Analysis
-
max time kernel
96s -
max time network
100s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
01/11/2022, 10:40
Static task
static1
Behavioral task
behavioral1
Sample
545bb4b6a14382f9965d81d0aef4a1accd604e5cc55d5c3618212da461d4fe59.exe
Resource
win10-20220812-en
General
-
Target
545bb4b6a14382f9965d81d0aef4a1accd604e5cc55d5c3618212da461d4fe59.exe
-
Size
324KB
-
MD5
fa2663255be8e0bfe2a6a5f2a9b89a94
-
SHA1
fe3208c501e0f82317693c158810ecafe5f989e4
-
SHA256
545bb4b6a14382f9965d81d0aef4a1accd604e5cc55d5c3618212da461d4fe59
-
SHA512
57d3b18cb335269a4be802896572aa16295d2d8daffe4318231f623f480cdd717b250a96fed1c680df9386209c6d427a731505d71552640870a3d68030279927
-
SSDEEP
6144:eKlzr1sYCzek2ciDaP9Xk6Ln1W8W/9InBSkZZmLdGcAdgdY6RKpjS:eGhQ2ciDq9ZL1W8q9InBRqELdolRKpj
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 4124 oobeldr.exe 4548 oobeldr.exe 8 oobeldr.exe 4924 oobeldr.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2676 set thread context of 5104 2676 545bb4b6a14382f9965d81d0aef4a1accd604e5cc55d5c3618212da461d4fe59.exe 66 PID 4124 set thread context of 4548 4124 oobeldr.exe 70 PID 8 set thread context of 4924 8 oobeldr.exe 74 -
Program crash 1 IoCs
pid pid_target Process procid_target 4580 4548 WerFault.exe 70 -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3960 schtasks.exe 4960 schtasks.exe -
Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 2676 wrote to memory of 5104 2676 545bb4b6a14382f9965d81d0aef4a1accd604e5cc55d5c3618212da461d4fe59.exe 66 PID 2676 wrote to memory of 5104 2676 545bb4b6a14382f9965d81d0aef4a1accd604e5cc55d5c3618212da461d4fe59.exe 66 PID 2676 wrote to memory of 5104 2676 545bb4b6a14382f9965d81d0aef4a1accd604e5cc55d5c3618212da461d4fe59.exe 66 PID 2676 wrote to memory of 5104 2676 545bb4b6a14382f9965d81d0aef4a1accd604e5cc55d5c3618212da461d4fe59.exe 66 PID 2676 wrote to memory of 5104 2676 545bb4b6a14382f9965d81d0aef4a1accd604e5cc55d5c3618212da461d4fe59.exe 66 PID 2676 wrote to memory of 5104 2676 545bb4b6a14382f9965d81d0aef4a1accd604e5cc55d5c3618212da461d4fe59.exe 66 PID 2676 wrote to memory of 5104 2676 545bb4b6a14382f9965d81d0aef4a1accd604e5cc55d5c3618212da461d4fe59.exe 66 PID 2676 wrote to memory of 5104 2676 545bb4b6a14382f9965d81d0aef4a1accd604e5cc55d5c3618212da461d4fe59.exe 66 PID 2676 wrote to memory of 5104 2676 545bb4b6a14382f9965d81d0aef4a1accd604e5cc55d5c3618212da461d4fe59.exe 66 PID 5104 wrote to memory of 3960 5104 545bb4b6a14382f9965d81d0aef4a1accd604e5cc55d5c3618212da461d4fe59.exe 67 PID 5104 wrote to memory of 3960 5104 545bb4b6a14382f9965d81d0aef4a1accd604e5cc55d5c3618212da461d4fe59.exe 67 PID 5104 wrote to memory of 3960 5104 545bb4b6a14382f9965d81d0aef4a1accd604e5cc55d5c3618212da461d4fe59.exe 67 PID 4124 wrote to memory of 4548 4124 oobeldr.exe 70 PID 4124 wrote to memory of 4548 4124 oobeldr.exe 70 PID 4124 wrote to memory of 4548 4124 oobeldr.exe 70 PID 4124 wrote to memory of 4548 4124 oobeldr.exe 70 PID 4124 wrote to memory of 4548 4124 oobeldr.exe 70 PID 4124 wrote to memory of 4548 4124 oobeldr.exe 70 PID 4124 wrote to memory of 4548 4124 oobeldr.exe 70 PID 4124 wrote to memory of 4548 4124 oobeldr.exe 70 PID 4124 wrote to memory of 4548 4124 oobeldr.exe 70 PID 8 wrote to memory of 4924 8 oobeldr.exe 74 PID 8 wrote to memory of 4924 8 oobeldr.exe 74 PID 8 wrote to memory of 4924 8 oobeldr.exe 74 PID 8 wrote to memory of 4924 8 oobeldr.exe 74 PID 8 wrote to memory of 4924 8 oobeldr.exe 74 PID 8 wrote to memory of 4924 8 oobeldr.exe 74 PID 8 wrote to memory of 4924 8 oobeldr.exe 74 PID 8 wrote to memory of 4924 8 oobeldr.exe 74 PID 8 wrote to memory of 4924 8 oobeldr.exe 74 PID 4924 wrote to memory of 4960 4924 oobeldr.exe 75 PID 4924 wrote to memory of 4960 4924 oobeldr.exe 75 PID 4924 wrote to memory of 4960 4924 oobeldr.exe 75
Processes
-
C:\Users\Admin\AppData\Local\Temp\545bb4b6a14382f9965d81d0aef4a1accd604e5cc55d5c3618212da461d4fe59.exe"C:\Users\Admin\AppData\Local\Temp\545bb4b6a14382f9965d81d0aef4a1accd604e5cc55d5c3618212da461d4fe59.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\545bb4b6a14382f9965d81d0aef4a1accd604e5cc55d5c3618212da461d4fe59.exeC:\Users\Admin\AppData\Local\Temp\545bb4b6a14382f9965d81d0aef4a1accd604e5cc55d5c3618212da461d4fe59.exe2⤵
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
PID:3960
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
PID:4548 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4548 -s 1523⤵
- Program crash
PID:4580
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
PID:4960
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
789B
MD5db5ef8d7c51bad129d9097bf953e4913
SHA18439db960aa2d431bf5ec3c37af775b45eb07e06
SHA2561248e67f10b47b397af3c8cbe342bad4be75c68b8e10f4ec6341195cc3138bd9
SHA51204572485790b25e1751347e43b47174051cd153dd75fd55ee5590d25a2579f344cd96cf86cf45bdb7759e3e6d0f734d0ff717148ca70f501b9869e964e036fee
-
Filesize
324KB
MD5fa2663255be8e0bfe2a6a5f2a9b89a94
SHA1fe3208c501e0f82317693c158810ecafe5f989e4
SHA256545bb4b6a14382f9965d81d0aef4a1accd604e5cc55d5c3618212da461d4fe59
SHA51257d3b18cb335269a4be802896572aa16295d2d8daffe4318231f623f480cdd717b250a96fed1c680df9386209c6d427a731505d71552640870a3d68030279927
-
Filesize
324KB
MD5fa2663255be8e0bfe2a6a5f2a9b89a94
SHA1fe3208c501e0f82317693c158810ecafe5f989e4
SHA256545bb4b6a14382f9965d81d0aef4a1accd604e5cc55d5c3618212da461d4fe59
SHA51257d3b18cb335269a4be802896572aa16295d2d8daffe4318231f623f480cdd717b250a96fed1c680df9386209c6d427a731505d71552640870a3d68030279927
-
Filesize
324KB
MD5fa2663255be8e0bfe2a6a5f2a9b89a94
SHA1fe3208c501e0f82317693c158810ecafe5f989e4
SHA256545bb4b6a14382f9965d81d0aef4a1accd604e5cc55d5c3618212da461d4fe59
SHA51257d3b18cb335269a4be802896572aa16295d2d8daffe4318231f623f480cdd717b250a96fed1c680df9386209c6d427a731505d71552640870a3d68030279927
-
Filesize
324KB
MD5fa2663255be8e0bfe2a6a5f2a9b89a94
SHA1fe3208c501e0f82317693c158810ecafe5f989e4
SHA256545bb4b6a14382f9965d81d0aef4a1accd604e5cc55d5c3618212da461d4fe59
SHA51257d3b18cb335269a4be802896572aa16295d2d8daffe4318231f623f480cdd717b250a96fed1c680df9386209c6d427a731505d71552640870a3d68030279927
-
Filesize
324KB
MD5fa2663255be8e0bfe2a6a5f2a9b89a94
SHA1fe3208c501e0f82317693c158810ecafe5f989e4
SHA256545bb4b6a14382f9965d81d0aef4a1accd604e5cc55d5c3618212da461d4fe59
SHA51257d3b18cb335269a4be802896572aa16295d2d8daffe4318231f623f480cdd717b250a96fed1c680df9386209c6d427a731505d71552640870a3d68030279927