Analysis
-
max time kernel
146s -
max time network
147s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
01/11/2022, 11:39
Static task
static1
Behavioral task
behavioral1
Sample
957df3eea8c1402c9d880f27e52bd64a417378c28ab995ea6514f3ed4ca1cfa7.exe
Resource
win10-20220812-en
General
-
Target
957df3eea8c1402c9d880f27e52bd64a417378c28ab995ea6514f3ed4ca1cfa7.exe
-
Size
324KB
-
MD5
7cc5ff38901a374172aee6d32c15452b
-
SHA1
3246e97d067ecfb2ea05996518715aefc30fed1a
-
SHA256
957df3eea8c1402c9d880f27e52bd64a417378c28ab995ea6514f3ed4ca1cfa7
-
SHA512
c3c039e08d9ecd65005a508f08559094282bfe64257539d426f05fe2595ae4975ab05be3cbc1a6fdbd872d85101559b0cc6828703540e29fdb463b0e32016926
-
SSDEEP
6144:eKlzr1sYCzek2ciDaP9Xk6Ln1W8W/9InBSkZZmLdGcAdgdY6RKpjS:eGhQ2ciDq9ZL1W8q9InBRqELdolRKpj
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 4800 oobeldr.exe 2744 oobeldr.exe 2256 oobeldr.exe 4596 oobeldr.exe 4472 oobeldr.exe 808 oobeldr.exe 1792 oobeldr.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 2700 set thread context of 4776 2700 957df3eea8c1402c9d880f27e52bd64a417378c28ab995ea6514f3ed4ca1cfa7.exe 66 PID 4800 set thread context of 2744 4800 oobeldr.exe 70 PID 2256 set thread context of 4472 2256 oobeldr.exe 75 PID 808 set thread context of 1792 808 oobeldr.exe 79 -
Program crash 1 IoCs
pid pid_target Process procid_target 3924 2744 WerFault.exe 70 -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1364 schtasks.exe 4576 schtasks.exe -
Suspicious use of WriteProcessMemory 45 IoCs
description pid Process procid_target PID 2700 wrote to memory of 4776 2700 957df3eea8c1402c9d880f27e52bd64a417378c28ab995ea6514f3ed4ca1cfa7.exe 66 PID 2700 wrote to memory of 4776 2700 957df3eea8c1402c9d880f27e52bd64a417378c28ab995ea6514f3ed4ca1cfa7.exe 66 PID 2700 wrote to memory of 4776 2700 957df3eea8c1402c9d880f27e52bd64a417378c28ab995ea6514f3ed4ca1cfa7.exe 66 PID 2700 wrote to memory of 4776 2700 957df3eea8c1402c9d880f27e52bd64a417378c28ab995ea6514f3ed4ca1cfa7.exe 66 PID 2700 wrote to memory of 4776 2700 957df3eea8c1402c9d880f27e52bd64a417378c28ab995ea6514f3ed4ca1cfa7.exe 66 PID 2700 wrote to memory of 4776 2700 957df3eea8c1402c9d880f27e52bd64a417378c28ab995ea6514f3ed4ca1cfa7.exe 66 PID 2700 wrote to memory of 4776 2700 957df3eea8c1402c9d880f27e52bd64a417378c28ab995ea6514f3ed4ca1cfa7.exe 66 PID 2700 wrote to memory of 4776 2700 957df3eea8c1402c9d880f27e52bd64a417378c28ab995ea6514f3ed4ca1cfa7.exe 66 PID 2700 wrote to memory of 4776 2700 957df3eea8c1402c9d880f27e52bd64a417378c28ab995ea6514f3ed4ca1cfa7.exe 66 PID 4776 wrote to memory of 1364 4776 957df3eea8c1402c9d880f27e52bd64a417378c28ab995ea6514f3ed4ca1cfa7.exe 67 PID 4776 wrote to memory of 1364 4776 957df3eea8c1402c9d880f27e52bd64a417378c28ab995ea6514f3ed4ca1cfa7.exe 67 PID 4776 wrote to memory of 1364 4776 957df3eea8c1402c9d880f27e52bd64a417378c28ab995ea6514f3ed4ca1cfa7.exe 67 PID 4800 wrote to memory of 2744 4800 oobeldr.exe 70 PID 4800 wrote to memory of 2744 4800 oobeldr.exe 70 PID 4800 wrote to memory of 2744 4800 oobeldr.exe 70 PID 4800 wrote to memory of 2744 4800 oobeldr.exe 70 PID 4800 wrote to memory of 2744 4800 oobeldr.exe 70 PID 4800 wrote to memory of 2744 4800 oobeldr.exe 70 PID 4800 wrote to memory of 2744 4800 oobeldr.exe 70 PID 4800 wrote to memory of 2744 4800 oobeldr.exe 70 PID 4800 wrote to memory of 2744 4800 oobeldr.exe 70 PID 2256 wrote to memory of 4596 2256 oobeldr.exe 74 PID 2256 wrote to memory of 4596 2256 oobeldr.exe 74 PID 2256 wrote to memory of 4596 2256 oobeldr.exe 74 PID 2256 wrote to memory of 4472 2256 oobeldr.exe 75 PID 2256 wrote to memory of 4472 2256 oobeldr.exe 75 PID 2256 wrote to memory of 4472 2256 oobeldr.exe 75 PID 2256 wrote to memory of 4472 2256 oobeldr.exe 75 PID 2256 wrote to memory of 4472 2256 oobeldr.exe 75 PID 2256 wrote to memory of 4472 2256 oobeldr.exe 75 PID 2256 wrote to memory of 4472 2256 oobeldr.exe 75 PID 2256 wrote to memory of 4472 2256 oobeldr.exe 75 PID 2256 wrote to memory of 4472 2256 oobeldr.exe 75 PID 4472 wrote to memory of 4576 4472 oobeldr.exe 76 PID 4472 wrote to memory of 4576 4472 oobeldr.exe 76 PID 4472 wrote to memory of 4576 4472 oobeldr.exe 76 PID 808 wrote to memory of 1792 808 oobeldr.exe 79 PID 808 wrote to memory of 1792 808 oobeldr.exe 79 PID 808 wrote to memory of 1792 808 oobeldr.exe 79 PID 808 wrote to memory of 1792 808 oobeldr.exe 79 PID 808 wrote to memory of 1792 808 oobeldr.exe 79 PID 808 wrote to memory of 1792 808 oobeldr.exe 79 PID 808 wrote to memory of 1792 808 oobeldr.exe 79 PID 808 wrote to memory of 1792 808 oobeldr.exe 79 PID 808 wrote to memory of 1792 808 oobeldr.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\957df3eea8c1402c9d880f27e52bd64a417378c28ab995ea6514f3ed4ca1cfa7.exe"C:\Users\Admin\AppData\Local\Temp\957df3eea8c1402c9d880f27e52bd64a417378c28ab995ea6514f3ed4ca1cfa7.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\957df3eea8c1402c9d880f27e52bd64a417378c28ab995ea6514f3ed4ca1cfa7.exeC:\Users\Admin\AppData\Local\Temp\957df3eea8c1402c9d880f27e52bd64a417378c28ab995ea6514f3ed4ca1cfa7.exe2⤵
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
PID:1364
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
PID:2744 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2744 -s 243⤵
- Program crash
PID:3924
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
PID:4596
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
PID:4576
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
PID:1792
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
789B
MD5db5ef8d7c51bad129d9097bf953e4913
SHA18439db960aa2d431bf5ec3c37af775b45eb07e06
SHA2561248e67f10b47b397af3c8cbe342bad4be75c68b8e10f4ec6341195cc3138bd9
SHA51204572485790b25e1751347e43b47174051cd153dd75fd55ee5590d25a2579f344cd96cf86cf45bdb7759e3e6d0f734d0ff717148ca70f501b9869e964e036fee
-
Filesize
324KB
MD57cc5ff38901a374172aee6d32c15452b
SHA13246e97d067ecfb2ea05996518715aefc30fed1a
SHA256957df3eea8c1402c9d880f27e52bd64a417378c28ab995ea6514f3ed4ca1cfa7
SHA512c3c039e08d9ecd65005a508f08559094282bfe64257539d426f05fe2595ae4975ab05be3cbc1a6fdbd872d85101559b0cc6828703540e29fdb463b0e32016926
-
Filesize
324KB
MD57cc5ff38901a374172aee6d32c15452b
SHA13246e97d067ecfb2ea05996518715aefc30fed1a
SHA256957df3eea8c1402c9d880f27e52bd64a417378c28ab995ea6514f3ed4ca1cfa7
SHA512c3c039e08d9ecd65005a508f08559094282bfe64257539d426f05fe2595ae4975ab05be3cbc1a6fdbd872d85101559b0cc6828703540e29fdb463b0e32016926
-
Filesize
324KB
MD57cc5ff38901a374172aee6d32c15452b
SHA13246e97d067ecfb2ea05996518715aefc30fed1a
SHA256957df3eea8c1402c9d880f27e52bd64a417378c28ab995ea6514f3ed4ca1cfa7
SHA512c3c039e08d9ecd65005a508f08559094282bfe64257539d426f05fe2595ae4975ab05be3cbc1a6fdbd872d85101559b0cc6828703540e29fdb463b0e32016926
-
Filesize
324KB
MD57cc5ff38901a374172aee6d32c15452b
SHA13246e97d067ecfb2ea05996518715aefc30fed1a
SHA256957df3eea8c1402c9d880f27e52bd64a417378c28ab995ea6514f3ed4ca1cfa7
SHA512c3c039e08d9ecd65005a508f08559094282bfe64257539d426f05fe2595ae4975ab05be3cbc1a6fdbd872d85101559b0cc6828703540e29fdb463b0e32016926
-
Filesize
324KB
MD57cc5ff38901a374172aee6d32c15452b
SHA13246e97d067ecfb2ea05996518715aefc30fed1a
SHA256957df3eea8c1402c9d880f27e52bd64a417378c28ab995ea6514f3ed4ca1cfa7
SHA512c3c039e08d9ecd65005a508f08559094282bfe64257539d426f05fe2595ae4975ab05be3cbc1a6fdbd872d85101559b0cc6828703540e29fdb463b0e32016926
-
Filesize
324KB
MD57cc5ff38901a374172aee6d32c15452b
SHA13246e97d067ecfb2ea05996518715aefc30fed1a
SHA256957df3eea8c1402c9d880f27e52bd64a417378c28ab995ea6514f3ed4ca1cfa7
SHA512c3c039e08d9ecd65005a508f08559094282bfe64257539d426f05fe2595ae4975ab05be3cbc1a6fdbd872d85101559b0cc6828703540e29fdb463b0e32016926
-
Filesize
324KB
MD57cc5ff38901a374172aee6d32c15452b
SHA13246e97d067ecfb2ea05996518715aefc30fed1a
SHA256957df3eea8c1402c9d880f27e52bd64a417378c28ab995ea6514f3ed4ca1cfa7
SHA512c3c039e08d9ecd65005a508f08559094282bfe64257539d426f05fe2595ae4975ab05be3cbc1a6fdbd872d85101559b0cc6828703540e29fdb463b0e32016926
-
Filesize
324KB
MD57cc5ff38901a374172aee6d32c15452b
SHA13246e97d067ecfb2ea05996518715aefc30fed1a
SHA256957df3eea8c1402c9d880f27e52bd64a417378c28ab995ea6514f3ed4ca1cfa7
SHA512c3c039e08d9ecd65005a508f08559094282bfe64257539d426f05fe2595ae4975ab05be3cbc1a6fdbd872d85101559b0cc6828703540e29fdb463b0e32016926