da5a459fcdba4e1909b6233e5ba248499fc14e77c6b30747f98e4ebc91617c2a

Analysis

max time kernel
133s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/11/2022, 05:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

da5a459fcdba4e1909b6233e5ba248499fc14e77c6b30747f98e4ebc91617c2a.exe
Size

323KB
MD5

e6a9073196fd70c285341b22706cf47b
SHA1

79c74e6350ae2db0a3616732d973b7fac8f7e67f
SHA256

da5a459fcdba4e1909b6233e5ba248499fc14e77c6b30747f98e4ebc91617c2a
SHA512

b9d990c8fb5238a857a425259fcdad31ca89326f5ccb2e175fadfeccc545be10cbc131bf15f7fdf1f9c6eb1ef102b11d572fdbb5fa640bfabc50672d26fcdda4
SSDEEP

6144:eKlzr1sYCzek2ciDaP9Xk6Ln1W8W/9InBSkZZmLdGcAdgdY6RKpjS:eGhQ2ciDq9ZL1W8q9InBRqELdolRKpj

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 6 IoCs

pid	Process
4676	oobeldr.exe
3504	oobeldr.exe
1880	oobeldr.exe
5052	oobeldr.exe
596	oobeldr.exe
1796	oobeldr.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1976 set thread context of 5088	1976	da5a459fcdba4e1909b6233e5ba248499fc14e77c6b30747f98e4ebc91617c2a.exe	80
PID 4676 set thread context of 3504	4676	oobeldr.exe	84
PID 1880 set thread context of 5052	1880	oobeldr.exe	96
PID 596 set thread context of 1796	596	oobeldr.exe	100

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4320	3504	WerFault.exe	84

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1152	schtasks.exe
2268	schtasks.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 5088	1976	da5a459fcdba4e1909b6233e5ba248499fc14e77c6b30747f98e4ebc91617c2a.exe	80
PID 1976 wrote to memory of 5088	1976	da5a459fcdba4e1909b6233e5ba248499fc14e77c6b30747f98e4ebc91617c2a.exe	80
PID 1976 wrote to memory of 5088	1976	da5a459fcdba4e1909b6233e5ba248499fc14e77c6b30747f98e4ebc91617c2a.exe	80
PID 1976 wrote to memory of 5088	1976	da5a459fcdba4e1909b6233e5ba248499fc14e77c6b30747f98e4ebc91617c2a.exe	80
PID 1976 wrote to memory of 5088	1976	da5a459fcdba4e1909b6233e5ba248499fc14e77c6b30747f98e4ebc91617c2a.exe	80
PID 1976 wrote to memory of 5088	1976	da5a459fcdba4e1909b6233e5ba248499fc14e77c6b30747f98e4ebc91617c2a.exe	80
PID 1976 wrote to memory of 5088	1976	da5a459fcdba4e1909b6233e5ba248499fc14e77c6b30747f98e4ebc91617c2a.exe	80
PID 1976 wrote to memory of 5088	1976	da5a459fcdba4e1909b6233e5ba248499fc14e77c6b30747f98e4ebc91617c2a.exe	80
PID 1976 wrote to memory of 5088	1976	da5a459fcdba4e1909b6233e5ba248499fc14e77c6b30747f98e4ebc91617c2a.exe	80
PID 5088 wrote to memory of 1152	5088	da5a459fcdba4e1909b6233e5ba248499fc14e77c6b30747f98e4ebc91617c2a.exe	81
PID 5088 wrote to memory of 1152	5088	da5a459fcdba4e1909b6233e5ba248499fc14e77c6b30747f98e4ebc91617c2a.exe	81
PID 5088 wrote to memory of 1152	5088	da5a459fcdba4e1909b6233e5ba248499fc14e77c6b30747f98e4ebc91617c2a.exe	81
PID 4676 wrote to memory of 3504	4676	oobeldr.exe	84
PID 4676 wrote to memory of 3504	4676	oobeldr.exe	84
PID 4676 wrote to memory of 3504	4676	oobeldr.exe	84
PID 4676 wrote to memory of 3504	4676	oobeldr.exe	84
PID 4676 wrote to memory of 3504	4676	oobeldr.exe	84
PID 4676 wrote to memory of 3504	4676	oobeldr.exe	84
PID 4676 wrote to memory of 3504	4676	oobeldr.exe	84
PID 4676 wrote to memory of 3504	4676	oobeldr.exe	84
PID 4676 wrote to memory of 3504	4676	oobeldr.exe	84
PID 1880 wrote to memory of 5052	1880	oobeldr.exe	96
PID 1880 wrote to memory of 5052	1880	oobeldr.exe	96
PID 1880 wrote to memory of 5052	1880	oobeldr.exe	96
PID 1880 wrote to memory of 5052	1880	oobeldr.exe	96
PID 1880 wrote to memory of 5052	1880	oobeldr.exe	96
PID 1880 wrote to memory of 5052	1880	oobeldr.exe	96
PID 1880 wrote to memory of 5052	1880	oobeldr.exe	96
PID 1880 wrote to memory of 5052	1880	oobeldr.exe	96
PID 1880 wrote to memory of 5052	1880	oobeldr.exe	96
PID 5052 wrote to memory of 2268	5052	oobeldr.exe	97
PID 5052 wrote to memory of 2268	5052	oobeldr.exe	97
PID 5052 wrote to memory of 2268	5052	oobeldr.exe	97
PID 596 wrote to memory of 1796	596	oobeldr.exe	100
PID 596 wrote to memory of 1796	596	oobeldr.exe	100
PID 596 wrote to memory of 1796	596	oobeldr.exe	100
PID 596 wrote to memory of 1796	596	oobeldr.exe	100
PID 596 wrote to memory of 1796	596	oobeldr.exe	100
PID 596 wrote to memory of 1796	596	oobeldr.exe	100
PID 596 wrote to memory of 1796	596	oobeldr.exe	100
PID 596 wrote to memory of 1796	596	oobeldr.exe	100
PID 596 wrote to memory of 1796	596	oobeldr.exe	100

C:\Users\Admin\AppData\Local\Temp\da5a459fcdba4e1909b6233e5ba248499fc14e77c6b30747f98e4ebc91617c2a.exe
"C:\Users\Admin\AppData\Local\Temp\da5a459fcdba4e1909b6233e5ba248499fc14e77c6b30747f98e4ebc91617c2a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Users\Admin\AppData\Local\Temp\da5a459fcdba4e1909b6233e5ba248499fc14e77c6b30747f98e4ebc91617c2a.exe
  C:\Users\Admin\AppData\Local\Temp\da5a459fcdba4e1909b6233e5ba248499fc14e77c6b30747f98e4ebc91617c2a.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5088
- - C:\Windows\SysWOW64\schtasks.exe
    /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
    3⤵
    - Creates scheduled task(s)
    PID:1152

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4676
- C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
  2⤵
  - Executes dropped EXE
  PID:3504
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3504 -s 144
    3⤵
    - Program crash
    PID:4320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3504 -ip 3504
1⤵
PID:4556

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1880
- C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5052
- - C:\Windows\SysWOW64\schtasks.exe
    /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
    3⤵
    - Creates scheduled task(s)
    PID:2268

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:596
- C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
  2⤵
  - Executes dropped EXE
  PID:1796

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\oobeldr.exe.log

Filesize
789B

MD5
03d2df1e8834bc4ec1756735429b458c

SHA1
4ee6c0f5b04c8e0c5076219c5724032daab11d40

SHA256
745ab70552d9a0463b791fd8dc1942838ac3e34fb1a68f09ed3766c7e3b05631

SHA512
2482c3d4478125ccbc7f224f50e86b7bf925ed438b59f4dce57b9b6bcdb59df51417049096b131b6b911173550eed98bc92aba7050861de303a692f0681b197b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe

Filesize
323KB

MD5
e6a9073196fd70c285341b22706cf47b

SHA1
79c74e6350ae2db0a3616732d973b7fac8f7e67f

SHA256
da5a459fcdba4e1909b6233e5ba248499fc14e77c6b30747f98e4ebc91617c2a

SHA512
b9d990c8fb5238a857a425259fcdad31ca89326f5ccb2e175fadfeccc545be10cbc131bf15f7fdf1f9c6eb1ef102b11d572fdbb5fa640bfabc50672d26fcdda4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe

Filesize
323KB

MD5
e6a9073196fd70c285341b22706cf47b

SHA1
79c74e6350ae2db0a3616732d973b7fac8f7e67f

SHA256
da5a459fcdba4e1909b6233e5ba248499fc14e77c6b30747f98e4ebc91617c2a

SHA512
b9d990c8fb5238a857a425259fcdad31ca89326f5ccb2e175fadfeccc545be10cbc131bf15f7fdf1f9c6eb1ef102b11d572fdbb5fa640bfabc50672d26fcdda4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe

Filesize
323KB

MD5
e6a9073196fd70c285341b22706cf47b

SHA1
79c74e6350ae2db0a3616732d973b7fac8f7e67f

SHA256
da5a459fcdba4e1909b6233e5ba248499fc14e77c6b30747f98e4ebc91617c2a

SHA512
b9d990c8fb5238a857a425259fcdad31ca89326f5ccb2e175fadfeccc545be10cbc131bf15f7fdf1f9c6eb1ef102b11d572fdbb5fa640bfabc50672d26fcdda4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe

Filesize
323KB

MD5
e6a9073196fd70c285341b22706cf47b

SHA1
79c74e6350ae2db0a3616732d973b7fac8f7e67f

SHA256
da5a459fcdba4e1909b6233e5ba248499fc14e77c6b30747f98e4ebc91617c2a

SHA512
b9d990c8fb5238a857a425259fcdad31ca89326f5ccb2e175fadfeccc545be10cbc131bf15f7fdf1f9c6eb1ef102b11d572fdbb5fa640bfabc50672d26fcdda4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe

Filesize
323KB

MD5
e6a9073196fd70c285341b22706cf47b

SHA1
79c74e6350ae2db0a3616732d973b7fac8f7e67f

SHA256
da5a459fcdba4e1909b6233e5ba248499fc14e77c6b30747f98e4ebc91617c2a

SHA512
b9d990c8fb5238a857a425259fcdad31ca89326f5ccb2e175fadfeccc545be10cbc131bf15f7fdf1f9c6eb1ef102b11d572fdbb5fa640bfabc50672d26fcdda4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe

Filesize
323KB

MD5
e6a9073196fd70c285341b22706cf47b

SHA1
79c74e6350ae2db0a3616732d973b7fac8f7e67f

SHA256
da5a459fcdba4e1909b6233e5ba248499fc14e77c6b30747f98e4ebc91617c2a

SHA512
b9d990c8fb5238a857a425259fcdad31ca89326f5ccb2e175fadfeccc545be10cbc131bf15f7fdf1f9c6eb1ef102b11d572fdbb5fa640bfabc50672d26fcdda4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe

Filesize
323KB

MD5
e6a9073196fd70c285341b22706cf47b

SHA1
79c74e6350ae2db0a3616732d973b7fac8f7e67f

SHA256
da5a459fcdba4e1909b6233e5ba248499fc14e77c6b30747f98e4ebc91617c2a

SHA512
b9d990c8fb5238a857a425259fcdad31ca89326f5ccb2e175fadfeccc545be10cbc131bf15f7fdf1f9c6eb1ef102b11d572fdbb5fa640bfabc50672d26fcdda4

Download Submit
memory/1976-132-0x00000000007A0000-0x00000000007F6000-memory.dmp

Filesize
344KB

Download
memory/1976-134-0x00000000077F0000-0x0000000007882000-memory.dmp

Filesize
584KB

Download
memory/1976-136-0x00000000053A0000-0x00000000053BE000-memory.dmp

Filesize
120KB

Download
memory/1976-135-0x0000000007A90000-0x0000000007B06000-memory.dmp

Filesize
472KB

Download
memory/1976-133-0x0000000007D00000-0x00000000082A4000-memory.dmp

Filesize
5.6MB

Download
memory/5088-142-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/5088-140-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/5088-138-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads