Analysis
-
max time kernel
145s -
max time network
147s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
01/11/2022, 11:36
Static task
static1
Behavioral task
behavioral1
Sample
e795f2169c7fa609a840e4b042597bb4a0c9fee4fe280d233780fab546288d94.exe
Resource
win10-20220812-en
General
-
Target
e795f2169c7fa609a840e4b042597bb4a0c9fee4fe280d233780fab546288d94.exe
-
Size
324KB
-
MD5
f6cf9897942e0ae620d06be6858bbdf0
-
SHA1
0f878b006f1258033c8ef3c7a10b980f1545be73
-
SHA256
e795f2169c7fa609a840e4b042597bb4a0c9fee4fe280d233780fab546288d94
-
SHA512
f0ea1cba8d3afdffee11ee27936bbbfc5f05223f0fce95b814b2ed0b4f433336b746bcd7d83aa0e0eb6201e7a5018e5d2c677e7ce4191ffeb264ea1e991a8b2d
-
SSDEEP
6144:eKlzr1sYCzek2ciDaP9Xk6Ln1W8W/9InBSkZZmLdGcAdgdY6RKpjS:eGhQ2ciDq9ZL1W8q9InBRqELdolRKpj
Malware Config
Signatures
-
Executes dropped EXE 6 IoCs
pid Process 4916 oobeldr.exe 4856 oobeldr.exe 3788 oobeldr.exe 4532 oobeldr.exe 3172 oobeldr.exe 2412 oobeldr.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 3676 set thread context of 4852 3676 e795f2169c7fa609a840e4b042597bb4a0c9fee4fe280d233780fab546288d94.exe 66 PID 4916 set thread context of 4856 4916 oobeldr.exe 70 PID 3788 set thread context of 4532 3788 oobeldr.exe 74 PID 3172 set thread context of 2412 3172 oobeldr.exe 76 -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3628 schtasks.exe 3664 schtasks.exe -
Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 3676 wrote to memory of 4852 3676 e795f2169c7fa609a840e4b042597bb4a0c9fee4fe280d233780fab546288d94.exe 66 PID 3676 wrote to memory of 4852 3676 e795f2169c7fa609a840e4b042597bb4a0c9fee4fe280d233780fab546288d94.exe 66 PID 3676 wrote to memory of 4852 3676 e795f2169c7fa609a840e4b042597bb4a0c9fee4fe280d233780fab546288d94.exe 66 PID 3676 wrote to memory of 4852 3676 e795f2169c7fa609a840e4b042597bb4a0c9fee4fe280d233780fab546288d94.exe 66 PID 3676 wrote to memory of 4852 3676 e795f2169c7fa609a840e4b042597bb4a0c9fee4fe280d233780fab546288d94.exe 66 PID 3676 wrote to memory of 4852 3676 e795f2169c7fa609a840e4b042597bb4a0c9fee4fe280d233780fab546288d94.exe 66 PID 3676 wrote to memory of 4852 3676 e795f2169c7fa609a840e4b042597bb4a0c9fee4fe280d233780fab546288d94.exe 66 PID 3676 wrote to memory of 4852 3676 e795f2169c7fa609a840e4b042597bb4a0c9fee4fe280d233780fab546288d94.exe 66 PID 3676 wrote to memory of 4852 3676 e795f2169c7fa609a840e4b042597bb4a0c9fee4fe280d233780fab546288d94.exe 66 PID 4852 wrote to memory of 3628 4852 e795f2169c7fa609a840e4b042597bb4a0c9fee4fe280d233780fab546288d94.exe 68 PID 4852 wrote to memory of 3628 4852 e795f2169c7fa609a840e4b042597bb4a0c9fee4fe280d233780fab546288d94.exe 68 PID 4852 wrote to memory of 3628 4852 e795f2169c7fa609a840e4b042597bb4a0c9fee4fe280d233780fab546288d94.exe 68 PID 4916 wrote to memory of 4856 4916 oobeldr.exe 70 PID 4916 wrote to memory of 4856 4916 oobeldr.exe 70 PID 4916 wrote to memory of 4856 4916 oobeldr.exe 70 PID 4916 wrote to memory of 4856 4916 oobeldr.exe 70 PID 4916 wrote to memory of 4856 4916 oobeldr.exe 70 PID 4916 wrote to memory of 4856 4916 oobeldr.exe 70 PID 4916 wrote to memory of 4856 4916 oobeldr.exe 70 PID 4916 wrote to memory of 4856 4916 oobeldr.exe 70 PID 4916 wrote to memory of 4856 4916 oobeldr.exe 70 PID 4856 wrote to memory of 3664 4856 oobeldr.exe 72 PID 4856 wrote to memory of 3664 4856 oobeldr.exe 72 PID 4856 wrote to memory of 3664 4856 oobeldr.exe 72 PID 3788 wrote to memory of 4532 3788 oobeldr.exe 74 PID 3788 wrote to memory of 4532 3788 oobeldr.exe 74 PID 3788 wrote to memory of 4532 3788 oobeldr.exe 74 PID 3788 wrote to memory of 4532 3788 oobeldr.exe 74 PID 3788 wrote to memory of 4532 3788 oobeldr.exe 74 PID 3788 wrote to memory of 4532 3788 oobeldr.exe 74 PID 3788 wrote to memory of 4532 3788 oobeldr.exe 74 PID 3788 wrote to memory of 4532 3788 oobeldr.exe 74 PID 3788 wrote to memory of 4532 3788 oobeldr.exe 74 PID 3172 wrote to memory of 2412 3172 oobeldr.exe 76 PID 3172 wrote to memory of 2412 3172 oobeldr.exe 76 PID 3172 wrote to memory of 2412 3172 oobeldr.exe 76 PID 3172 wrote to memory of 2412 3172 oobeldr.exe 76 PID 3172 wrote to memory of 2412 3172 oobeldr.exe 76 PID 3172 wrote to memory of 2412 3172 oobeldr.exe 76 PID 3172 wrote to memory of 2412 3172 oobeldr.exe 76 PID 3172 wrote to memory of 2412 3172 oobeldr.exe 76 PID 3172 wrote to memory of 2412 3172 oobeldr.exe 76
Processes
-
C:\Users\Admin\AppData\Local\Temp\e795f2169c7fa609a840e4b042597bb4a0c9fee4fe280d233780fab546288d94.exe"C:\Users\Admin\AppData\Local\Temp\e795f2169c7fa609a840e4b042597bb4a0c9fee4fe280d233780fab546288d94.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3676 -
C:\Users\Admin\AppData\Local\Temp\e795f2169c7fa609a840e4b042597bb4a0c9fee4fe280d233780fab546288d94.exeC:\Users\Admin\AppData\Local\Temp\e795f2169c7fa609a840e4b042597bb4a0c9fee4fe280d233780fab546288d94.exe2⤵
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
PID:3628
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
PID:3664
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3788 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
PID:4532
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
PID:2412
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
789B
MD5db5ef8d7c51bad129d9097bf953e4913
SHA18439db960aa2d431bf5ec3c37af775b45eb07e06
SHA2561248e67f10b47b397af3c8cbe342bad4be75c68b8e10f4ec6341195cc3138bd9
SHA51204572485790b25e1751347e43b47174051cd153dd75fd55ee5590d25a2579f344cd96cf86cf45bdb7759e3e6d0f734d0ff717148ca70f501b9869e964e036fee
-
Filesize
324KB
MD5f6cf9897942e0ae620d06be6858bbdf0
SHA10f878b006f1258033c8ef3c7a10b980f1545be73
SHA256e795f2169c7fa609a840e4b042597bb4a0c9fee4fe280d233780fab546288d94
SHA512f0ea1cba8d3afdffee11ee27936bbbfc5f05223f0fce95b814b2ed0b4f433336b746bcd7d83aa0e0eb6201e7a5018e5d2c677e7ce4191ffeb264ea1e991a8b2d
-
Filesize
324KB
MD5f6cf9897942e0ae620d06be6858bbdf0
SHA10f878b006f1258033c8ef3c7a10b980f1545be73
SHA256e795f2169c7fa609a840e4b042597bb4a0c9fee4fe280d233780fab546288d94
SHA512f0ea1cba8d3afdffee11ee27936bbbfc5f05223f0fce95b814b2ed0b4f433336b746bcd7d83aa0e0eb6201e7a5018e5d2c677e7ce4191ffeb264ea1e991a8b2d
-
Filesize
324KB
MD5f6cf9897942e0ae620d06be6858bbdf0
SHA10f878b006f1258033c8ef3c7a10b980f1545be73
SHA256e795f2169c7fa609a840e4b042597bb4a0c9fee4fe280d233780fab546288d94
SHA512f0ea1cba8d3afdffee11ee27936bbbfc5f05223f0fce95b814b2ed0b4f433336b746bcd7d83aa0e0eb6201e7a5018e5d2c677e7ce4191ffeb264ea1e991a8b2d
-
Filesize
324KB
MD5f6cf9897942e0ae620d06be6858bbdf0
SHA10f878b006f1258033c8ef3c7a10b980f1545be73
SHA256e795f2169c7fa609a840e4b042597bb4a0c9fee4fe280d233780fab546288d94
SHA512f0ea1cba8d3afdffee11ee27936bbbfc5f05223f0fce95b814b2ed0b4f433336b746bcd7d83aa0e0eb6201e7a5018e5d2c677e7ce4191ffeb264ea1e991a8b2d
-
Filesize
324KB
MD5f6cf9897942e0ae620d06be6858bbdf0
SHA10f878b006f1258033c8ef3c7a10b980f1545be73
SHA256e795f2169c7fa609a840e4b042597bb4a0c9fee4fe280d233780fab546288d94
SHA512f0ea1cba8d3afdffee11ee27936bbbfc5f05223f0fce95b814b2ed0b4f433336b746bcd7d83aa0e0eb6201e7a5018e5d2c677e7ce4191ffeb264ea1e991a8b2d
-
Filesize
324KB
MD5f6cf9897942e0ae620d06be6858bbdf0
SHA10f878b006f1258033c8ef3c7a10b980f1545be73
SHA256e795f2169c7fa609a840e4b042597bb4a0c9fee4fe280d233780fab546288d94
SHA512f0ea1cba8d3afdffee11ee27936bbbfc5f05223f0fce95b814b2ed0b4f433336b746bcd7d83aa0e0eb6201e7a5018e5d2c677e7ce4191ffeb264ea1e991a8b2d
-
Filesize
324KB
MD5f6cf9897942e0ae620d06be6858bbdf0
SHA10f878b006f1258033c8ef3c7a10b980f1545be73
SHA256e795f2169c7fa609a840e4b042597bb4a0c9fee4fe280d233780fab546288d94
SHA512f0ea1cba8d3afdffee11ee27936bbbfc5f05223f0fce95b814b2ed0b4f433336b746bcd7d83aa0e0eb6201e7a5018e5d2c677e7ce4191ffeb264ea1e991a8b2d