Analysis
-
max time kernel
106s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
31/10/2022, 22:54
Static task
static1
Behavioral task
behavioral1
Sample
62389bb1ee076db37ae0e91c72bc85ca4753a98d97c3ad92c35f5c4c634016fd.exe
Resource
win10v2004-20220901-en
General
-
Target
62389bb1ee076db37ae0e91c72bc85ca4753a98d97c3ad92c35f5c4c634016fd.exe
-
Size
322KB
-
MD5
d0a7906b4f4e7eed3a74b9ef9e2b0a21
-
SHA1
f095772e113973f627d1d974358a7b0a28dba964
-
SHA256
62389bb1ee076db37ae0e91c72bc85ca4753a98d97c3ad92c35f5c4c634016fd
-
SHA512
65c0e7d4abff1d050763f12a7006201519a9037ad09c57103223f3b23c7395cf360bd016e3aa9d0dd8bf31c99bdfdc28a8094c16ce578c3e45dbea0572202592
-
SSDEEP
6144:eKlzr1sYCzek2ciDaP9Xk6Ln1W8W/9InBSkZZmLdGcAdgdY6RKpjS:eGhQ2ciDq9ZL1W8q9InBRqELdolRKpj
Malware Config
Signatures
-
Executes dropped EXE 5 IoCs
pid Process 4692 oobeldr.exe 1940 oobeldr.exe 1844 oobeldr.exe 972 oobeldr.exe 1088 oobeldr.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2532 set thread context of 5096 2532 62389bb1ee076db37ae0e91c72bc85ca4753a98d97c3ad92c35f5c4c634016fd.exe 86 PID 4692 set thread context of 1940 4692 oobeldr.exe 94 PID 1844 set thread context of 1088 1844 oobeldr.exe 99 -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1132 schtasks.exe 2716 schtasks.exe -
Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 2532 wrote to memory of 2656 2532 62389bb1ee076db37ae0e91c72bc85ca4753a98d97c3ad92c35f5c4c634016fd.exe 82 PID 2532 wrote to memory of 2656 2532 62389bb1ee076db37ae0e91c72bc85ca4753a98d97c3ad92c35f5c4c634016fd.exe 82 PID 2532 wrote to memory of 2656 2532 62389bb1ee076db37ae0e91c72bc85ca4753a98d97c3ad92c35f5c4c634016fd.exe 82 PID 2532 wrote to memory of 5096 2532 62389bb1ee076db37ae0e91c72bc85ca4753a98d97c3ad92c35f5c4c634016fd.exe 86 PID 2532 wrote to memory of 5096 2532 62389bb1ee076db37ae0e91c72bc85ca4753a98d97c3ad92c35f5c4c634016fd.exe 86 PID 2532 wrote to memory of 5096 2532 62389bb1ee076db37ae0e91c72bc85ca4753a98d97c3ad92c35f5c4c634016fd.exe 86 PID 2532 wrote to memory of 5096 2532 62389bb1ee076db37ae0e91c72bc85ca4753a98d97c3ad92c35f5c4c634016fd.exe 86 PID 2532 wrote to memory of 5096 2532 62389bb1ee076db37ae0e91c72bc85ca4753a98d97c3ad92c35f5c4c634016fd.exe 86 PID 2532 wrote to memory of 5096 2532 62389bb1ee076db37ae0e91c72bc85ca4753a98d97c3ad92c35f5c4c634016fd.exe 86 PID 2532 wrote to memory of 5096 2532 62389bb1ee076db37ae0e91c72bc85ca4753a98d97c3ad92c35f5c4c634016fd.exe 86 PID 2532 wrote to memory of 5096 2532 62389bb1ee076db37ae0e91c72bc85ca4753a98d97c3ad92c35f5c4c634016fd.exe 86 PID 2532 wrote to memory of 5096 2532 62389bb1ee076db37ae0e91c72bc85ca4753a98d97c3ad92c35f5c4c634016fd.exe 86 PID 5096 wrote to memory of 1132 5096 62389bb1ee076db37ae0e91c72bc85ca4753a98d97c3ad92c35f5c4c634016fd.exe 88 PID 5096 wrote to memory of 1132 5096 62389bb1ee076db37ae0e91c72bc85ca4753a98d97c3ad92c35f5c4c634016fd.exe 88 PID 5096 wrote to memory of 1132 5096 62389bb1ee076db37ae0e91c72bc85ca4753a98d97c3ad92c35f5c4c634016fd.exe 88 PID 4692 wrote to memory of 1940 4692 oobeldr.exe 94 PID 4692 wrote to memory of 1940 4692 oobeldr.exe 94 PID 4692 wrote to memory of 1940 4692 oobeldr.exe 94 PID 4692 wrote to memory of 1940 4692 oobeldr.exe 94 PID 4692 wrote to memory of 1940 4692 oobeldr.exe 94 PID 4692 wrote to memory of 1940 4692 oobeldr.exe 94 PID 4692 wrote to memory of 1940 4692 oobeldr.exe 94 PID 4692 wrote to memory of 1940 4692 oobeldr.exe 94 PID 4692 wrote to memory of 1940 4692 oobeldr.exe 94 PID 1940 wrote to memory of 2716 1940 oobeldr.exe 95 PID 1940 wrote to memory of 2716 1940 oobeldr.exe 95 PID 1940 wrote to memory of 2716 1940 oobeldr.exe 95 PID 1844 wrote to memory of 972 1844 oobeldr.exe 98 PID 1844 wrote to memory of 972 1844 oobeldr.exe 98 PID 1844 wrote to memory of 972 1844 oobeldr.exe 98 PID 1844 wrote to memory of 1088 1844 oobeldr.exe 99 PID 1844 wrote to memory of 1088 1844 oobeldr.exe 99 PID 1844 wrote to memory of 1088 1844 oobeldr.exe 99 PID 1844 wrote to memory of 1088 1844 oobeldr.exe 99 PID 1844 wrote to memory of 1088 1844 oobeldr.exe 99 PID 1844 wrote to memory of 1088 1844 oobeldr.exe 99 PID 1844 wrote to memory of 1088 1844 oobeldr.exe 99 PID 1844 wrote to memory of 1088 1844 oobeldr.exe 99 PID 1844 wrote to memory of 1088 1844 oobeldr.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\62389bb1ee076db37ae0e91c72bc85ca4753a98d97c3ad92c35f5c4c634016fd.exe"C:\Users\Admin\AppData\Local\Temp\62389bb1ee076db37ae0e91c72bc85ca4753a98d97c3ad92c35f5c4c634016fd.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\62389bb1ee076db37ae0e91c72bc85ca4753a98d97c3ad92c35f5c4c634016fd.exeC:\Users\Admin\AppData\Local\Temp\62389bb1ee076db37ae0e91c72bc85ca4753a98d97c3ad92c35f5c4c634016fd.exe2⤵PID:2656
-
-
C:\Users\Admin\AppData\Local\Temp\62389bb1ee076db37ae0e91c72bc85ca4753a98d97c3ad92c35f5c4c634016fd.exeC:\Users\Admin\AppData\Local\Temp\62389bb1ee076db37ae0e91c72bc85ca4753a98d97c3ad92c35f5c4c634016fd.exe2⤵
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
PID:1132
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
PID:2716
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
PID:972
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
PID:1088
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
789B
MD503d2df1e8834bc4ec1756735429b458c
SHA14ee6c0f5b04c8e0c5076219c5724032daab11d40
SHA256745ab70552d9a0463b791fd8dc1942838ac3e34fb1a68f09ed3766c7e3b05631
SHA5122482c3d4478125ccbc7f224f50e86b7bf925ed438b59f4dce57b9b6bcdb59df51417049096b131b6b911173550eed98bc92aba7050861de303a692f0681b197b
-
Filesize
322KB
MD5d0a7906b4f4e7eed3a74b9ef9e2b0a21
SHA1f095772e113973f627d1d974358a7b0a28dba964
SHA25662389bb1ee076db37ae0e91c72bc85ca4753a98d97c3ad92c35f5c4c634016fd
SHA51265c0e7d4abff1d050763f12a7006201519a9037ad09c57103223f3b23c7395cf360bd016e3aa9d0dd8bf31c99bdfdc28a8094c16ce578c3e45dbea0572202592
-
Filesize
322KB
MD5d0a7906b4f4e7eed3a74b9ef9e2b0a21
SHA1f095772e113973f627d1d974358a7b0a28dba964
SHA25662389bb1ee076db37ae0e91c72bc85ca4753a98d97c3ad92c35f5c4c634016fd
SHA51265c0e7d4abff1d050763f12a7006201519a9037ad09c57103223f3b23c7395cf360bd016e3aa9d0dd8bf31c99bdfdc28a8094c16ce578c3e45dbea0572202592
-
Filesize
322KB
MD5d0a7906b4f4e7eed3a74b9ef9e2b0a21
SHA1f095772e113973f627d1d974358a7b0a28dba964
SHA25662389bb1ee076db37ae0e91c72bc85ca4753a98d97c3ad92c35f5c4c634016fd
SHA51265c0e7d4abff1d050763f12a7006201519a9037ad09c57103223f3b23c7395cf360bd016e3aa9d0dd8bf31c99bdfdc28a8094c16ce578c3e45dbea0572202592
-
Filesize
322KB
MD5d0a7906b4f4e7eed3a74b9ef9e2b0a21
SHA1f095772e113973f627d1d974358a7b0a28dba964
SHA25662389bb1ee076db37ae0e91c72bc85ca4753a98d97c3ad92c35f5c4c634016fd
SHA51265c0e7d4abff1d050763f12a7006201519a9037ad09c57103223f3b23c7395cf360bd016e3aa9d0dd8bf31c99bdfdc28a8094c16ce578c3e45dbea0572202592
-
Filesize
322KB
MD5d0a7906b4f4e7eed3a74b9ef9e2b0a21
SHA1f095772e113973f627d1d974358a7b0a28dba964
SHA25662389bb1ee076db37ae0e91c72bc85ca4753a98d97c3ad92c35f5c4c634016fd
SHA51265c0e7d4abff1d050763f12a7006201519a9037ad09c57103223f3b23c7395cf360bd016e3aa9d0dd8bf31c99bdfdc28a8094c16ce578c3e45dbea0572202592
-
Filesize
322KB
MD5d0a7906b4f4e7eed3a74b9ef9e2b0a21
SHA1f095772e113973f627d1d974358a7b0a28dba964
SHA25662389bb1ee076db37ae0e91c72bc85ca4753a98d97c3ad92c35f5c4c634016fd
SHA51265c0e7d4abff1d050763f12a7006201519a9037ad09c57103223f3b23c7395cf360bd016e3aa9d0dd8bf31c99bdfdc28a8094c16ce578c3e45dbea0572202592