Analysis
-
max time kernel
118s -
max time network
72s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
01/11/2022, 11:36
Static task
static1
Behavioral task
behavioral1
Sample
277e70a459d0276309fed8514f10393e6d4ab59069d7502176d886f462eaf791.exe
Resource
win10-20220812-en
General
-
Target
277e70a459d0276309fed8514f10393e6d4ab59069d7502176d886f462eaf791.exe
-
Size
324KB
-
MD5
0d865c9f7f06f0416eb2371531e7f1c5
-
SHA1
86d55a284116895d3e13be3dadb3c904b31e3870
-
SHA256
277e70a459d0276309fed8514f10393e6d4ab59069d7502176d886f462eaf791
-
SHA512
ad94d9de5336dc1446a8e24a23c5f938b1c3dc14bbd1ddf5b7de611f8ce221049866635d1586121037e6cf81ebf884bda8beefba530e6154bf98452f0363e854
-
SSDEEP
6144:eKlzr1sYCzek2ciDaP9Xk6Ln1W8W/9InBSkZZmLdGcAdgdY6RKpjS:eGhQ2ciDq9ZL1W8q9InBRqELdolRKpj
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 4384 oobeldr.exe 4128 oobeldr.exe 4952 oobeldr.exe 636 oobeldr.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1524 set thread context of 3448 1524 277e70a459d0276309fed8514f10393e6d4ab59069d7502176d886f462eaf791.exe 66 PID 4384 set thread context of 4128 4384 oobeldr.exe 70 PID 4952 set thread context of 636 4952 oobeldr.exe 74 -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1104 schtasks.exe 4960 schtasks.exe -
Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 1524 wrote to memory of 3448 1524 277e70a459d0276309fed8514f10393e6d4ab59069d7502176d886f462eaf791.exe 66 PID 1524 wrote to memory of 3448 1524 277e70a459d0276309fed8514f10393e6d4ab59069d7502176d886f462eaf791.exe 66 PID 1524 wrote to memory of 3448 1524 277e70a459d0276309fed8514f10393e6d4ab59069d7502176d886f462eaf791.exe 66 PID 1524 wrote to memory of 3448 1524 277e70a459d0276309fed8514f10393e6d4ab59069d7502176d886f462eaf791.exe 66 PID 1524 wrote to memory of 3448 1524 277e70a459d0276309fed8514f10393e6d4ab59069d7502176d886f462eaf791.exe 66 PID 1524 wrote to memory of 3448 1524 277e70a459d0276309fed8514f10393e6d4ab59069d7502176d886f462eaf791.exe 66 PID 1524 wrote to memory of 3448 1524 277e70a459d0276309fed8514f10393e6d4ab59069d7502176d886f462eaf791.exe 66 PID 1524 wrote to memory of 3448 1524 277e70a459d0276309fed8514f10393e6d4ab59069d7502176d886f462eaf791.exe 66 PID 1524 wrote to memory of 3448 1524 277e70a459d0276309fed8514f10393e6d4ab59069d7502176d886f462eaf791.exe 66 PID 3448 wrote to memory of 1104 3448 277e70a459d0276309fed8514f10393e6d4ab59069d7502176d886f462eaf791.exe 68 PID 3448 wrote to memory of 1104 3448 277e70a459d0276309fed8514f10393e6d4ab59069d7502176d886f462eaf791.exe 68 PID 3448 wrote to memory of 1104 3448 277e70a459d0276309fed8514f10393e6d4ab59069d7502176d886f462eaf791.exe 68 PID 4384 wrote to memory of 4128 4384 oobeldr.exe 70 PID 4384 wrote to memory of 4128 4384 oobeldr.exe 70 PID 4384 wrote to memory of 4128 4384 oobeldr.exe 70 PID 4384 wrote to memory of 4128 4384 oobeldr.exe 70 PID 4384 wrote to memory of 4128 4384 oobeldr.exe 70 PID 4384 wrote to memory of 4128 4384 oobeldr.exe 70 PID 4384 wrote to memory of 4128 4384 oobeldr.exe 70 PID 4384 wrote to memory of 4128 4384 oobeldr.exe 70 PID 4384 wrote to memory of 4128 4384 oobeldr.exe 70 PID 4128 wrote to memory of 4960 4128 oobeldr.exe 71 PID 4128 wrote to memory of 4960 4128 oobeldr.exe 71 PID 4128 wrote to memory of 4960 4128 oobeldr.exe 71 PID 4952 wrote to memory of 636 4952 oobeldr.exe 74 PID 4952 wrote to memory of 636 4952 oobeldr.exe 74 PID 4952 wrote to memory of 636 4952 oobeldr.exe 74 PID 4952 wrote to memory of 636 4952 oobeldr.exe 74 PID 4952 wrote to memory of 636 4952 oobeldr.exe 74 PID 4952 wrote to memory of 636 4952 oobeldr.exe 74 PID 4952 wrote to memory of 636 4952 oobeldr.exe 74 PID 4952 wrote to memory of 636 4952 oobeldr.exe 74 PID 4952 wrote to memory of 636 4952 oobeldr.exe 74
Processes
-
C:\Users\Admin\AppData\Local\Temp\277e70a459d0276309fed8514f10393e6d4ab59069d7502176d886f462eaf791.exe"C:\Users\Admin\AppData\Local\Temp\277e70a459d0276309fed8514f10393e6d4ab59069d7502176d886f462eaf791.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\277e70a459d0276309fed8514f10393e6d4ab59069d7502176d886f462eaf791.exeC:\Users\Admin\AppData\Local\Temp\277e70a459d0276309fed8514f10393e6d4ab59069d7502176d886f462eaf791.exe2⤵
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
PID:1104
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
PID:4960
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
PID:636
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
789B
MD5db5ef8d7c51bad129d9097bf953e4913
SHA18439db960aa2d431bf5ec3c37af775b45eb07e06
SHA2561248e67f10b47b397af3c8cbe342bad4be75c68b8e10f4ec6341195cc3138bd9
SHA51204572485790b25e1751347e43b47174051cd153dd75fd55ee5590d25a2579f344cd96cf86cf45bdb7759e3e6d0f734d0ff717148ca70f501b9869e964e036fee
-
Filesize
324KB
MD50d865c9f7f06f0416eb2371531e7f1c5
SHA186d55a284116895d3e13be3dadb3c904b31e3870
SHA256277e70a459d0276309fed8514f10393e6d4ab59069d7502176d886f462eaf791
SHA512ad94d9de5336dc1446a8e24a23c5f938b1c3dc14bbd1ddf5b7de611f8ce221049866635d1586121037e6cf81ebf884bda8beefba530e6154bf98452f0363e854
-
Filesize
324KB
MD50d865c9f7f06f0416eb2371531e7f1c5
SHA186d55a284116895d3e13be3dadb3c904b31e3870
SHA256277e70a459d0276309fed8514f10393e6d4ab59069d7502176d886f462eaf791
SHA512ad94d9de5336dc1446a8e24a23c5f938b1c3dc14bbd1ddf5b7de611f8ce221049866635d1586121037e6cf81ebf884bda8beefba530e6154bf98452f0363e854
-
Filesize
324KB
MD50d865c9f7f06f0416eb2371531e7f1c5
SHA186d55a284116895d3e13be3dadb3c904b31e3870
SHA256277e70a459d0276309fed8514f10393e6d4ab59069d7502176d886f462eaf791
SHA512ad94d9de5336dc1446a8e24a23c5f938b1c3dc14bbd1ddf5b7de611f8ce221049866635d1586121037e6cf81ebf884bda8beefba530e6154bf98452f0363e854
-
Filesize
324KB
MD50d865c9f7f06f0416eb2371531e7f1c5
SHA186d55a284116895d3e13be3dadb3c904b31e3870
SHA256277e70a459d0276309fed8514f10393e6d4ab59069d7502176d886f462eaf791
SHA512ad94d9de5336dc1446a8e24a23c5f938b1c3dc14bbd1ddf5b7de611f8ce221049866635d1586121037e6cf81ebf884bda8beefba530e6154bf98452f0363e854
-
Filesize
324KB
MD50d865c9f7f06f0416eb2371531e7f1c5
SHA186d55a284116895d3e13be3dadb3c904b31e3870
SHA256277e70a459d0276309fed8514f10393e6d4ab59069d7502176d886f462eaf791
SHA512ad94d9de5336dc1446a8e24a23c5f938b1c3dc14bbd1ddf5b7de611f8ce221049866635d1586121037e6cf81ebf884bda8beefba530e6154bf98452f0363e854