Analysis
-
max time kernel
98s -
max time network
73s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
01/11/2022, 11:42
Static task
static1
Behavioral task
behavioral1
Sample
01f6452c5445baf5448c065c81a04dcfb9dfb28afe8f563296556bb72376052e.exe
Resource
win10-20220812-en
General
-
Target
01f6452c5445baf5448c065c81a04dcfb9dfb28afe8f563296556bb72376052e.exe
-
Size
324KB
-
MD5
8d1934456beb9fd9e86f1d69e1108b00
-
SHA1
33f003c7d21bf6178da3358010beac91de54ec2c
-
SHA256
01f6452c5445baf5448c065c81a04dcfb9dfb28afe8f563296556bb72376052e
-
SHA512
50548cc468161654c3b39e5854d5b76d283b6bd564ab8c9913eb7383714ad348c174fb320d703fc44d3909a1617cf222b4e643d33b685e7f7cfb441648266e43
-
SSDEEP
6144:eKlzr1sYCzek2ciDaP9Xk6Ln1W8W/9InBSkZZmLdGcAdgdY6RKpjS:eGhQ2ciDq9ZL1W8q9InBRqELdolRKpj
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 4908 oobeldr.exe 4856 oobeldr.exe 3704 oobeldr.exe 4696 oobeldr.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3764 set thread context of 4880 3764 01f6452c5445baf5448c065c81a04dcfb9dfb28afe8f563296556bb72376052e.exe 66 PID 4908 set thread context of 4856 4908 oobeldr.exe 70 PID 3704 set thread context of 4696 3704 oobeldr.exe 74 -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2992 schtasks.exe 4332 schtasks.exe -
Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 3764 wrote to memory of 4880 3764 01f6452c5445baf5448c065c81a04dcfb9dfb28afe8f563296556bb72376052e.exe 66 PID 3764 wrote to memory of 4880 3764 01f6452c5445baf5448c065c81a04dcfb9dfb28afe8f563296556bb72376052e.exe 66 PID 3764 wrote to memory of 4880 3764 01f6452c5445baf5448c065c81a04dcfb9dfb28afe8f563296556bb72376052e.exe 66 PID 3764 wrote to memory of 4880 3764 01f6452c5445baf5448c065c81a04dcfb9dfb28afe8f563296556bb72376052e.exe 66 PID 3764 wrote to memory of 4880 3764 01f6452c5445baf5448c065c81a04dcfb9dfb28afe8f563296556bb72376052e.exe 66 PID 3764 wrote to memory of 4880 3764 01f6452c5445baf5448c065c81a04dcfb9dfb28afe8f563296556bb72376052e.exe 66 PID 3764 wrote to memory of 4880 3764 01f6452c5445baf5448c065c81a04dcfb9dfb28afe8f563296556bb72376052e.exe 66 PID 3764 wrote to memory of 4880 3764 01f6452c5445baf5448c065c81a04dcfb9dfb28afe8f563296556bb72376052e.exe 66 PID 3764 wrote to memory of 4880 3764 01f6452c5445baf5448c065c81a04dcfb9dfb28afe8f563296556bb72376052e.exe 66 PID 4880 wrote to memory of 2992 4880 01f6452c5445baf5448c065c81a04dcfb9dfb28afe8f563296556bb72376052e.exe 67 PID 4880 wrote to memory of 2992 4880 01f6452c5445baf5448c065c81a04dcfb9dfb28afe8f563296556bb72376052e.exe 67 PID 4880 wrote to memory of 2992 4880 01f6452c5445baf5448c065c81a04dcfb9dfb28afe8f563296556bb72376052e.exe 67 PID 4908 wrote to memory of 4856 4908 oobeldr.exe 70 PID 4908 wrote to memory of 4856 4908 oobeldr.exe 70 PID 4908 wrote to memory of 4856 4908 oobeldr.exe 70 PID 4908 wrote to memory of 4856 4908 oobeldr.exe 70 PID 4908 wrote to memory of 4856 4908 oobeldr.exe 70 PID 4908 wrote to memory of 4856 4908 oobeldr.exe 70 PID 4908 wrote to memory of 4856 4908 oobeldr.exe 70 PID 4908 wrote to memory of 4856 4908 oobeldr.exe 70 PID 4908 wrote to memory of 4856 4908 oobeldr.exe 70 PID 4856 wrote to memory of 4332 4856 oobeldr.exe 71 PID 4856 wrote to memory of 4332 4856 oobeldr.exe 71 PID 4856 wrote to memory of 4332 4856 oobeldr.exe 71 PID 3704 wrote to memory of 4696 3704 oobeldr.exe 74 PID 3704 wrote to memory of 4696 3704 oobeldr.exe 74 PID 3704 wrote to memory of 4696 3704 oobeldr.exe 74 PID 3704 wrote to memory of 4696 3704 oobeldr.exe 74 PID 3704 wrote to memory of 4696 3704 oobeldr.exe 74 PID 3704 wrote to memory of 4696 3704 oobeldr.exe 74 PID 3704 wrote to memory of 4696 3704 oobeldr.exe 74 PID 3704 wrote to memory of 4696 3704 oobeldr.exe 74 PID 3704 wrote to memory of 4696 3704 oobeldr.exe 74
Processes
-
C:\Users\Admin\AppData\Local\Temp\01f6452c5445baf5448c065c81a04dcfb9dfb28afe8f563296556bb72376052e.exe"C:\Users\Admin\AppData\Local\Temp\01f6452c5445baf5448c065c81a04dcfb9dfb28afe8f563296556bb72376052e.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\01f6452c5445baf5448c065c81a04dcfb9dfb28afe8f563296556bb72376052e.exeC:\Users\Admin\AppData\Local\Temp\01f6452c5445baf5448c065c81a04dcfb9dfb28afe8f563296556bb72376052e.exe2⤵
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
PID:2992
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
PID:4332
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
PID:4696
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
789B
MD5db5ef8d7c51bad129d9097bf953e4913
SHA18439db960aa2d431bf5ec3c37af775b45eb07e06
SHA2561248e67f10b47b397af3c8cbe342bad4be75c68b8e10f4ec6341195cc3138bd9
SHA51204572485790b25e1751347e43b47174051cd153dd75fd55ee5590d25a2579f344cd96cf86cf45bdb7759e3e6d0f734d0ff717148ca70f501b9869e964e036fee
-
Filesize
324KB
MD58d1934456beb9fd9e86f1d69e1108b00
SHA133f003c7d21bf6178da3358010beac91de54ec2c
SHA25601f6452c5445baf5448c065c81a04dcfb9dfb28afe8f563296556bb72376052e
SHA51250548cc468161654c3b39e5854d5b76d283b6bd564ab8c9913eb7383714ad348c174fb320d703fc44d3909a1617cf222b4e643d33b685e7f7cfb441648266e43
-
Filesize
324KB
MD58d1934456beb9fd9e86f1d69e1108b00
SHA133f003c7d21bf6178da3358010beac91de54ec2c
SHA25601f6452c5445baf5448c065c81a04dcfb9dfb28afe8f563296556bb72376052e
SHA51250548cc468161654c3b39e5854d5b76d283b6bd564ab8c9913eb7383714ad348c174fb320d703fc44d3909a1617cf222b4e643d33b685e7f7cfb441648266e43
-
Filesize
324KB
MD58d1934456beb9fd9e86f1d69e1108b00
SHA133f003c7d21bf6178da3358010beac91de54ec2c
SHA25601f6452c5445baf5448c065c81a04dcfb9dfb28afe8f563296556bb72376052e
SHA51250548cc468161654c3b39e5854d5b76d283b6bd564ab8c9913eb7383714ad348c174fb320d703fc44d3909a1617cf222b4e643d33b685e7f7cfb441648266e43
-
Filesize
324KB
MD58d1934456beb9fd9e86f1d69e1108b00
SHA133f003c7d21bf6178da3358010beac91de54ec2c
SHA25601f6452c5445baf5448c065c81a04dcfb9dfb28afe8f563296556bb72376052e
SHA51250548cc468161654c3b39e5854d5b76d283b6bd564ab8c9913eb7383714ad348c174fb320d703fc44d3909a1617cf222b4e643d33b685e7f7cfb441648266e43
-
Filesize
324KB
MD58d1934456beb9fd9e86f1d69e1108b00
SHA133f003c7d21bf6178da3358010beac91de54ec2c
SHA25601f6452c5445baf5448c065c81a04dcfb9dfb28afe8f563296556bb72376052e
SHA51250548cc468161654c3b39e5854d5b76d283b6bd564ab8c9913eb7383714ad348c174fb320d703fc44d3909a1617cf222b4e643d33b685e7f7cfb441648266e43