c668902b9f2bdecca311319fe6191a8b481a9192b73c8f3c786303f733a1859a

Analysis

max time kernel
143s
max time network
147s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
31/10/2022, 20:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c668902b9f2bdecca311319fe6191a8b481a9192b73c8f3c786303f733a1859a.exe
Size

322KB
MD5

679ac3815f73e0f2c4674b6b08412527
SHA1

030a6b21215ad7832d39c4131e786e33dc205481
SHA256

c668902b9f2bdecca311319fe6191a8b481a9192b73c8f3c786303f733a1859a
SHA512

11c0114d5d416113fecbd1baaf469a84f9a3193fcd2d7335faddc4e9cc01d1f30a25babe0c1f9145639be32ab35901e9ade73792b8a33e900a39c1bff803fdf0
SSDEEP

6144:eKlzr1sYCzek2ciDaP9Xk6Ln1W8W/9InBSkZZmLdGcAdgdY6RKpjS:eGhQ2ciDq9ZL1W8q9InBRqELdolRKpj

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4552	oobeldr.exe
3240	oobeldr.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4944 set thread context of 3728	4944	c668902b9f2bdecca311319fe6191a8b481a9192b73c8f3c786303f733a1859a.exe	67
PID 4552 set thread context of 3240	4552	oobeldr.exe	71

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
5084	schtasks.exe
4764	schtasks.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 4944 wrote to memory of 3728	4944	c668902b9f2bdecca311319fe6191a8b481a9192b73c8f3c786303f733a1859a.exe	67
PID 4944 wrote to memory of 3728	4944	c668902b9f2bdecca311319fe6191a8b481a9192b73c8f3c786303f733a1859a.exe	67
PID 4944 wrote to memory of 3728	4944	c668902b9f2bdecca311319fe6191a8b481a9192b73c8f3c786303f733a1859a.exe	67
PID 4944 wrote to memory of 3728	4944	c668902b9f2bdecca311319fe6191a8b481a9192b73c8f3c786303f733a1859a.exe	67
PID 4944 wrote to memory of 3728	4944	c668902b9f2bdecca311319fe6191a8b481a9192b73c8f3c786303f733a1859a.exe	67
PID 4944 wrote to memory of 3728	4944	c668902b9f2bdecca311319fe6191a8b481a9192b73c8f3c786303f733a1859a.exe	67
PID 4944 wrote to memory of 3728	4944	c668902b9f2bdecca311319fe6191a8b481a9192b73c8f3c786303f733a1859a.exe	67
PID 4944 wrote to memory of 3728	4944	c668902b9f2bdecca311319fe6191a8b481a9192b73c8f3c786303f733a1859a.exe	67
PID 4944 wrote to memory of 3728	4944	c668902b9f2bdecca311319fe6191a8b481a9192b73c8f3c786303f733a1859a.exe	67
PID 3728 wrote to memory of 5084	3728	c668902b9f2bdecca311319fe6191a8b481a9192b73c8f3c786303f733a1859a.exe	69
PID 3728 wrote to memory of 5084	3728	c668902b9f2bdecca311319fe6191a8b481a9192b73c8f3c786303f733a1859a.exe	69
PID 3728 wrote to memory of 5084	3728	c668902b9f2bdecca311319fe6191a8b481a9192b73c8f3c786303f733a1859a.exe	69
PID 4552 wrote to memory of 3240	4552	oobeldr.exe	71
PID 4552 wrote to memory of 3240	4552	oobeldr.exe	71
PID 4552 wrote to memory of 3240	4552	oobeldr.exe	71
PID 4552 wrote to memory of 3240	4552	oobeldr.exe	71
PID 4552 wrote to memory of 3240	4552	oobeldr.exe	71
PID 4552 wrote to memory of 3240	4552	oobeldr.exe	71
PID 4552 wrote to memory of 3240	4552	oobeldr.exe	71
PID 4552 wrote to memory of 3240	4552	oobeldr.exe	71
PID 4552 wrote to memory of 3240	4552	oobeldr.exe	71
PID 3240 wrote to memory of 4764	3240	oobeldr.exe	73
PID 3240 wrote to memory of 4764	3240	oobeldr.exe	73
PID 3240 wrote to memory of 4764	3240	oobeldr.exe	73

C:\Users\Admin\AppData\Local\Temp\c668902b9f2bdecca311319fe6191a8b481a9192b73c8f3c786303f733a1859a.exe
"C:\Users\Admin\AppData\Local\Temp\c668902b9f2bdecca311319fe6191a8b481a9192b73c8f3c786303f733a1859a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4944
- C:\Users\Admin\AppData\Local\Temp\c668902b9f2bdecca311319fe6191a8b481a9192b73c8f3c786303f733a1859a.exe
  C:\Users\Admin\AppData\Local\Temp\c668902b9f2bdecca311319fe6191a8b481a9192b73c8f3c786303f733a1859a.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3728
- - C:\Windows\SysWOW64\schtasks.exe
    /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
    3⤵
    - Creates scheduled task(s)
    PID:5084

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4552
- C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3240
- - C:\Windows\SysWOW64\schtasks.exe
    /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
    3⤵
    - Creates scheduled task(s)
    PID:4764

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe

Filesize
322KB

MD5
679ac3815f73e0f2c4674b6b08412527

SHA1
030a6b21215ad7832d39c4131e786e33dc205481

SHA256
c668902b9f2bdecca311319fe6191a8b481a9192b73c8f3c786303f733a1859a

SHA512
11c0114d5d416113fecbd1baaf469a84f9a3193fcd2d7335faddc4e9cc01d1f30a25babe0c1f9145639be32ab35901e9ade73792b8a33e900a39c1bff803fdf0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe

Filesize
322KB

MD5
679ac3815f73e0f2c4674b6b08412527

SHA1
030a6b21215ad7832d39c4131e786e33dc205481

SHA256
c668902b9f2bdecca311319fe6191a8b481a9192b73c8f3c786303f733a1859a

SHA512
11c0114d5d416113fecbd1baaf469a84f9a3193fcd2d7335faddc4e9cc01d1f30a25babe0c1f9145639be32ab35901e9ade73792b8a33e900a39c1bff803fdf0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe

Filesize
322KB

MD5
679ac3815f73e0f2c4674b6b08412527

SHA1
030a6b21215ad7832d39c4131e786e33dc205481

SHA256
c668902b9f2bdecca311319fe6191a8b481a9192b73c8f3c786303f733a1859a

SHA512
11c0114d5d416113fecbd1baaf469a84f9a3193fcd2d7335faddc4e9cc01d1f30a25babe0c1f9145639be32ab35901e9ade73792b8a33e900a39c1bff803fdf0

Download Submit
memory/3728-181-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/3728-207-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3728-174-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3728-176-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/3728-177-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/3728-178-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/3728-179-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/3728-182-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/3728-184-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/3728-186-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/3728-187-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/3728-185-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/3728-183-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-156-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-164-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-141-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-142-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-143-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-144-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-145-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-138-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-136-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-146-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-134-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-133-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-147-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-148-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-149-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-150-0x00000000009A0000-0x00000000009F6000-memory.dmp

Filesize
344KB

Download
memory/4944-151-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-152-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-154-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-117-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-155-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-153-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-157-0x00000000076D0000-0x000000000779C000-memory.dmp

Filesize
816KB

Download
memory/4944-158-0x0000000007CA0000-0x000000000819E000-memory.dmp

Filesize
5.0MB

Download
memory/4944-159-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-160-0x0000000007840000-0x00000000078D2000-memory.dmp

Filesize
584KB

Download
memory/4944-161-0x00000000051F0000-0x00000000051F6000-memory.dmp

Filesize
24KB

Download
memory/4944-162-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-163-0x0000000007AE0000-0x0000000007B56000-memory.dmp

Filesize
472KB

Download
memory/4944-140-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-165-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-166-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-167-0x00000000077C0000-0x00000000077DE000-memory.dmp

Filesize
120KB

Download
memory/4944-168-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-170-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-173-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-172-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-171-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-169-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-139-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-137-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-135-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-132-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-131-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-124-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-126-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-128-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-130-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-129-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-127-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-125-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-123-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-122-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-118-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-121-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-116-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-120-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4944-119-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads