Analysis
-
max time kernel
144s -
max time network
147s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
01/11/2022, 10:34
Static task
static1
Behavioral task
behavioral1
Sample
899c569df9792436429c78b5d96e274f4f64cde8764a4cf123af1ecb58477fbc.exe
Resource
win10-20220812-en
General
-
Target
899c569df9792436429c78b5d96e274f4f64cde8764a4cf123af1ecb58477fbc.exe
-
Size
324KB
-
MD5
5ae5c015cbf13ee10eb95a3c1b2a37df
-
SHA1
ada2a4f3018864496426ad1ef81c4bc0726ba3b7
-
SHA256
899c569df9792436429c78b5d96e274f4f64cde8764a4cf123af1ecb58477fbc
-
SHA512
27d8cbd9fa2d8f435cadc3e4c8b3faa541422bfeaeb7bbe81d9cf1db7415434032783ea3e0061c6ae07fb9f3b21a5afbf19cd2daf363f79706d9ce0c16ac9134
-
SSDEEP
6144:eKlzr1sYCzek2ciDaP9Xk6Ln1W8W/9InBSkZZmLdGcAdgdY6RKpjS:eGhQ2ciDq9ZL1W8q9InBRqELdolRKpj
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 4784 oobeldr.exe 4228 oobeldr.exe 4488 oobeldr.exe 696 oobeldr.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2660 set thread context of 4724 2660 899c569df9792436429c78b5d96e274f4f64cde8764a4cf123af1ecb58477fbc.exe 67 PID 4784 set thread context of 4228 4784 oobeldr.exe 71 PID 4488 set thread context of 696 4488 oobeldr.exe 75 -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4080 schtasks.exe 4516 schtasks.exe -
Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 2660 wrote to memory of 4724 2660 899c569df9792436429c78b5d96e274f4f64cde8764a4cf123af1ecb58477fbc.exe 67 PID 2660 wrote to memory of 4724 2660 899c569df9792436429c78b5d96e274f4f64cde8764a4cf123af1ecb58477fbc.exe 67 PID 2660 wrote to memory of 4724 2660 899c569df9792436429c78b5d96e274f4f64cde8764a4cf123af1ecb58477fbc.exe 67 PID 2660 wrote to memory of 4724 2660 899c569df9792436429c78b5d96e274f4f64cde8764a4cf123af1ecb58477fbc.exe 67 PID 2660 wrote to memory of 4724 2660 899c569df9792436429c78b5d96e274f4f64cde8764a4cf123af1ecb58477fbc.exe 67 PID 2660 wrote to memory of 4724 2660 899c569df9792436429c78b5d96e274f4f64cde8764a4cf123af1ecb58477fbc.exe 67 PID 2660 wrote to memory of 4724 2660 899c569df9792436429c78b5d96e274f4f64cde8764a4cf123af1ecb58477fbc.exe 67 PID 2660 wrote to memory of 4724 2660 899c569df9792436429c78b5d96e274f4f64cde8764a4cf123af1ecb58477fbc.exe 67 PID 2660 wrote to memory of 4724 2660 899c569df9792436429c78b5d96e274f4f64cde8764a4cf123af1ecb58477fbc.exe 67 PID 4724 wrote to memory of 4080 4724 899c569df9792436429c78b5d96e274f4f64cde8764a4cf123af1ecb58477fbc.exe 69 PID 4724 wrote to memory of 4080 4724 899c569df9792436429c78b5d96e274f4f64cde8764a4cf123af1ecb58477fbc.exe 69 PID 4724 wrote to memory of 4080 4724 899c569df9792436429c78b5d96e274f4f64cde8764a4cf123af1ecb58477fbc.exe 69 PID 4784 wrote to memory of 4228 4784 oobeldr.exe 71 PID 4784 wrote to memory of 4228 4784 oobeldr.exe 71 PID 4784 wrote to memory of 4228 4784 oobeldr.exe 71 PID 4784 wrote to memory of 4228 4784 oobeldr.exe 71 PID 4784 wrote to memory of 4228 4784 oobeldr.exe 71 PID 4784 wrote to memory of 4228 4784 oobeldr.exe 71 PID 4784 wrote to memory of 4228 4784 oobeldr.exe 71 PID 4784 wrote to memory of 4228 4784 oobeldr.exe 71 PID 4784 wrote to memory of 4228 4784 oobeldr.exe 71 PID 4228 wrote to memory of 4516 4228 oobeldr.exe 72 PID 4228 wrote to memory of 4516 4228 oobeldr.exe 72 PID 4228 wrote to memory of 4516 4228 oobeldr.exe 72 PID 4488 wrote to memory of 696 4488 oobeldr.exe 75 PID 4488 wrote to memory of 696 4488 oobeldr.exe 75 PID 4488 wrote to memory of 696 4488 oobeldr.exe 75 PID 4488 wrote to memory of 696 4488 oobeldr.exe 75 PID 4488 wrote to memory of 696 4488 oobeldr.exe 75 PID 4488 wrote to memory of 696 4488 oobeldr.exe 75 PID 4488 wrote to memory of 696 4488 oobeldr.exe 75 PID 4488 wrote to memory of 696 4488 oobeldr.exe 75 PID 4488 wrote to memory of 696 4488 oobeldr.exe 75
Processes
-
C:\Users\Admin\AppData\Local\Temp\899c569df9792436429c78b5d96e274f4f64cde8764a4cf123af1ecb58477fbc.exe"C:\Users\Admin\AppData\Local\Temp\899c569df9792436429c78b5d96e274f4f64cde8764a4cf123af1ecb58477fbc.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\899c569df9792436429c78b5d96e274f4f64cde8764a4cf123af1ecb58477fbc.exeC:\Users\Admin\AppData\Local\Temp\899c569df9792436429c78b5d96e274f4f64cde8764a4cf123af1ecb58477fbc.exe2⤵
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
PID:4080
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
PID:4516
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
PID:696
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
789B
MD5db5ef8d7c51bad129d9097bf953e4913
SHA18439db960aa2d431bf5ec3c37af775b45eb07e06
SHA2561248e67f10b47b397af3c8cbe342bad4be75c68b8e10f4ec6341195cc3138bd9
SHA51204572485790b25e1751347e43b47174051cd153dd75fd55ee5590d25a2579f344cd96cf86cf45bdb7759e3e6d0f734d0ff717148ca70f501b9869e964e036fee
-
Filesize
324KB
MD55ae5c015cbf13ee10eb95a3c1b2a37df
SHA1ada2a4f3018864496426ad1ef81c4bc0726ba3b7
SHA256899c569df9792436429c78b5d96e274f4f64cde8764a4cf123af1ecb58477fbc
SHA51227d8cbd9fa2d8f435cadc3e4c8b3faa541422bfeaeb7bbe81d9cf1db7415434032783ea3e0061c6ae07fb9f3b21a5afbf19cd2daf363f79706d9ce0c16ac9134
-
Filesize
324KB
MD55ae5c015cbf13ee10eb95a3c1b2a37df
SHA1ada2a4f3018864496426ad1ef81c4bc0726ba3b7
SHA256899c569df9792436429c78b5d96e274f4f64cde8764a4cf123af1ecb58477fbc
SHA51227d8cbd9fa2d8f435cadc3e4c8b3faa541422bfeaeb7bbe81d9cf1db7415434032783ea3e0061c6ae07fb9f3b21a5afbf19cd2daf363f79706d9ce0c16ac9134
-
Filesize
324KB
MD55ae5c015cbf13ee10eb95a3c1b2a37df
SHA1ada2a4f3018864496426ad1ef81c4bc0726ba3b7
SHA256899c569df9792436429c78b5d96e274f4f64cde8764a4cf123af1ecb58477fbc
SHA51227d8cbd9fa2d8f435cadc3e4c8b3faa541422bfeaeb7bbe81d9cf1db7415434032783ea3e0061c6ae07fb9f3b21a5afbf19cd2daf363f79706d9ce0c16ac9134
-
Filesize
324KB
MD55ae5c015cbf13ee10eb95a3c1b2a37df
SHA1ada2a4f3018864496426ad1ef81c4bc0726ba3b7
SHA256899c569df9792436429c78b5d96e274f4f64cde8764a4cf123af1ecb58477fbc
SHA51227d8cbd9fa2d8f435cadc3e4c8b3faa541422bfeaeb7bbe81d9cf1db7415434032783ea3e0061c6ae07fb9f3b21a5afbf19cd2daf363f79706d9ce0c16ac9134
-
Filesize
324KB
MD55ae5c015cbf13ee10eb95a3c1b2a37df
SHA1ada2a4f3018864496426ad1ef81c4bc0726ba3b7
SHA256899c569df9792436429c78b5d96e274f4f64cde8764a4cf123af1ecb58477fbc
SHA51227d8cbd9fa2d8f435cadc3e4c8b3faa541422bfeaeb7bbe81d9cf1db7415434032783ea3e0061c6ae07fb9f3b21a5afbf19cd2daf363f79706d9ce0c16ac9134