Analysis
-
max time kernel
137s -
max time network
74s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
01/11/2022, 10:41
Static task
static1
Behavioral task
behavioral1
Sample
1185da0cee9730e6a28c70c5fe7a7561087e828a2e12590e6976ee7058b84f4c.exe
Resource
win10-20220812-en
General
-
Target
1185da0cee9730e6a28c70c5fe7a7561087e828a2e12590e6976ee7058b84f4c.exe
-
Size
324KB
-
MD5
a7cf78e756dc2aa53f505815e94fe784
-
SHA1
04f5220912668853cf93ce5da230c439c1eb21ce
-
SHA256
1185da0cee9730e6a28c70c5fe7a7561087e828a2e12590e6976ee7058b84f4c
-
SHA512
480e32072a7aa3d4b7b149c1377c6b1261315ec126ae7c55c278dfe3b9ae3dd2b9ed3d6c8ad9dc9851b01eed577b5bba172259edef2abb902b70ab0f56cffa83
-
SSDEEP
6144:eKlzr1sYCzek2ciDaP9Xk6Ln1W8W/9InBSkZZmLdGcAdgdY6RKpjS:eGhQ2ciDq9ZL1W8q9InBRqELdolRKpj
Malware Config
Signatures
-
Executes dropped EXE 5 IoCs
pid Process 4912 oobeldr.exe 4432 oobeldr.exe 4632 oobeldr.exe 4648 oobeldr.exe 4676 oobeldr.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2576 set thread context of 2276 2576 1185da0cee9730e6a28c70c5fe7a7561087e828a2e12590e6976ee7058b84f4c.exe 66 PID 4912 set thread context of 4432 4912 oobeldr.exe 70 PID 4632 set thread context of 4676 4632 oobeldr.exe 75 -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2664 schtasks.exe 2304 schtasks.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 2576 wrote to memory of 2276 2576 1185da0cee9730e6a28c70c5fe7a7561087e828a2e12590e6976ee7058b84f4c.exe 66 PID 2576 wrote to memory of 2276 2576 1185da0cee9730e6a28c70c5fe7a7561087e828a2e12590e6976ee7058b84f4c.exe 66 PID 2576 wrote to memory of 2276 2576 1185da0cee9730e6a28c70c5fe7a7561087e828a2e12590e6976ee7058b84f4c.exe 66 PID 2576 wrote to memory of 2276 2576 1185da0cee9730e6a28c70c5fe7a7561087e828a2e12590e6976ee7058b84f4c.exe 66 PID 2576 wrote to memory of 2276 2576 1185da0cee9730e6a28c70c5fe7a7561087e828a2e12590e6976ee7058b84f4c.exe 66 PID 2576 wrote to memory of 2276 2576 1185da0cee9730e6a28c70c5fe7a7561087e828a2e12590e6976ee7058b84f4c.exe 66 PID 2576 wrote to memory of 2276 2576 1185da0cee9730e6a28c70c5fe7a7561087e828a2e12590e6976ee7058b84f4c.exe 66 PID 2576 wrote to memory of 2276 2576 1185da0cee9730e6a28c70c5fe7a7561087e828a2e12590e6976ee7058b84f4c.exe 66 PID 2576 wrote to memory of 2276 2576 1185da0cee9730e6a28c70c5fe7a7561087e828a2e12590e6976ee7058b84f4c.exe 66 PID 2276 wrote to memory of 2304 2276 1185da0cee9730e6a28c70c5fe7a7561087e828a2e12590e6976ee7058b84f4c.exe 67 PID 2276 wrote to memory of 2304 2276 1185da0cee9730e6a28c70c5fe7a7561087e828a2e12590e6976ee7058b84f4c.exe 67 PID 2276 wrote to memory of 2304 2276 1185da0cee9730e6a28c70c5fe7a7561087e828a2e12590e6976ee7058b84f4c.exe 67 PID 4912 wrote to memory of 4432 4912 oobeldr.exe 70 PID 4912 wrote to memory of 4432 4912 oobeldr.exe 70 PID 4912 wrote to memory of 4432 4912 oobeldr.exe 70 PID 4912 wrote to memory of 4432 4912 oobeldr.exe 70 PID 4912 wrote to memory of 4432 4912 oobeldr.exe 70 PID 4912 wrote to memory of 4432 4912 oobeldr.exe 70 PID 4912 wrote to memory of 4432 4912 oobeldr.exe 70 PID 4912 wrote to memory of 4432 4912 oobeldr.exe 70 PID 4912 wrote to memory of 4432 4912 oobeldr.exe 70 PID 4432 wrote to memory of 2664 4432 oobeldr.exe 72 PID 4432 wrote to memory of 2664 4432 oobeldr.exe 72 PID 4432 wrote to memory of 2664 4432 oobeldr.exe 72 PID 4632 wrote to memory of 4648 4632 oobeldr.exe 74 PID 4632 wrote to memory of 4648 4632 oobeldr.exe 74 PID 4632 wrote to memory of 4648 4632 oobeldr.exe 74 PID 4632 wrote to memory of 4676 4632 oobeldr.exe 75 PID 4632 wrote to memory of 4676 4632 oobeldr.exe 75 PID 4632 wrote to memory of 4676 4632 oobeldr.exe 75 PID 4632 wrote to memory of 4676 4632 oobeldr.exe 75 PID 4632 wrote to memory of 4676 4632 oobeldr.exe 75 PID 4632 wrote to memory of 4676 4632 oobeldr.exe 75 PID 4632 wrote to memory of 4676 4632 oobeldr.exe 75 PID 4632 wrote to memory of 4676 4632 oobeldr.exe 75 PID 4632 wrote to memory of 4676 4632 oobeldr.exe 75
Processes
-
C:\Users\Admin\AppData\Local\Temp\1185da0cee9730e6a28c70c5fe7a7561087e828a2e12590e6976ee7058b84f4c.exe"C:\Users\Admin\AppData\Local\Temp\1185da0cee9730e6a28c70c5fe7a7561087e828a2e12590e6976ee7058b84f4c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\1185da0cee9730e6a28c70c5fe7a7561087e828a2e12590e6976ee7058b84f4c.exeC:\Users\Admin\AppData\Local\Temp\1185da0cee9730e6a28c70c5fe7a7561087e828a2e12590e6976ee7058b84f4c.exe2⤵
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
PID:2304
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
PID:2664
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
PID:4648
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
PID:4676
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
789B
MD5db5ef8d7c51bad129d9097bf953e4913
SHA18439db960aa2d431bf5ec3c37af775b45eb07e06
SHA2561248e67f10b47b397af3c8cbe342bad4be75c68b8e10f4ec6341195cc3138bd9
SHA51204572485790b25e1751347e43b47174051cd153dd75fd55ee5590d25a2579f344cd96cf86cf45bdb7759e3e6d0f734d0ff717148ca70f501b9869e964e036fee
-
Filesize
324KB
MD5a7cf78e756dc2aa53f505815e94fe784
SHA104f5220912668853cf93ce5da230c439c1eb21ce
SHA2561185da0cee9730e6a28c70c5fe7a7561087e828a2e12590e6976ee7058b84f4c
SHA512480e32072a7aa3d4b7b149c1377c6b1261315ec126ae7c55c278dfe3b9ae3dd2b9ed3d6c8ad9dc9851b01eed577b5bba172259edef2abb902b70ab0f56cffa83
-
Filesize
324KB
MD5a7cf78e756dc2aa53f505815e94fe784
SHA104f5220912668853cf93ce5da230c439c1eb21ce
SHA2561185da0cee9730e6a28c70c5fe7a7561087e828a2e12590e6976ee7058b84f4c
SHA512480e32072a7aa3d4b7b149c1377c6b1261315ec126ae7c55c278dfe3b9ae3dd2b9ed3d6c8ad9dc9851b01eed577b5bba172259edef2abb902b70ab0f56cffa83
-
Filesize
324KB
MD5a7cf78e756dc2aa53f505815e94fe784
SHA104f5220912668853cf93ce5da230c439c1eb21ce
SHA2561185da0cee9730e6a28c70c5fe7a7561087e828a2e12590e6976ee7058b84f4c
SHA512480e32072a7aa3d4b7b149c1377c6b1261315ec126ae7c55c278dfe3b9ae3dd2b9ed3d6c8ad9dc9851b01eed577b5bba172259edef2abb902b70ab0f56cffa83
-
Filesize
324KB
MD5a7cf78e756dc2aa53f505815e94fe784
SHA104f5220912668853cf93ce5da230c439c1eb21ce
SHA2561185da0cee9730e6a28c70c5fe7a7561087e828a2e12590e6976ee7058b84f4c
SHA512480e32072a7aa3d4b7b149c1377c6b1261315ec126ae7c55c278dfe3b9ae3dd2b9ed3d6c8ad9dc9851b01eed577b5bba172259edef2abb902b70ab0f56cffa83
-
Filesize
324KB
MD5a7cf78e756dc2aa53f505815e94fe784
SHA104f5220912668853cf93ce5da230c439c1eb21ce
SHA2561185da0cee9730e6a28c70c5fe7a7561087e828a2e12590e6976ee7058b84f4c
SHA512480e32072a7aa3d4b7b149c1377c6b1261315ec126ae7c55c278dfe3b9ae3dd2b9ed3d6c8ad9dc9851b01eed577b5bba172259edef2abb902b70ab0f56cffa83
-
Filesize
324KB
MD5a7cf78e756dc2aa53f505815e94fe784
SHA104f5220912668853cf93ce5da230c439c1eb21ce
SHA2561185da0cee9730e6a28c70c5fe7a7561087e828a2e12590e6976ee7058b84f4c
SHA512480e32072a7aa3d4b7b149c1377c6b1261315ec126ae7c55c278dfe3b9ae3dd2b9ed3d6c8ad9dc9851b01eed577b5bba172259edef2abb902b70ab0f56cffa83