Analysis
-
max time kernel
150s -
max time network
64s -
platform
windows10-1703_x64 -
resource
win10-20220901-en -
resource tags
arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system -
submitted
01/11/2022, 10:36
Static task
static1
Behavioral task
behavioral1
Sample
41219ba5b9e68b99121f3ced5d92753ee9df584db4ec2fb2a9923f3866b5eddd.exe
Resource
win10-20220901-en
General
-
Target
41219ba5b9e68b99121f3ced5d92753ee9df584db4ec2fb2a9923f3866b5eddd.exe
-
Size
324KB
-
MD5
4691c7c7c553a3a0fe1066ece1e8903d
-
SHA1
636197bb134f3bb48be9444da0bc4e7559736e6e
-
SHA256
41219ba5b9e68b99121f3ced5d92753ee9df584db4ec2fb2a9923f3866b5eddd
-
SHA512
3a401615e504d7aaa80076880ff5c6742cee84d5f4bfc450f281e7c12791cd6aa5f34c7809f60b535725495250549eea6bf8adcfdd7d581bfe4dfd0334bf15c7
-
SSDEEP
6144:eKlzr1sYCzek2ciDaP9Xk6Ln1W8W/9InBSkZZmLdGcAdgdY6RKpjS:eGhQ2ciDq9ZL1W8q9InBRqELdolRKpj
Malware Config
Signatures
-
Executes dropped EXE 5 IoCs
pid Process 4940 oobeldr.exe 4972 oobeldr.exe 68 oobeldr.exe 1500 oobeldr.exe 2232 oobeldr.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2764 set thread context of 2368 2764 41219ba5b9e68b99121f3ced5d92753ee9df584db4ec2fb2a9923f3866b5eddd.exe 66 PID 4940 set thread context of 4972 4940 oobeldr.exe 70 PID 68 set thread context of 1500 68 oobeldr.exe 74 -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4352 schtasks.exe 4648 schtasks.exe -
Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 2764 wrote to memory of 2368 2764 41219ba5b9e68b99121f3ced5d92753ee9df584db4ec2fb2a9923f3866b5eddd.exe 66 PID 2764 wrote to memory of 2368 2764 41219ba5b9e68b99121f3ced5d92753ee9df584db4ec2fb2a9923f3866b5eddd.exe 66 PID 2764 wrote to memory of 2368 2764 41219ba5b9e68b99121f3ced5d92753ee9df584db4ec2fb2a9923f3866b5eddd.exe 66 PID 2764 wrote to memory of 2368 2764 41219ba5b9e68b99121f3ced5d92753ee9df584db4ec2fb2a9923f3866b5eddd.exe 66 PID 2764 wrote to memory of 2368 2764 41219ba5b9e68b99121f3ced5d92753ee9df584db4ec2fb2a9923f3866b5eddd.exe 66 PID 2764 wrote to memory of 2368 2764 41219ba5b9e68b99121f3ced5d92753ee9df584db4ec2fb2a9923f3866b5eddd.exe 66 PID 2764 wrote to memory of 2368 2764 41219ba5b9e68b99121f3ced5d92753ee9df584db4ec2fb2a9923f3866b5eddd.exe 66 PID 2764 wrote to memory of 2368 2764 41219ba5b9e68b99121f3ced5d92753ee9df584db4ec2fb2a9923f3866b5eddd.exe 66 PID 2764 wrote to memory of 2368 2764 41219ba5b9e68b99121f3ced5d92753ee9df584db4ec2fb2a9923f3866b5eddd.exe 66 PID 2368 wrote to memory of 4352 2368 41219ba5b9e68b99121f3ced5d92753ee9df584db4ec2fb2a9923f3866b5eddd.exe 67 PID 2368 wrote to memory of 4352 2368 41219ba5b9e68b99121f3ced5d92753ee9df584db4ec2fb2a9923f3866b5eddd.exe 67 PID 2368 wrote to memory of 4352 2368 41219ba5b9e68b99121f3ced5d92753ee9df584db4ec2fb2a9923f3866b5eddd.exe 67 PID 4940 wrote to memory of 4972 4940 oobeldr.exe 70 PID 4940 wrote to memory of 4972 4940 oobeldr.exe 70 PID 4940 wrote to memory of 4972 4940 oobeldr.exe 70 PID 4940 wrote to memory of 4972 4940 oobeldr.exe 70 PID 4940 wrote to memory of 4972 4940 oobeldr.exe 70 PID 4940 wrote to memory of 4972 4940 oobeldr.exe 70 PID 4940 wrote to memory of 4972 4940 oobeldr.exe 70 PID 4940 wrote to memory of 4972 4940 oobeldr.exe 70 PID 4940 wrote to memory of 4972 4940 oobeldr.exe 70 PID 4972 wrote to memory of 4648 4972 oobeldr.exe 71 PID 4972 wrote to memory of 4648 4972 oobeldr.exe 71 PID 4972 wrote to memory of 4648 4972 oobeldr.exe 71 PID 68 wrote to memory of 1500 68 oobeldr.exe 74 PID 68 wrote to memory of 1500 68 oobeldr.exe 74 PID 68 wrote to memory of 1500 68 oobeldr.exe 74 PID 68 wrote to memory of 1500 68 oobeldr.exe 74 PID 68 wrote to memory of 1500 68 oobeldr.exe 74 PID 68 wrote to memory of 1500 68 oobeldr.exe 74 PID 68 wrote to memory of 1500 68 oobeldr.exe 74 PID 68 wrote to memory of 1500 68 oobeldr.exe 74 PID 68 wrote to memory of 1500 68 oobeldr.exe 74
Processes
-
C:\Users\Admin\AppData\Local\Temp\41219ba5b9e68b99121f3ced5d92753ee9df584db4ec2fb2a9923f3866b5eddd.exe"C:\Users\Admin\AppData\Local\Temp\41219ba5b9e68b99121f3ced5d92753ee9df584db4ec2fb2a9923f3866b5eddd.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\41219ba5b9e68b99121f3ced5d92753ee9df584db4ec2fb2a9923f3866b5eddd.exeC:\Users\Admin\AppData\Local\Temp\41219ba5b9e68b99121f3ced5d92753ee9df584db4ec2fb2a9923f3866b5eddd.exe2⤵
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
PID:4352
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
PID:4648
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:68 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
PID:1500
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
PID:2232
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
789B
MD5db5ef8d7c51bad129d9097bf953e4913
SHA18439db960aa2d431bf5ec3c37af775b45eb07e06
SHA2561248e67f10b47b397af3c8cbe342bad4be75c68b8e10f4ec6341195cc3138bd9
SHA51204572485790b25e1751347e43b47174051cd153dd75fd55ee5590d25a2579f344cd96cf86cf45bdb7759e3e6d0f734d0ff717148ca70f501b9869e964e036fee
-
Filesize
324KB
MD54691c7c7c553a3a0fe1066ece1e8903d
SHA1636197bb134f3bb48be9444da0bc4e7559736e6e
SHA25641219ba5b9e68b99121f3ced5d92753ee9df584db4ec2fb2a9923f3866b5eddd
SHA5123a401615e504d7aaa80076880ff5c6742cee84d5f4bfc450f281e7c12791cd6aa5f34c7809f60b535725495250549eea6bf8adcfdd7d581bfe4dfd0334bf15c7
-
Filesize
324KB
MD54691c7c7c553a3a0fe1066ece1e8903d
SHA1636197bb134f3bb48be9444da0bc4e7559736e6e
SHA25641219ba5b9e68b99121f3ced5d92753ee9df584db4ec2fb2a9923f3866b5eddd
SHA5123a401615e504d7aaa80076880ff5c6742cee84d5f4bfc450f281e7c12791cd6aa5f34c7809f60b535725495250549eea6bf8adcfdd7d581bfe4dfd0334bf15c7
-
Filesize
324KB
MD54691c7c7c553a3a0fe1066ece1e8903d
SHA1636197bb134f3bb48be9444da0bc4e7559736e6e
SHA25641219ba5b9e68b99121f3ced5d92753ee9df584db4ec2fb2a9923f3866b5eddd
SHA5123a401615e504d7aaa80076880ff5c6742cee84d5f4bfc450f281e7c12791cd6aa5f34c7809f60b535725495250549eea6bf8adcfdd7d581bfe4dfd0334bf15c7
-
Filesize
324KB
MD54691c7c7c553a3a0fe1066ece1e8903d
SHA1636197bb134f3bb48be9444da0bc4e7559736e6e
SHA25641219ba5b9e68b99121f3ced5d92753ee9df584db4ec2fb2a9923f3866b5eddd
SHA5123a401615e504d7aaa80076880ff5c6742cee84d5f4bfc450f281e7c12791cd6aa5f34c7809f60b535725495250549eea6bf8adcfdd7d581bfe4dfd0334bf15c7
-
Filesize
324KB
MD54691c7c7c553a3a0fe1066ece1e8903d
SHA1636197bb134f3bb48be9444da0bc4e7559736e6e
SHA25641219ba5b9e68b99121f3ced5d92753ee9df584db4ec2fb2a9923f3866b5eddd
SHA5123a401615e504d7aaa80076880ff5c6742cee84d5f4bfc450f281e7c12791cd6aa5f34c7809f60b535725495250549eea6bf8adcfdd7d581bfe4dfd0334bf15c7
-
Filesize
324KB
MD54691c7c7c553a3a0fe1066ece1e8903d
SHA1636197bb134f3bb48be9444da0bc4e7559736e6e
SHA25641219ba5b9e68b99121f3ced5d92753ee9df584db4ec2fb2a9923f3866b5eddd
SHA5123a401615e504d7aaa80076880ff5c6742cee84d5f4bfc450f281e7c12791cd6aa5f34c7809f60b535725495250549eea6bf8adcfdd7d581bfe4dfd0334bf15c7