Analysis
- max time kernel
141s - max time network
143s - platform
windows10-1703_x64 - resource
win10-20220812-en - resource tags
- submitted
01/11/2022, 01:34
General
- Target 6db275d29af43750f94d8f9af8a4f01770142d6117fea40f3ccf288044c2fc18.exe
- Size 322KB
- Sample221101-by4dpsfhck
- SHA256 6db275d29af43750f94d8f9af8a4f01770142d6117fea40f3ccf288044c2fc18
Malware Config
Signatures
- Executes dropped EXE 5 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of WriteProcessMemory 36 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6db275d29af43750f94d8f9af8a4f01770142d6117fea40f3ccf288044c2fc18.exe"C:\Users\Admin\AppData\Local\Temp\6db275d29af43750f94d8f9af8a4f01770142d6117fea40f3ccf288044c2fc18.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6db275d29af43750f94d8f9af8a4f01770142d6117fea40f3ccf288044c2fc18.exeC:\Users\Admin\AppData\Local\Temp\6db275d29af43750f94d8f9af8a4f01770142d6117fea40f3ccf288044c2fc18.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
oobeldr.exe.log
oobeldr.exe
oobeldr.exe
oobeldr.exe
oobeldr.exe
oobeldr.exe
oobeldr.exe
memory/2156-231-0x0000000000400000-0x0000000000406000-memory.dmp
memory/2156-177-0x0000000000400000-0x0000000000406000-memory.dmp
memory/2156-189-0x0000000077770000-0x00000000778FE000-memory.dmp
memory/2156-190-0x0000000077770000-0x00000000778FE000-memory.dmp
memory/2156-188-0x0000000077770000-0x00000000778FE000-memory.dmp
memory/2156-187-0x0000000077770000-0x00000000778FE000-memory.dmp
memory/2156-186-0x0000000077770000-0x00000000778FE000-memory.dmp
memory/2156-185-0x0000000077770000-0x00000000778FE000-memory.dmp
memory/2156-183-0x0000000077770000-0x00000000778FE000-memory.dmp
memory/2156-181-0x0000000077770000-0x00000000778FE000-memory.dmp
memory/2156-180-0x0000000077770000-0x00000000778FE000-memory.dmp
memory/2156-179-0x0000000077770000-0x00000000778FE000-memory.dmp
memory/2620-140-0x0000000077770000-0x00000000778FE000-memory.dmp
memory/2620-171-0x0000000077770000-0x00000000778FE000-memory.dmp
memory/2620-144-0x0000000077770000-0x00000000778FE000-memory.dmp
memory/2620-145-0x0000000077770000-0x00000000778FE000-memory.dmp
memory/2620-146-0x0000000077770000-0x00000000778FE000-memory.dmp
memory/2620-147-0x0000000077770000-0x00000000778FE000-memory.dmp
memory/2620-148-0x0000000077770000-0x00000000778FE000-memory.dmp
memory/2620-149-0x0000000077770000-0x00000000778FE000-memory.dmp
memory/2620-150-0x0000000077770000-0x00000000778FE000-memory.dmp
memory/2620-151-0x0000000077770000-0x00000000778FE000-memory.dmp
memory/2620-152-0x0000000077770000-0x00000000778FE000-memory.dmp
memory/2620-153-0x0000000000810000-0x0000000000866000-memory.dmp
memory/2620-154-0x0000000077770000-0x00000000778FE000-memory.dmp
memory/2620-155-0x0000000077770000-0x00000000778FE000-memory.dmp
memory/2620-156-0x0000000077770000-0x00000000778FE000-memory.dmp
memory/2620-157-0x0000000077770000-0x00000000778FE000-memory.dmp
memory/2620-158-0x0000000077770000-0x00000000778FE000-memory.dmp
memory/2620-159-0x0000000077770000-0x00000000778FE000-memory.dmp
memory/2620-160-0x0000000007570000-0x000000000763C000-memory.dmp
memory/2620-161-0x0000000007B40000-0x000000000803E000-memory.dmp
memory/2620-162-0x0000000077770000-0x00000000778FE000-memory.dmp
memory/2620-163-0x00000000076E0000-0x0000000007772000-memory.dmp
memory/2620-164-0x0000000005060000-0x0000000005066000-memory.dmp
memory/2620-165-0x0000000077770000-0x00000000778FE000-memory.dmp
memory/2620-166-0x0000000007980000-0x00000000079F6000-memory.dmp
memory/2620-167-0x0000000077770000-0x00000000778FE000-memory.dmp
memory/2620-168-0x0000000077770000-0x00000000778FE000-memory.dmp
memory/2620-169-0x0000000077770000-0x00000000778FE000-memory.dmp
memory/2620-170-0x00000000050C0000-0x00000000050DE000-memory.dmp
memory/2620-143-0x0000000077770000-0x00000000778FE000-memory.dmp
memory/2620-172-0x0000000077770000-0x00000000778FE000-memory.dmp
memory/2620-173-0x0000000077770000-0x00000000778FE000-memory.dmp
memory/2620-174-0x0000000077770000-0x00000000778FE000-memory.dmp
memory/2620-175-0x0000000077770000-0x00000000778FE000-memory.dmp
memory/2620-176-0x0000000077770000-0x00000000778FE000-memory.dmp
memory/2620-142-0x0000000077770000-0x00000000778FE000-memory.dmp
memory/2620-141-0x0000000077770000-0x00000000778FE000-memory.dmp
memory/2620-139-0x0000000077770000-0x00000000778FE000-memory.dmp
memory/2620-119-0x0000000077770000-0x00000000778FE000-memory.dmp
memory/2620-138-0x0000000077770000-0x00000000778FE000-memory.dmp
memory/2620-182-0x0000000077770000-0x00000000778FE000-memory.dmp
memory/2620-137-0x0000000077770000-0x00000000778FE000-memory.dmp
memory/2620-136-0x0000000077770000-0x00000000778FE000-memory.dmp
memory/2620-135-0x0000000077770000-0x00000000778FE000-memory.dmp
memory/2620-134-0x0000000077770000-0x00000000778FE000-memory.dmp
memory/2620-133-0x0000000077770000-0x00000000778FE000-memory.dmp
memory/2620-132-0x0000000077770000-0x00000000778FE000-memory.dmp
memory/2620-131-0x0000000077770000-0x00000000778FE000-memory.dmp
memory/2620-130-0x0000000077770000-0x00000000778FE000-memory.dmp
memory/2620-129-0x0000000077770000-0x00000000778FE000-memory.dmp
memory/2620-128-0x0000000077770000-0x00000000778FE000-memory.dmp
memory/2620-127-0x0000000077770000-0x00000000778FE000-memory.dmp
memory/2620-126-0x0000000077770000-0x00000000778FE000-memory.dmp
memory/2620-125-0x0000000077770000-0x00000000778FE000-memory.dmp
memory/2620-124-0x0000000077770000-0x00000000778FE000-memory.dmp
memory/2620-122-0x0000000077770000-0x00000000778FE000-memory.dmp
memory/2620-123-0x0000000077770000-0x00000000778FE000-memory.dmp
memory/2620-121-0x0000000077770000-0x00000000778FE000-memory.dmp
memory/2620-120-0x0000000077770000-0x00000000778FE000-memory.dmp