Analysis
-
max time kernel
132s -
max time network
147s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
01/11/2022, 10:36
Static task
static1
Behavioral task
behavioral1
Sample
927925adb5edc38a07e34032eadd1afc04ebe53bfaf3a9e664c6d8d753894795.exe
Resource
win10-20220812-en
General
-
Target
927925adb5edc38a07e34032eadd1afc04ebe53bfaf3a9e664c6d8d753894795.exe
-
Size
324KB
-
MD5
d6916d2f16423d2a21bcb271ca77a037
-
SHA1
e1941ca28b4236b7867da0b76080b550258bf7a0
-
SHA256
927925adb5edc38a07e34032eadd1afc04ebe53bfaf3a9e664c6d8d753894795
-
SHA512
79895f6b4847e7745d9c64ad8e5610edc597d1e419c97eb266631242ed21b25ade7236737135397a905af06cd4b6352e9cbc635edeae72ca1df2ec4b0a9a52fc
-
SSDEEP
6144:eKlzr1sYCzek2ciDaP9Xk6Ln1W8W/9InBSkZZmLdGcAdgdY6RKpjS:eGhQ2ciDq9ZL1W8q9InBRqELdolRKpj
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 3480 oobeldr.exe 1232 oobeldr.exe 4040 oobeldr.exe 568 oobeldr.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2684 set thread context of 5040 2684 927925adb5edc38a07e34032eadd1afc04ebe53bfaf3a9e664c6d8d753894795.exe 66 PID 3480 set thread context of 1232 3480 oobeldr.exe 70 PID 4040 set thread context of 568 4040 oobeldr.exe 74 -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2908 schtasks.exe 4852 schtasks.exe -
Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 2684 wrote to memory of 5040 2684 927925adb5edc38a07e34032eadd1afc04ebe53bfaf3a9e664c6d8d753894795.exe 66 PID 2684 wrote to memory of 5040 2684 927925adb5edc38a07e34032eadd1afc04ebe53bfaf3a9e664c6d8d753894795.exe 66 PID 2684 wrote to memory of 5040 2684 927925adb5edc38a07e34032eadd1afc04ebe53bfaf3a9e664c6d8d753894795.exe 66 PID 2684 wrote to memory of 5040 2684 927925adb5edc38a07e34032eadd1afc04ebe53bfaf3a9e664c6d8d753894795.exe 66 PID 2684 wrote to memory of 5040 2684 927925adb5edc38a07e34032eadd1afc04ebe53bfaf3a9e664c6d8d753894795.exe 66 PID 2684 wrote to memory of 5040 2684 927925adb5edc38a07e34032eadd1afc04ebe53bfaf3a9e664c6d8d753894795.exe 66 PID 2684 wrote to memory of 5040 2684 927925adb5edc38a07e34032eadd1afc04ebe53bfaf3a9e664c6d8d753894795.exe 66 PID 2684 wrote to memory of 5040 2684 927925adb5edc38a07e34032eadd1afc04ebe53bfaf3a9e664c6d8d753894795.exe 66 PID 2684 wrote to memory of 5040 2684 927925adb5edc38a07e34032eadd1afc04ebe53bfaf3a9e664c6d8d753894795.exe 66 PID 5040 wrote to memory of 2908 5040 927925adb5edc38a07e34032eadd1afc04ebe53bfaf3a9e664c6d8d753894795.exe 67 PID 5040 wrote to memory of 2908 5040 927925adb5edc38a07e34032eadd1afc04ebe53bfaf3a9e664c6d8d753894795.exe 67 PID 5040 wrote to memory of 2908 5040 927925adb5edc38a07e34032eadd1afc04ebe53bfaf3a9e664c6d8d753894795.exe 67 PID 3480 wrote to memory of 1232 3480 oobeldr.exe 70 PID 3480 wrote to memory of 1232 3480 oobeldr.exe 70 PID 3480 wrote to memory of 1232 3480 oobeldr.exe 70 PID 3480 wrote to memory of 1232 3480 oobeldr.exe 70 PID 3480 wrote to memory of 1232 3480 oobeldr.exe 70 PID 3480 wrote to memory of 1232 3480 oobeldr.exe 70 PID 3480 wrote to memory of 1232 3480 oobeldr.exe 70 PID 3480 wrote to memory of 1232 3480 oobeldr.exe 70 PID 3480 wrote to memory of 1232 3480 oobeldr.exe 70 PID 1232 wrote to memory of 4852 1232 oobeldr.exe 71 PID 1232 wrote to memory of 4852 1232 oobeldr.exe 71 PID 1232 wrote to memory of 4852 1232 oobeldr.exe 71 PID 4040 wrote to memory of 568 4040 oobeldr.exe 74 PID 4040 wrote to memory of 568 4040 oobeldr.exe 74 PID 4040 wrote to memory of 568 4040 oobeldr.exe 74 PID 4040 wrote to memory of 568 4040 oobeldr.exe 74 PID 4040 wrote to memory of 568 4040 oobeldr.exe 74 PID 4040 wrote to memory of 568 4040 oobeldr.exe 74 PID 4040 wrote to memory of 568 4040 oobeldr.exe 74 PID 4040 wrote to memory of 568 4040 oobeldr.exe 74 PID 4040 wrote to memory of 568 4040 oobeldr.exe 74
Processes
-
C:\Users\Admin\AppData\Local\Temp\927925adb5edc38a07e34032eadd1afc04ebe53bfaf3a9e664c6d8d753894795.exe"C:\Users\Admin\AppData\Local\Temp\927925adb5edc38a07e34032eadd1afc04ebe53bfaf3a9e664c6d8d753894795.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\927925adb5edc38a07e34032eadd1afc04ebe53bfaf3a9e664c6d8d753894795.exeC:\Users\Admin\AppData\Local\Temp\927925adb5edc38a07e34032eadd1afc04ebe53bfaf3a9e664c6d8d753894795.exe2⤵
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
PID:2908
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
PID:4852
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
PID:568
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
789B
MD5db5ef8d7c51bad129d9097bf953e4913
SHA18439db960aa2d431bf5ec3c37af775b45eb07e06
SHA2561248e67f10b47b397af3c8cbe342bad4be75c68b8e10f4ec6341195cc3138bd9
SHA51204572485790b25e1751347e43b47174051cd153dd75fd55ee5590d25a2579f344cd96cf86cf45bdb7759e3e6d0f734d0ff717148ca70f501b9869e964e036fee
-
Filesize
324KB
MD5d6916d2f16423d2a21bcb271ca77a037
SHA1e1941ca28b4236b7867da0b76080b550258bf7a0
SHA256927925adb5edc38a07e34032eadd1afc04ebe53bfaf3a9e664c6d8d753894795
SHA51279895f6b4847e7745d9c64ad8e5610edc597d1e419c97eb266631242ed21b25ade7236737135397a905af06cd4b6352e9cbc635edeae72ca1df2ec4b0a9a52fc
-
Filesize
324KB
MD5d6916d2f16423d2a21bcb271ca77a037
SHA1e1941ca28b4236b7867da0b76080b550258bf7a0
SHA256927925adb5edc38a07e34032eadd1afc04ebe53bfaf3a9e664c6d8d753894795
SHA51279895f6b4847e7745d9c64ad8e5610edc597d1e419c97eb266631242ed21b25ade7236737135397a905af06cd4b6352e9cbc635edeae72ca1df2ec4b0a9a52fc
-
Filesize
324KB
MD5d6916d2f16423d2a21bcb271ca77a037
SHA1e1941ca28b4236b7867da0b76080b550258bf7a0
SHA256927925adb5edc38a07e34032eadd1afc04ebe53bfaf3a9e664c6d8d753894795
SHA51279895f6b4847e7745d9c64ad8e5610edc597d1e419c97eb266631242ed21b25ade7236737135397a905af06cd4b6352e9cbc635edeae72ca1df2ec4b0a9a52fc
-
Filesize
324KB
MD5d6916d2f16423d2a21bcb271ca77a037
SHA1e1941ca28b4236b7867da0b76080b550258bf7a0
SHA256927925adb5edc38a07e34032eadd1afc04ebe53bfaf3a9e664c6d8d753894795
SHA51279895f6b4847e7745d9c64ad8e5610edc597d1e419c97eb266631242ed21b25ade7236737135397a905af06cd4b6352e9cbc635edeae72ca1df2ec4b0a9a52fc
-
Filesize
324KB
MD5d6916d2f16423d2a21bcb271ca77a037
SHA1e1941ca28b4236b7867da0b76080b550258bf7a0
SHA256927925adb5edc38a07e34032eadd1afc04ebe53bfaf3a9e664c6d8d753894795
SHA51279895f6b4847e7745d9c64ad8e5610edc597d1e419c97eb266631242ed21b25ade7236737135397a905af06cd4b6352e9cbc635edeae72ca1df2ec4b0a9a52fc