Analysis
-
max time kernel
130s -
max time network
147s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
01/11/2022, 10:40
Static task
static1
Behavioral task
behavioral1
Sample
bbe02d5f4ae87b515613075b35531856dc5e57817b7d7df3f066fbbab35742a4.exe
Resource
win10-20220812-en
General
-
Target
bbe02d5f4ae87b515613075b35531856dc5e57817b7d7df3f066fbbab35742a4.exe
-
Size
324KB
-
MD5
e1e140ff0ab6b669a42332780bc9b656
-
SHA1
6975c1a22ae7f83530a99bb54d2af9bef6b94852
-
SHA256
bbe02d5f4ae87b515613075b35531856dc5e57817b7d7df3f066fbbab35742a4
-
SHA512
ab94e77011eab412f39dc0b26f8bc38ce8ff544180592330da8ad87fd981c8673adec7b135f0ac5727eaac8fc7a6c1a12191d39a139c73878cc3932794c5f302
-
SSDEEP
6144:eKlzr1sYCzek2ciDaP9Xk6Ln1W8W/9InBSkZZmLdGcAdgdY6RKpjS:eGhQ2ciDq9ZL1W8q9InBRqELdolRKpj
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 3420 oobeldr.exe 4256 oobeldr.exe 2072 oobeldr.exe 1396 oobeldr.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1756 set thread context of 4160 1756 bbe02d5f4ae87b515613075b35531856dc5e57817b7d7df3f066fbbab35742a4.exe 66 PID 3420 set thread context of 4256 3420 oobeldr.exe 70 PID 2072 set thread context of 1396 2072 oobeldr.exe 74 -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 5016 schtasks.exe 3408 schtasks.exe -
Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 1756 wrote to memory of 4160 1756 bbe02d5f4ae87b515613075b35531856dc5e57817b7d7df3f066fbbab35742a4.exe 66 PID 1756 wrote to memory of 4160 1756 bbe02d5f4ae87b515613075b35531856dc5e57817b7d7df3f066fbbab35742a4.exe 66 PID 1756 wrote to memory of 4160 1756 bbe02d5f4ae87b515613075b35531856dc5e57817b7d7df3f066fbbab35742a4.exe 66 PID 1756 wrote to memory of 4160 1756 bbe02d5f4ae87b515613075b35531856dc5e57817b7d7df3f066fbbab35742a4.exe 66 PID 1756 wrote to memory of 4160 1756 bbe02d5f4ae87b515613075b35531856dc5e57817b7d7df3f066fbbab35742a4.exe 66 PID 1756 wrote to memory of 4160 1756 bbe02d5f4ae87b515613075b35531856dc5e57817b7d7df3f066fbbab35742a4.exe 66 PID 1756 wrote to memory of 4160 1756 bbe02d5f4ae87b515613075b35531856dc5e57817b7d7df3f066fbbab35742a4.exe 66 PID 1756 wrote to memory of 4160 1756 bbe02d5f4ae87b515613075b35531856dc5e57817b7d7df3f066fbbab35742a4.exe 66 PID 1756 wrote to memory of 4160 1756 bbe02d5f4ae87b515613075b35531856dc5e57817b7d7df3f066fbbab35742a4.exe 66 PID 4160 wrote to memory of 3408 4160 bbe02d5f4ae87b515613075b35531856dc5e57817b7d7df3f066fbbab35742a4.exe 67 PID 4160 wrote to memory of 3408 4160 bbe02d5f4ae87b515613075b35531856dc5e57817b7d7df3f066fbbab35742a4.exe 67 PID 4160 wrote to memory of 3408 4160 bbe02d5f4ae87b515613075b35531856dc5e57817b7d7df3f066fbbab35742a4.exe 67 PID 3420 wrote to memory of 4256 3420 oobeldr.exe 70 PID 3420 wrote to memory of 4256 3420 oobeldr.exe 70 PID 3420 wrote to memory of 4256 3420 oobeldr.exe 70 PID 3420 wrote to memory of 4256 3420 oobeldr.exe 70 PID 3420 wrote to memory of 4256 3420 oobeldr.exe 70 PID 3420 wrote to memory of 4256 3420 oobeldr.exe 70 PID 3420 wrote to memory of 4256 3420 oobeldr.exe 70 PID 3420 wrote to memory of 4256 3420 oobeldr.exe 70 PID 3420 wrote to memory of 4256 3420 oobeldr.exe 70 PID 4256 wrote to memory of 5016 4256 oobeldr.exe 71 PID 4256 wrote to memory of 5016 4256 oobeldr.exe 71 PID 4256 wrote to memory of 5016 4256 oobeldr.exe 71 PID 2072 wrote to memory of 1396 2072 oobeldr.exe 74 PID 2072 wrote to memory of 1396 2072 oobeldr.exe 74 PID 2072 wrote to memory of 1396 2072 oobeldr.exe 74 PID 2072 wrote to memory of 1396 2072 oobeldr.exe 74 PID 2072 wrote to memory of 1396 2072 oobeldr.exe 74 PID 2072 wrote to memory of 1396 2072 oobeldr.exe 74 PID 2072 wrote to memory of 1396 2072 oobeldr.exe 74 PID 2072 wrote to memory of 1396 2072 oobeldr.exe 74 PID 2072 wrote to memory of 1396 2072 oobeldr.exe 74
Processes
-
C:\Users\Admin\AppData\Local\Temp\bbe02d5f4ae87b515613075b35531856dc5e57817b7d7df3f066fbbab35742a4.exe"C:\Users\Admin\AppData\Local\Temp\bbe02d5f4ae87b515613075b35531856dc5e57817b7d7df3f066fbbab35742a4.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\bbe02d5f4ae87b515613075b35531856dc5e57817b7d7df3f066fbbab35742a4.exeC:\Users\Admin\AppData\Local\Temp\bbe02d5f4ae87b515613075b35531856dc5e57817b7d7df3f066fbbab35742a4.exe2⤵
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
PID:3408
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
PID:5016
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
PID:1396
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
789B
MD5db5ef8d7c51bad129d9097bf953e4913
SHA18439db960aa2d431bf5ec3c37af775b45eb07e06
SHA2561248e67f10b47b397af3c8cbe342bad4be75c68b8e10f4ec6341195cc3138bd9
SHA51204572485790b25e1751347e43b47174051cd153dd75fd55ee5590d25a2579f344cd96cf86cf45bdb7759e3e6d0f734d0ff717148ca70f501b9869e964e036fee
-
Filesize
324KB
MD5e1e140ff0ab6b669a42332780bc9b656
SHA16975c1a22ae7f83530a99bb54d2af9bef6b94852
SHA256bbe02d5f4ae87b515613075b35531856dc5e57817b7d7df3f066fbbab35742a4
SHA512ab94e77011eab412f39dc0b26f8bc38ce8ff544180592330da8ad87fd981c8673adec7b135f0ac5727eaac8fc7a6c1a12191d39a139c73878cc3932794c5f302
-
Filesize
324KB
MD5e1e140ff0ab6b669a42332780bc9b656
SHA16975c1a22ae7f83530a99bb54d2af9bef6b94852
SHA256bbe02d5f4ae87b515613075b35531856dc5e57817b7d7df3f066fbbab35742a4
SHA512ab94e77011eab412f39dc0b26f8bc38ce8ff544180592330da8ad87fd981c8673adec7b135f0ac5727eaac8fc7a6c1a12191d39a139c73878cc3932794c5f302
-
Filesize
324KB
MD5e1e140ff0ab6b669a42332780bc9b656
SHA16975c1a22ae7f83530a99bb54d2af9bef6b94852
SHA256bbe02d5f4ae87b515613075b35531856dc5e57817b7d7df3f066fbbab35742a4
SHA512ab94e77011eab412f39dc0b26f8bc38ce8ff544180592330da8ad87fd981c8673adec7b135f0ac5727eaac8fc7a6c1a12191d39a139c73878cc3932794c5f302
-
Filesize
324KB
MD5e1e140ff0ab6b669a42332780bc9b656
SHA16975c1a22ae7f83530a99bb54d2af9bef6b94852
SHA256bbe02d5f4ae87b515613075b35531856dc5e57817b7d7df3f066fbbab35742a4
SHA512ab94e77011eab412f39dc0b26f8bc38ce8ff544180592330da8ad87fd981c8673adec7b135f0ac5727eaac8fc7a6c1a12191d39a139c73878cc3932794c5f302
-
Filesize
324KB
MD5e1e140ff0ab6b669a42332780bc9b656
SHA16975c1a22ae7f83530a99bb54d2af9bef6b94852
SHA256bbe02d5f4ae87b515613075b35531856dc5e57817b7d7df3f066fbbab35742a4
SHA512ab94e77011eab412f39dc0b26f8bc38ce8ff544180592330da8ad87fd981c8673adec7b135f0ac5727eaac8fc7a6c1a12191d39a139c73878cc3932794c5f302