cd796e472627811d99ee611730a291f42d31d0dc38eb59e385c7d1.exe 66 PID 1776 wrote to memory of 2576 1776 5f88b53875cd796e472627811d99ee611730a291f42d31d0dc38eb59e385c7d1.exe 66 PID 1776 wrote to memory of 2576 1776 5f88b53875cd796e472627811d99ee611730a291f42d31d0dc38eb59e385c7d1.exe 66 PID 1776 wrote to memory of 2576 1776 5f88b53875cd796e472627811d99ee611730a291f42d31d0dc38eb59e385c7d1.exe 66 PID 1776 wrote to memory of 2576 1776 5f88b53875cd796e472627811d99ee611730a291f42d31d0dc38eb59e385c7d1.exe 66 PID 1776 wrote to memory of 2576 1776 5f88b53875cd796e472627811d99ee611730a291f42d31d0dc38eb59e385c7d1.exe 66 PID 1776 wrote to memory of 2576 1776 5f88b53875cd796e472627811d99ee611730a291f42d31d0dc38eb59e385c7d1.exe 66 PID 2576 wrote to memory of 3404 2576 5f88b53875cd796e472627811d99ee611730a291f42d31d0dc38eb59e385c7d1.exe 67 PID 2576 wrote to memory of 3404 2576 5f88b53875cd796e472627811d99ee611730a291f42d31d0dc38eb59e385c7d1.exe 67 PID 2576 wrote to memory of 3404 2576 5f88b53875cd796e472627811d99ee611730a291f42d31d0dc38eb59e385c7d1.exe 67 PID 3416 wrote to memory of 4244 3416 oobeldr.exe 70 PID 3416 wrote to memory of 4244 3416 oobeldr.exe 70 PID 3416 wrote to memory of 4244 3416 oobeldr.exe 70 PID 3416 wrote to memory of 4244 3416 oobeldr.exe 70 PID 3416 wrote to memory of 4244 3416 oobeldr.exe 70 PID 3416 wrote to memory of 4244 3416 oobeldr.exe 70 PID 3416 wrote to memory of 4244 3416 oobeldr.exe 70 PID 3416 wrote to memory of 4244 3416 oobeldr.exe 70 PID 3416 wrote to memory of 4244 3416 oobeldr.exe 70 PID 4244 wrote to memory of 4012 4244 oobeldr.exe 71 PID 4244 wrote to memory of 4012 4244 oobeldr.exe 71 PID 4244 wrote to memory of 4012 4244 oobeldr.exe 71 PID 3976 wrote to memory of 1332 3976 oobeldr.exe 74 PID 3976 wrote to memory of 1332 3976 oobeldr.exe 74 PID 3976 wrote to memory of 1332 3976 oobeldr.exe 74 PID 3976 wrote to memory of 1332 3976 oobeldr.exe 74 PID 3976 wrote to memory of 1332 3976 oobeldr.exe 74 PID 3976 wrote to memory of 1332 3976 oobeldr.exe 74 PID 3976 wrote to memory of 1332 3976 oobeldr.exe 74 PID 3976 wrote to memory of 1332 3976 oobeldr.exe 74 PID 3976 wrote to memory of 1332 3976 oobeldr.exe 74
Processes
-
C:\Users\Admin\AppData\Local\Temp\5f88b53875cd796e472627811d99ee611730a291f42d31d0dc38eb59e385c7d1.exe"C:\Users\Admin\AppData\Local\Temp\5f88b53875cd796e472627811d99ee611730a291f42d31d0dc38eb59e385c7d1.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\5f88b53875cd796e472627811d99ee611730a291f42d31d0dc38eb59e385c7d1.exeC:\Users\Admin\AppData\Local\Temp\5f88b53875cd796e472627811d99ee611730a291f42d31d0dc38eb59e385c7d1.exe2⤵
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
PID:3404
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
PID:4012
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
PID:1332
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
789B
MD5db5ef8d7c51bad129d9097bf953e4913
SHA18439db960aa2d431bf5ec3c37af775b45eb07e06
SHA2561248e67f10b47b397af3c8cbe342bad4be75c68b8e10f4ec6341195cc3138bd9
SHA51204572485790b25e1751347e43b47174051cd153dd75fd55ee5590d25a2579f344cd96cf86cf45bdb7759e3e6d0f734d0ff717148ca70f501b9869e964e036fee
-
Filesize
322KB
MD57e2202a4fe6215f7e8c2523716624fa2
SHA1618f7148df9d5ac1370c7a79e8caed32545163ce
SHA2565f88b53875cd796e472627811d99ee611730a291f42d31d0dc38eb59e385c7d1
SHA512b61ea3a72d9d562bd68f7c244548d6fef5d372aefbb38b594555365dd1097b27366e72d8edea28f0dd788c196799be8bf2d8cb96c6175e80d189655485a80870
-
Filesize
322KB
MD57e2202a4fe6215f7e8c2523716624fa2
SHA1618f7148df9d5ac1370c7a79e8caed32545163ce
SHA2565f88b53875cd796e472627811d99ee611730a291f42d31d0dc38eb59e385c7d1
SHA512b61ea3a72d9d562bd68f7c244548d6fef5d372aefbb38b594555365dd1097b27366e72d8edea28f0dd788c196799be8bf2d8cb96c6175e80d189655485a80870
-
Filesize
322KB
MD57e2202a4fe6215f7e8c2523716624fa2
SHA1618f7148df9d5ac1370c7a79e8caed32545163ce
SHA2565f88b53875cd796e472627811d99ee611730a291f42d31d0dc38eb59e385c7d1
SHA512b61ea3a72d9d562bd68f7c244548d6fef5d372aefbb38b594555365dd1097b27366e72d8edea28f0dd788c196799be8bf2d8cb96c6175e80d189655485a80870
-
Filesize
322KB
MD57e2202a4fe6215f7e8c2523716624fa2
SHA1618f7148df9d5ac1370c7a79e8caed32545163ce
SHA2565f88b53875cd796e472627811d99ee611730a291f42d31d0dc38eb59e385c7d1
SHA512b61ea3a72d9d562bd68f7c244548d6fef5d372aefbb38b594555365dd1097b27366e72d8edea28f0dd788c196799be8bf2d8cb96c6175e80d189655485a80870
-
Filesize
322KB
MD57e2202a4fe6215f7e8c2523716624fa2
SHA1618f7148df9d5ac1370c7a79e8caed32545163ce
SHA2565f88b53875cd796e472627811d99ee611730a291f42d31d0dc38eb59e385c7d1
SHA512b61ea3a72d9d562bd68f7c244548d6fef5d372aefbb38b594555365dd1097b27366e72d8edea28f0dd788c196799be8bf2d8cb96c6175e80d189655485a80870