Analysis
-
max time kernel
134s -
max time network
147s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
01/11/2022, 10:37
Static task
static1
Behavioral task
behavioral1
Sample
c2c0060eed63a5472d785b5a95dbb193db7ec8e4e253bc747a3e90d152dcd273.exe
Resource
win10-20220812-en
General
-
Target
c2c0060eed63a5472d785b5a95dbb193db7ec8e4e253bc747a3e90d152dcd273.exe
-
Size
324KB
-
MD5
9c3a3a59d138cfc00db1fba62f7d725f
-
SHA1
a8162eeb6c5e7d70d57b0374e987fec42759a129
-
SHA256
c2c0060eed63a5472d785b5a95dbb193db7ec8e4e253bc747a3e90d152dcd273
-
SHA512
5bf895c0152eecfddfef8fcd35d6f2c712c1d49930138d77954ce80a042df7fa0c900a74ec4d61e3d3abe656eaf9c68259c4f7c5be6127ce5db3fe0a137da796
-
SSDEEP
6144:eKlzr1sYCzek2ciDaP9Xk6Ln1W8W/9InBSkZZmLdGcAdgdY6RKpjS:eGhQ2ciDq9ZL1W8q9InBRqELdolRKpj
Malware Config
Signatures
-
Executes dropped EXE 5 IoCs
pid Process 3128 oobeldr.exe 692 oobeldr.exe 3280 oobeldr.exe 4092 oobeldr.exe 1412 oobeldr.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 392 set thread context of 4188 392 c2c0060eed63a5472d785b5a95dbb193db7ec8e4e253bc747a3e90d152dcd273.exe 66 PID 3128 set thread context of 3280 3128 oobeldr.exe 71 PID 4092 set thread context of 1412 4092 oobeldr.exe 75 -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4584 schtasks.exe 4440 schtasks.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 392 wrote to memory of 4188 392 c2c0060eed63a5472d785b5a95dbb193db7ec8e4e253bc747a3e90d152dcd273.exe 66 PID 392 wrote to memory of 4188 392 c2c0060eed63a5472d785b5a95dbb193db7ec8e4e253bc747a3e90d152dcd273.exe 66 PID 392 wrote to memory of 4188 392 c2c0060eed63a5472d785b5a95dbb193db7ec8e4e253bc747a3e90d152dcd273.exe 66 PID 392 wrote to memory of 4188 392 c2c0060eed63a5472d785b5a95dbb193db7ec8e4e253bc747a3e90d152dcd273.exe 66 PID 392 wrote to memory of 4188 392 c2c0060eed63a5472d785b5a95dbb193db7ec8e4e253bc747a3e90d152dcd273.exe 66 PID 392 wrote to memory of 4188 392 c2c0060eed63a5472d785b5a95dbb193db7ec8e4e253bc747a3e90d152dcd273.exe 66 PID 392 wrote to memory of 4188 392 c2c0060eed63a5472d785b5a95dbb193db7ec8e4e253bc747a3e90d152dcd273.exe 66 PID 392 wrote to memory of 4188 392 c2c0060eed63a5472d785b5a95dbb193db7ec8e4e253bc747a3e90d152dcd273.exe 66 PID 392 wrote to memory of 4188 392 c2c0060eed63a5472d785b5a95dbb193db7ec8e4e253bc747a3e90d152dcd273.exe 66 PID 4188 wrote to memory of 4584 4188 c2c0060eed63a5472d785b5a95dbb193db7ec8e4e253bc747a3e90d152dcd273.exe 67 PID 4188 wrote to memory of 4584 4188 c2c0060eed63a5472d785b5a95dbb193db7ec8e4e253bc747a3e90d152dcd273.exe 67 PID 4188 wrote to memory of 4584 4188 c2c0060eed63a5472d785b5a95dbb193db7ec8e4e253bc747a3e90d152dcd273.exe 67 PID 3128 wrote to memory of 692 3128 oobeldr.exe 70 PID 3128 wrote to memory of 692 3128 oobeldr.exe 70 PID 3128 wrote to memory of 692 3128 oobeldr.exe 70 PID 3128 wrote to memory of 3280 3128 oobeldr.exe 71 PID 3128 wrote to memory of 3280 3128 oobeldr.exe 71 PID 3128 wrote to memory of 3280 3128 oobeldr.exe 71 PID 3128 wrote to memory of 3280 3128 oobeldr.exe 71 PID 3128 wrote to memory of 3280 3128 oobeldr.exe 71 PID 3128 wrote to memory of 3280 3128 oobeldr.exe 71 PID 3128 wrote to memory of 3280 3128 oobeldr.exe 71 PID 3128 wrote to memory of 3280 3128 oobeldr.exe 71 PID 3128 wrote to memory of 3280 3128 oobeldr.exe 71 PID 3280 wrote to memory of 4440 3280 oobeldr.exe 72 PID 3280 wrote to memory of 4440 3280 oobeldr.exe 72 PID 3280 wrote to memory of 4440 3280 oobeldr.exe 72 PID 4092 wrote to memory of 1412 4092 oobeldr.exe 75 PID 4092 wrote to memory of 1412 4092 oobeldr.exe 75 PID 4092 wrote to memory of 1412 4092 oobeldr.exe 75 PID 4092 wrote to memory of 1412 4092 oobeldr.exe 75 PID 4092 wrote to memory of 1412 4092 oobeldr.exe 75 PID 4092 wrote to memory of 1412 4092 oobeldr.exe 75 PID 4092 wrote to memory of 1412 4092 oobeldr.exe 75 PID 4092 wrote to memory of 1412 4092 oobeldr.exe 75 PID 4092 wrote to memory of 1412 4092 oobeldr.exe 75
Processes
-
C:\Users\Admin\AppData\Local\Temp\c2c0060eed63a5472d785b5a95dbb193db7ec8e4e253bc747a3e90d152dcd273.exe"C:\Users\Admin\AppData\Local\Temp\c2c0060eed63a5472d785b5a95dbb193db7ec8e4e253bc747a3e90d152dcd273.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:392 -
C:\Users\Admin\AppData\Local\Temp\c2c0060eed63a5472d785b5a95dbb193db7ec8e4e253bc747a3e90d152dcd273.exeC:\Users\Admin\AppData\Local\Temp\c2c0060eed63a5472d785b5a95dbb193db7ec8e4e253bc747a3e90d152dcd273.exe2⤵
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
PID:4584
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
PID:692
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
PID:4440
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
PID:1412
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
789B
MD5db5ef8d7c51bad129d9097bf953e4913
SHA18439db960aa2d431bf5ec3c37af775b45eb07e06
SHA2561248e67f10b47b397af3c8cbe342bad4be75c68b8e10f4ec6341195cc3138bd9
SHA51204572485790b25e1751347e43b47174051cd153dd75fd55ee5590d25a2579f344cd96cf86cf45bdb7759e3e6d0f734d0ff717148ca70f501b9869e964e036fee
-
Filesize
324KB
MD59c3a3a59d138cfc00db1fba62f7d725f
SHA1a8162eeb6c5e7d70d57b0374e987fec42759a129
SHA256c2c0060eed63a5472d785b5a95dbb193db7ec8e4e253bc747a3e90d152dcd273
SHA5125bf895c0152eecfddfef8fcd35d6f2c712c1d49930138d77954ce80a042df7fa0c900a74ec4d61e3d3abe656eaf9c68259c4f7c5be6127ce5db3fe0a137da796
-
Filesize
324KB
MD59c3a3a59d138cfc00db1fba62f7d725f
SHA1a8162eeb6c5e7d70d57b0374e987fec42759a129
SHA256c2c0060eed63a5472d785b5a95dbb193db7ec8e4e253bc747a3e90d152dcd273
SHA5125bf895c0152eecfddfef8fcd35d6f2c712c1d49930138d77954ce80a042df7fa0c900a74ec4d61e3d3abe656eaf9c68259c4f7c5be6127ce5db3fe0a137da796
-
Filesize
324KB
MD59c3a3a59d138cfc00db1fba62f7d725f
SHA1a8162eeb6c5e7d70d57b0374e987fec42759a129
SHA256c2c0060eed63a5472d785b5a95dbb193db7ec8e4e253bc747a3e90d152dcd273
SHA5125bf895c0152eecfddfef8fcd35d6f2c712c1d49930138d77954ce80a042df7fa0c900a74ec4d61e3d3abe656eaf9c68259c4f7c5be6127ce5db3fe0a137da796
-
Filesize
324KB
MD59c3a3a59d138cfc00db1fba62f7d725f
SHA1a8162eeb6c5e7d70d57b0374e987fec42759a129
SHA256c2c0060eed63a5472d785b5a95dbb193db7ec8e4e253bc747a3e90d152dcd273
SHA5125bf895c0152eecfddfef8fcd35d6f2c712c1d49930138d77954ce80a042df7fa0c900a74ec4d61e3d3abe656eaf9c68259c4f7c5be6127ce5db3fe0a137da796
-
Filesize
324KB
MD59c3a3a59d138cfc00db1fba62f7d725f
SHA1a8162eeb6c5e7d70d57b0374e987fec42759a129
SHA256c2c0060eed63a5472d785b5a95dbb193db7ec8e4e253bc747a3e90d152dcd273
SHA5125bf895c0152eecfddfef8fcd35d6f2c712c1d49930138d77954ce80a042df7fa0c900a74ec4d61e3d3abe656eaf9c68259c4f7c5be6127ce5db3fe0a137da796
-
Filesize
324KB
MD59c3a3a59d138cfc00db1fba62f7d725f
SHA1a8162eeb6c5e7d70d57b0374e987fec42759a129
SHA256c2c0060eed63a5472d785b5a95dbb193db7ec8e4e253bc747a3e90d152dcd273
SHA5125bf895c0152eecfddfef8fcd35d6f2c712c1d49930138d77954ce80a042df7fa0c900a74ec4d61e3d3abe656eaf9c68259c4f7c5be6127ce5db3fe0a137da796