Analysis
- max time kernel
101s - max time network
64s - platform
windows10-1703_x64 - resource
win10-20220901-en - resource tags
- submitted
01/11/2022, 07:34
General
- Target c63fc74f9e4f459e58b95f023c0c5ae0a498b19b8b2ecc792ceffd516110bb21.exe
- Size 323KB
- Sample221101-jd9c8aabfn
- SHA256 c63fc74f9e4f459e58b95f023c0c5ae0a498b19b8b2ecc792ceffd516110bb21
Malware Config
Signatures
- Executes dropped EXE 4 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of WriteProcessMemory 33 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c63fc74f9e4f459e58b95f023c0c5ae0a498b19b8b2ecc792ceffd516110bb21.exe"C:\Users\Admin\AppData\Local\Temp\c63fc74f9e4f459e58b95f023c0c5ae0a498b19b8b2ecc792ceffd516110bb21.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c63fc74f9e4f459e58b95f023c0c5ae0a498b19b8b2ecc792ceffd516110bb21.exeC:\Users\Admin\AppData\Local\Temp\c63fc74f9e4f459e58b95f023c0c5ae0a498b19b8b2ecc792ceffd516110bb21.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
oobeldr.exe.log
oobeldr.exe
oobeldr.exe
oobeldr.exe
oobeldr.exe
oobeldr.exe
memory/2264-190-0x0000000076F80000-0x000000007710E000-memory.dmp
memory/2264-232-0x0000000000400000-0x0000000000406000-memory.dmp
memory/2264-191-0x0000000076F80000-0x000000007710E000-memory.dmp
memory/2264-178-0x0000000000400000-0x0000000000406000-memory.dmp
memory/2264-189-0x0000000076F80000-0x000000007710E000-memory.dmp
memory/2264-188-0x0000000076F80000-0x000000007710E000-memory.dmp
memory/2264-187-0x0000000076F80000-0x000000007710E000-memory.dmp
memory/2264-186-0x0000000076F80000-0x000000007710E000-memory.dmp
memory/2264-183-0x0000000076F80000-0x000000007710E000-memory.dmp
memory/2264-182-0x0000000076F80000-0x000000007710E000-memory.dmp
memory/2264-181-0x0000000076F80000-0x000000007710E000-memory.dmp
memory/2264-180-0x0000000076F80000-0x000000007710E000-memory.dmp
memory/2764-140-0x0000000076F80000-0x000000007710E000-memory.dmp
memory/2764-171-0x0000000004FE0000-0x0000000004FFE000-memory.dmp
memory/2764-142-0x0000000076F80000-0x000000007710E000-memory.dmp
memory/2764-143-0x0000000076F80000-0x000000007710E000-memory.dmp
memory/2764-144-0x0000000076F80000-0x000000007710E000-memory.dmp
memory/2764-145-0x0000000076F80000-0x000000007710E000-memory.dmp
memory/2764-146-0x0000000076F80000-0x000000007710E000-memory.dmp
memory/2764-147-0x0000000076F80000-0x000000007710E000-memory.dmp
memory/2764-148-0x0000000076F80000-0x000000007710E000-memory.dmp
memory/2764-149-0x0000000076F80000-0x000000007710E000-memory.dmp
memory/2764-150-0x0000000076F80000-0x000000007710E000-memory.dmp
memory/2764-151-0x0000000076F80000-0x000000007710E000-memory.dmp
memory/2764-152-0x0000000076F80000-0x000000007710E000-memory.dmp
memory/2764-153-0x0000000076F80000-0x000000007710E000-memory.dmp
memory/2764-154-0x00000000006B0000-0x0000000000706000-memory.dmp
memory/2764-155-0x0000000076F80000-0x000000007710E000-memory.dmp
memory/2764-156-0x0000000076F80000-0x000000007710E000-memory.dmp
memory/2764-157-0x0000000076F80000-0x000000007710E000-memory.dmp
memory/2764-158-0x0000000076F80000-0x000000007710E000-memory.dmp
memory/2764-159-0x0000000076F80000-0x000000007710E000-memory.dmp
memory/2764-160-0x0000000076F80000-0x000000007710E000-memory.dmp
memory/2764-161-0x0000000007340000-0x000000000740C000-memory.dmp
memory/2764-162-0x0000000007910000-0x0000000007E0E000-memory.dmp
memory/2764-163-0x0000000076F80000-0x000000007710E000-memory.dmp
memory/2764-164-0x00000000074F0000-0x0000000007582000-memory.dmp
memory/2764-165-0x0000000007470000-0x0000000007476000-memory.dmp
memory/2764-166-0x0000000076F80000-0x000000007710E000-memory.dmp
memory/2764-167-0x0000000007810000-0x0000000007886000-memory.dmp
memory/2764-168-0x0000000076F80000-0x000000007710E000-memory.dmp
memory/2764-169-0x0000000076F80000-0x000000007710E000-memory.dmp
memory/2764-170-0x0000000076F80000-0x000000007710E000-memory.dmp
memory/2764-141-0x0000000076F80000-0x000000007710E000-memory.dmp
memory/2764-172-0x0000000076F80000-0x000000007710E000-memory.dmp
memory/2764-173-0x0000000076F80000-0x000000007710E000-memory.dmp
memory/2764-174-0x0000000076F80000-0x000000007710E000-memory.dmp
memory/2764-175-0x0000000076F80000-0x000000007710E000-memory.dmp
memory/2764-176-0x0000000076F80000-0x000000007710E000-memory.dmp
memory/2764-177-0x0000000076F80000-0x000000007710E000-memory.dmp
memory/2764-120-0x0000000076F80000-0x000000007710E000-memory.dmp
memory/2764-139-0x0000000076F80000-0x000000007710E000-memory.dmp
memory/2764-138-0x0000000076F80000-0x000000007710E000-memory.dmp
memory/2764-137-0x0000000076F80000-0x000000007710E000-memory.dmp
memory/2764-136-0x0000000076F80000-0x000000007710E000-memory.dmp
memory/2764-135-0x0000000076F80000-0x000000007710E000-memory.dmp
memory/2764-184-0x0000000076F80000-0x000000007710E000-memory.dmp
memory/2764-133-0x0000000076F80000-0x000000007710E000-memory.dmp
memory/2764-134-0x0000000076F80000-0x000000007710E000-memory.dmp
memory/2764-132-0x0000000076F80000-0x000000007710E000-memory.dmp
memory/2764-131-0x0000000076F80000-0x000000007710E000-memory.dmp
memory/2764-130-0x0000000076F80000-0x000000007710E000-memory.dmp
memory/2764-129-0x0000000076F80000-0x000000007710E000-memory.dmp
memory/2764-121-0x0000000076F80000-0x000000007710E000-memory.dmp
memory/2764-128-0x0000000076F80000-0x000000007710E000-memory.dmp
memory/2764-127-0x0000000076F80000-0x000000007710E000-memory.dmp
memory/2764-126-0x0000000076F80000-0x000000007710E000-memory.dmp
memory/2764-125-0x0000000076F80000-0x000000007710E000-memory.dmp
memory/2764-122-0x0000000076F80000-0x000000007710E000-memory.dmp
memory/2764-123-0x0000000076F80000-0x000000007710E000-memory.dmp
memory/2764-124-0x0000000076F80000-0x000000007710E000-memory.dmp