Analysis
-
max time kernel
104s -
max time network
104s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
01/11/2022, 10:42
Static task
static1
Behavioral task
behavioral1
Sample
9f2868228ba606f220c12eeb2a2f0690c82d80296bd761db9d5d167889de5e85.exe
Resource
win10-20220812-en
General
-
Target
9f2868228ba606f220c12eeb2a2f0690c82d80296bd761db9d5d167889de5e85.exe
-
Size
324KB
-
MD5
8e1f99bcb7abd8ec666c7fa86d975a68
-
SHA1
5f4a07551fccbd5ad8baad2abc4476d80a79ebec
-
SHA256
9f2868228ba606f220c12eeb2a2f0690c82d80296bd761db9d5d167889de5e85
-
SHA512
8fac507f4e85e6131fd106331822c2f51a394d61c8f79b68ed4642ecda4f1175e87396dea20d7ca5e3f8331443fb99dfdeb2b111423eab205d4193552ebcedce
-
SSDEEP
6144:eKlzr1sYCzek2ciDaP9Xk6Ln1W8W/9InBSkZZmLdGcAdgdY6RKpjS:eGhQ2ciDq9ZL1W8q9InBRqELdolRKpj
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 1552 oobeldr.exe 4980 oobeldr.exe 4380 oobeldr.exe 4636 oobeldr.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3516 set thread context of 5000 3516 9f2868228ba606f220c12eeb2a2f0690c82d80296bd761db9d5d167889de5e85.exe 66 PID 1552 set thread context of 4980 1552 oobeldr.exe 70 PID 4380 set thread context of 4636 4380 oobeldr.exe 74 -
Program crash 1 IoCs
pid pid_target Process procid_target 3208 4980 WerFault.exe 70 -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2340 schtasks.exe 1336 schtasks.exe -
Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 3516 wrote to memory of 5000 3516 9f2868228ba606f220c12eeb2a2f0690c82d80296bd761db9d5d167889de5e85.exe 66 PID 3516 wrote to memory of 5000 3516 9f2868228ba606f220c12eeb2a2f0690c82d80296bd761db9d5d167889de5e85.exe 66 PID 3516 wrote to memory of 5000 3516 9f2868228ba606f220c12eeb2a2f0690c82d80296bd761db9d5d167889de5e85.exe 66 PID 3516 wrote to memory of 5000 3516 9f2868228ba606f220c12eeb2a2f0690c82d80296bd761db9d5d167889de5e85.exe 66 PID 3516 wrote to memory of 5000 3516 9f2868228ba606f220c12eeb2a2f0690c82d80296bd761db9d5d167889de5e85.exe 66 PID 3516 wrote to memory of 5000 3516 9f2868228ba606f220c12eeb2a2f0690c82d80296bd761db9d5d167889de5e85.exe 66 PID 3516 wrote to memory of 5000 3516 9f2868228ba606f220c12eeb2a2f0690c82d80296bd761db9d5d167889de5e85.exe 66 PID 3516 wrote to memory of 5000 3516 9f2868228ba606f220c12eeb2a2f0690c82d80296bd761db9d5d167889de5e85.exe 66 PID 3516 wrote to memory of 5000 3516 9f2868228ba606f220c12eeb2a2f0690c82d80296bd761db9d5d167889de5e85.exe 66 PID 5000 wrote to memory of 2340 5000 9f2868228ba606f220c12eeb2a2f0690c82d80296bd761db9d5d167889de5e85.exe 67 PID 5000 wrote to memory of 2340 5000 9f2868228ba606f220c12eeb2a2f0690c82d80296bd761db9d5d167889de5e85.exe 67 PID 5000 wrote to memory of 2340 5000 9f2868228ba606f220c12eeb2a2f0690c82d80296bd761db9d5d167889de5e85.exe 67 PID 1552 wrote to memory of 4980 1552 oobeldr.exe 70 PID 1552 wrote to memory of 4980 1552 oobeldr.exe 70 PID 1552 wrote to memory of 4980 1552 oobeldr.exe 70 PID 1552 wrote to memory of 4980 1552 oobeldr.exe 70 PID 1552 wrote to memory of 4980 1552 oobeldr.exe 70 PID 1552 wrote to memory of 4980 1552 oobeldr.exe 70 PID 1552 wrote to memory of 4980 1552 oobeldr.exe 70 PID 1552 wrote to memory of 4980 1552 oobeldr.exe 70 PID 1552 wrote to memory of 4980 1552 oobeldr.exe 70 PID 4380 wrote to memory of 4636 4380 oobeldr.exe 74 PID 4380 wrote to memory of 4636 4380 oobeldr.exe 74 PID 4380 wrote to memory of 4636 4380 oobeldr.exe 74 PID 4380 wrote to memory of 4636 4380 oobeldr.exe 74 PID 4380 wrote to memory of 4636 4380 oobeldr.exe 74 PID 4380 wrote to memory of 4636 4380 oobeldr.exe 74 PID 4380 wrote to memory of 4636 4380 oobeldr.exe 74 PID 4380 wrote to memory of 4636 4380 oobeldr.exe 74 PID 4380 wrote to memory of 4636 4380 oobeldr.exe 74 PID 4636 wrote to memory of 1336 4636 oobeldr.exe 75 PID 4636 wrote to memory of 1336 4636 oobeldr.exe 75 PID 4636 wrote to memory of 1336 4636 oobeldr.exe 75
Processes
-
C:\Users\Admin\AppData\Local\Temp\9f2868228ba606f220c12eeb2a2f0690c82d80296bd761db9d5d167889de5e85.exe"C:\Users\Admin\AppData\Local\Temp\9f2868228ba606f220c12eeb2a2f0690c82d80296bd761db9d5d167889de5e85.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\9f2868228ba606f220c12eeb2a2f0690c82d80296bd761db9d5d167889de5e85.exeC:\Users\Admin\AppData\Local\Temp\9f2868228ba606f220c12eeb2a2f0690c82d80296bd761db9d5d167889de5e85.exe2⤵
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
PID:2340
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
PID:4980 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4980 -s 243⤵
- Program crash
PID:3208
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
PID:1336
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
789B
MD5db5ef8d7c51bad129d9097bf953e4913
SHA18439db960aa2d431bf5ec3c37af775b45eb07e06
SHA2561248e67f10b47b397af3c8cbe342bad4be75c68b8e10f4ec6341195cc3138bd9
SHA51204572485790b25e1751347e43b47174051cd153dd75fd55ee5590d25a2579f344cd96cf86cf45bdb7759e3e6d0f734d0ff717148ca70f501b9869e964e036fee
-
Filesize
324KB
MD58e1f99bcb7abd8ec666c7fa86d975a68
SHA15f4a07551fccbd5ad8baad2abc4476d80a79ebec
SHA2569f2868228ba606f220c12eeb2a2f0690c82d80296bd761db9d5d167889de5e85
SHA5128fac507f4e85e6131fd106331822c2f51a394d61c8f79b68ed4642ecda4f1175e87396dea20d7ca5e3f8331443fb99dfdeb2b111423eab205d4193552ebcedce
-
Filesize
324KB
MD58e1f99bcb7abd8ec666c7fa86d975a68
SHA15f4a07551fccbd5ad8baad2abc4476d80a79ebec
SHA2569f2868228ba606f220c12eeb2a2f0690c82d80296bd761db9d5d167889de5e85
SHA5128fac507f4e85e6131fd106331822c2f51a394d61c8f79b68ed4642ecda4f1175e87396dea20d7ca5e3f8331443fb99dfdeb2b111423eab205d4193552ebcedce
-
Filesize
324KB
MD58e1f99bcb7abd8ec666c7fa86d975a68
SHA15f4a07551fccbd5ad8baad2abc4476d80a79ebec
SHA2569f2868228ba606f220c12eeb2a2f0690c82d80296bd761db9d5d167889de5e85
SHA5128fac507f4e85e6131fd106331822c2f51a394d61c8f79b68ed4642ecda4f1175e87396dea20d7ca5e3f8331443fb99dfdeb2b111423eab205d4193552ebcedce
-
Filesize
324KB
MD58e1f99bcb7abd8ec666c7fa86d975a68
SHA15f4a07551fccbd5ad8baad2abc4476d80a79ebec
SHA2569f2868228ba606f220c12eeb2a2f0690c82d80296bd761db9d5d167889de5e85
SHA5128fac507f4e85e6131fd106331822c2f51a394d61c8f79b68ed4642ecda4f1175e87396dea20d7ca5e3f8331443fb99dfdeb2b111423eab205d4193552ebcedce
-
Filesize
324KB
MD58e1f99bcb7abd8ec666c7fa86d975a68
SHA15f4a07551fccbd5ad8baad2abc4476d80a79ebec
SHA2569f2868228ba606f220c12eeb2a2f0690c82d80296bd761db9d5d167889de5e85
SHA5128fac507f4e85e6131fd106331822c2f51a394d61c8f79b68ed4642ecda4f1175e87396dea20d7ca5e3f8331443fb99dfdeb2b111423eab205d4193552ebcedce