Analysis
-
max time kernel
144s -
max time network
147s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
31/10/2022, 22:52
Static task
static1
Behavioral task
behavioral1
Sample
3d5186cdb6100d81aab2351113b9625be943237912928fa232569cbacca0023a.exe
Resource
win10-20220812-en
General
-
Target
3d5186cdb6100d81aab2351113b9625be943237912928fa232569cbacca0023a.exe
-
Size
322KB
-
MD5
4c3bcb18772eb63f5193d237f662814a
-
SHA1
ed84ad25d744d32ec4047cf3a35d5afaec563215
-
SHA256
3d5186cdb6100d81aab2351113b9625be943237912928fa232569cbacca0023a
-
SHA512
59c5df1abe69fd3f4feb80432b920c1c37a91684003c263501e3f9b067f5259f53b4e623771a0aa564f290a4f10e9545e5ec85f60a648a5cc274ea3975f42550
-
SSDEEP
6144:eKlzr1sYCzek2ciDaP9Xk6Ln1W8W/9InBSkZZmLdGcAdgdY6RKpjS:eGhQ2ciDq9ZL1W8q9InBRqELdolRKpj
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 3640 oobeldr.exe 3628 oobeldr.exe 3148 oobeldr.exe 420 oobeldr.exe 528 oobeldr.exe 1568 oobeldr.exe 1608 oobeldr.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 2404 set thread context of 4796 2404 3d5186cdb6100d81aab2351113b9625be943237912928fa232569cbacca0023a.exe 66 PID 3640 set thread context of 3628 3640 oobeldr.exe 70 PID 3148 set thread context of 528 3148 oobeldr.exe 75 PID 1568 set thread context of 1608 1568 oobeldr.exe 77 -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2484 schtasks.exe 4640 schtasks.exe -
Suspicious use of WriteProcessMemory 45 IoCs
description pid Process procid_target PID 2404 wrote to memory of 4796 2404 3d5186cdb6100d81aab2351113b9625be943237912928fa232569cbacca0023a.exe 66 PID 2404 wrote to memory of 4796 2404 3d5186cdb6100d81aab2351113b9625be943237912928fa232569cbacca0023a.exe 66 PID 2404 wrote to memory of 4796 2404 3d5186cdb6100d81aab2351113b9625be943237912928fa232569cbacca0023a.exe 66 PID 2404 wrote to memory of 4796 2404 3d5186cdb6100d81aab2351113b9625be943237912928fa232569cbacca0023a.exe 66 PID 2404 wrote to memory of 4796 2404 3d5186cdb6100d81aab2351113b9625be943237912928fa232569cbacca0023a.exe 66 PID 2404 wrote to memory of 4796 2404 3d5186cdb6100d81aab2351113b9625be943237912928fa232569cbacca0023a.exe 66 PID 2404 wrote to memory of 4796 2404 3d5186cdb6100d81aab2351113b9625be943237912928fa232569cbacca0023a.exe 66 PID 2404 wrote to memory of 4796 2404 3d5186cdb6100d81aab2351113b9625be943237912928fa232569cbacca0023a.exe 66 PID 2404 wrote to memory of 4796 2404 3d5186cdb6100d81aab2351113b9625be943237912928fa232569cbacca0023a.exe 66 PID 4796 wrote to memory of 2484 4796 3d5186cdb6100d81aab2351113b9625be943237912928fa232569cbacca0023a.exe 67 PID 4796 wrote to memory of 2484 4796 3d5186cdb6100d81aab2351113b9625be943237912928fa232569cbacca0023a.exe 67 PID 4796 wrote to memory of 2484 4796 3d5186cdb6100d81aab2351113b9625be943237912928fa232569cbacca0023a.exe 67 PID 3640 wrote to memory of 3628 3640 oobeldr.exe 70 PID 3640 wrote to memory of 3628 3640 oobeldr.exe 70 PID 3640 wrote to memory of 3628 3640 oobeldr.exe 70 PID 3640 wrote to memory of 3628 3640 oobeldr.exe 70 PID 3640 wrote to memory of 3628 3640 oobeldr.exe 70 PID 3640 wrote to memory of 3628 3640 oobeldr.exe 70 PID 3640 wrote to memory of 3628 3640 oobeldr.exe 70 PID 3640 wrote to memory of 3628 3640 oobeldr.exe 70 PID 3640 wrote to memory of 3628 3640 oobeldr.exe 70 PID 3628 wrote to memory of 4640 3628 oobeldr.exe 71 PID 3628 wrote to memory of 4640 3628 oobeldr.exe 71 PID 3628 wrote to memory of 4640 3628 oobeldr.exe 71 PID 3148 wrote to memory of 420 3148 oobeldr.exe 74 PID 3148 wrote to memory of 420 3148 oobeldr.exe 74 PID 3148 wrote to memory of 420 3148 oobeldr.exe 74 PID 3148 wrote to memory of 528 3148 oobeldr.exe 75 PID 3148 wrote to memory of 528 3148 oobeldr.exe 75 PID 3148 wrote to memory of 528 3148 oobeldr.exe 75 PID 3148 wrote to memory of 528 3148 oobeldr.exe 75 PID 3148 wrote to memory of 528 3148 oobeldr.exe 75 PID 3148 wrote to memory of 528 3148 oobeldr.exe 75 PID 3148 wrote to memory of 528 3148 oobeldr.exe 75 PID 3148 wrote to memory of 528 3148 oobeldr.exe 75 PID 3148 wrote to memory of 528 3148 oobeldr.exe 75 PID 1568 wrote to memory of 1608 1568 oobeldr.exe 77 PID 1568 wrote to memory of 1608 1568 oobeldr.exe 77 PID 1568 wrote to memory of 1608 1568 oobeldr.exe 77 PID 1568 wrote to memory of 1608 1568 oobeldr.exe 77 PID 1568 wrote to memory of 1608 1568 oobeldr.exe 77 PID 1568 wrote to memory of 1608 1568 oobeldr.exe 77 PID 1568 wrote to memory of 1608 1568 oobeldr.exe 77 PID 1568 wrote to memory of 1608 1568 oobeldr.exe 77 PID 1568 wrote to memory of 1608 1568 oobeldr.exe 77
Processes
-
C:\Users\Admin\AppData\Local\Temp\3d5186cdb6100d81aab2351113b9625be943237912928fa232569cbacca0023a.exe"C:\Users\Admin\AppData\Local\Temp\3d5186cdb6100d81aab2351113b9625be943237912928fa232569cbacca0023a.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\3d5186cdb6100d81aab2351113b9625be943237912928fa232569cbacca0023a.exeC:\Users\Admin\AppData\Local\Temp\3d5186cdb6100d81aab2351113b9625be943237912928fa232569cbacca0023a.exe2⤵
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
PID:2484
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
PID:4640
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
PID:420
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
PID:528
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
PID:1608
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
789B
MD5db5ef8d7c51bad129d9097bf953e4913
SHA18439db960aa2d431bf5ec3c37af775b45eb07e06
SHA2561248e67f10b47b397af3c8cbe342bad4be75c68b8e10f4ec6341195cc3138bd9
SHA51204572485790b25e1751347e43b47174051cd153dd75fd55ee5590d25a2579f344cd96cf86cf45bdb7759e3e6d0f734d0ff717148ca70f501b9869e964e036fee
-
Filesize
322KB
MD54c3bcb18772eb63f5193d237f662814a
SHA1ed84ad25d744d32ec4047cf3a35d5afaec563215
SHA2563d5186cdb6100d81aab2351113b9625be943237912928fa232569cbacca0023a
SHA51259c5df1abe69fd3f4feb80432b920c1c37a91684003c263501e3f9b067f5259f53b4e623771a0aa564f290a4f10e9545e5ec85f60a648a5cc274ea3975f42550
-
Filesize
322KB
MD54c3bcb18772eb63f5193d237f662814a
SHA1ed84ad25d744d32ec4047cf3a35d5afaec563215
SHA2563d5186cdb6100d81aab2351113b9625be943237912928fa232569cbacca0023a
SHA51259c5df1abe69fd3f4feb80432b920c1c37a91684003c263501e3f9b067f5259f53b4e623771a0aa564f290a4f10e9545e5ec85f60a648a5cc274ea3975f42550
-
Filesize
322KB
MD54c3bcb18772eb63f5193d237f662814a
SHA1ed84ad25d744d32ec4047cf3a35d5afaec563215
SHA2563d5186cdb6100d81aab2351113b9625be943237912928fa232569cbacca0023a
SHA51259c5df1abe69fd3f4feb80432b920c1c37a91684003c263501e3f9b067f5259f53b4e623771a0aa564f290a4f10e9545e5ec85f60a648a5cc274ea3975f42550
-
Filesize
322KB
MD54c3bcb18772eb63f5193d237f662814a
SHA1ed84ad25d744d32ec4047cf3a35d5afaec563215
SHA2563d5186cdb6100d81aab2351113b9625be943237912928fa232569cbacca0023a
SHA51259c5df1abe69fd3f4feb80432b920c1c37a91684003c263501e3f9b067f5259f53b4e623771a0aa564f290a4f10e9545e5ec85f60a648a5cc274ea3975f42550
-
Filesize
322KB
MD54c3bcb18772eb63f5193d237f662814a
SHA1ed84ad25d744d32ec4047cf3a35d5afaec563215
SHA2563d5186cdb6100d81aab2351113b9625be943237912928fa232569cbacca0023a
SHA51259c5df1abe69fd3f4feb80432b920c1c37a91684003c263501e3f9b067f5259f53b4e623771a0aa564f290a4f10e9545e5ec85f60a648a5cc274ea3975f42550
-
Filesize
322KB
MD54c3bcb18772eb63f5193d237f662814a
SHA1ed84ad25d744d32ec4047cf3a35d5afaec563215
SHA2563d5186cdb6100d81aab2351113b9625be943237912928fa232569cbacca0023a
SHA51259c5df1abe69fd3f4feb80432b920c1c37a91684003c263501e3f9b067f5259f53b4e623771a0aa564f290a4f10e9545e5ec85f60a648a5cc274ea3975f42550
-
Filesize
322KB
MD54c3bcb18772eb63f5193d237f662814a
SHA1ed84ad25d744d32ec4047cf3a35d5afaec563215
SHA2563d5186cdb6100d81aab2351113b9625be943237912928fa232569cbacca0023a
SHA51259c5df1abe69fd3f4feb80432b920c1c37a91684003c263501e3f9b067f5259f53b4e623771a0aa564f290a4f10e9545e5ec85f60a648a5cc274ea3975f42550
-
Filesize
322KB
MD54c3bcb18772eb63f5193d237f662814a
SHA1ed84ad25d744d32ec4047cf3a35d5afaec563215
SHA2563d5186cdb6100d81aab2351113b9625be943237912928fa232569cbacca0023a
SHA51259c5df1abe69fd3f4feb80432b920c1c37a91684003c263501e3f9b067f5259f53b4e623771a0aa564f290a4f10e9545e5ec85f60a648a5cc274ea3975f42550