Analysis
-
max time kernel
112s -
max time network
104s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
01/11/2022, 11:44
Static task
static1
Behavioral task
behavioral1
Sample
0a06eecf84fedadb26b6bb30b185f4334d886bb7d4718d63414a966c8247900b.exe
Resource
win10-20220812-en
General
-
Target
0a06eecf84fedadb26b6bb30b185f4334d886bb7d4718d63414a966c8247900b.exe
-
Size
324KB
-
MD5
c1f4f4c8b5c1e95034c539eb94d4316a
-
SHA1
8bae8ed24d9d86daf76d70484845113fb62d71f7
-
SHA256
0a06eecf84fedadb26b6bb30b185f4334d886bb7d4718d63414a966c8247900b
-
SHA512
45c1a921f64ba92d8573ce4cdfdb9979a5544a72444082a6928e1836fd52d6afcaf78132bab166e2a227dde83a4bda14823e507b838370d09e2923db6388fef9
-
SSDEEP
6144:eKlzr1sYCzek2ciDaP9Xk6Ln1W8W/9InBSkZZmLdGcAdgdY6RKpjS:eGhQ2ciDq9ZL1W8q9InBRqELdolRKpj
Malware Config
Signatures
-
Executes dropped EXE 5 IoCs
pid Process 5044 oobeldr.exe 4948 oobeldr.exe 4728 oobeldr.exe 3168 oobeldr.exe 1184 oobeldr.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3516 set thread context of 4972 3516 0a06eecf84fedadb26b6bb30b185f4334d886bb7d4718d63414a966c8247900b.exe 67 PID 5044 set thread context of 4728 5044 oobeldr.exe 72 PID 3168 set thread context of 1184 3168 oobeldr.exe 76 -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2204 schtasks.exe 5108 schtasks.exe -
Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 3516 wrote to memory of 5000 3516 0a06eecf84fedadb26b6bb30b185f4334d886bb7d4718d63414a966c8247900b.exe 66 PID 3516 wrote to memory of 5000 3516 0a06eecf84fedadb26b6bb30b185f4334d886bb7d4718d63414a966c8247900b.exe 66 PID 3516 wrote to memory of 5000 3516 0a06eecf84fedadb26b6bb30b185f4334d886bb7d4718d63414a966c8247900b.exe 66 PID 3516 wrote to memory of 4972 3516 0a06eecf84fedadb26b6bb30b185f4334d886bb7d4718d63414a966c8247900b.exe 67 PID 3516 wrote to memory of 4972 3516 0a06eecf84fedadb26b6bb30b185f4334d886bb7d4718d63414a966c8247900b.exe 67 PID 3516 wrote to memory of 4972 3516 0a06eecf84fedadb26b6bb30b185f4334d886bb7d4718d63414a966c8247900b.exe 67 PID 3516 wrote to memory of 4972 3516 0a06eecf84fedadb26b6bb30b185f4334d886bb7d4718d63414a966c8247900b.exe 67 PID 3516 wrote to memory of 4972 3516 0a06eecf84fedadb26b6bb30b185f4334d886bb7d4718d63414a966c8247900b.exe 67 PID 3516 wrote to memory of 4972 3516 0a06eecf84fedadb26b6bb30b185f4334d886bb7d4718d63414a966c8247900b.exe 67 PID 3516 wrote to memory of 4972 3516 0a06eecf84fedadb26b6bb30b185f4334d886bb7d4718d63414a966c8247900b.exe 67 PID 3516 wrote to memory of 4972 3516 0a06eecf84fedadb26b6bb30b185f4334d886bb7d4718d63414a966c8247900b.exe 67 PID 3516 wrote to memory of 4972 3516 0a06eecf84fedadb26b6bb30b185f4334d886bb7d4718d63414a966c8247900b.exe 67 PID 4972 wrote to memory of 2204 4972 0a06eecf84fedadb26b6bb30b185f4334d886bb7d4718d63414a966c8247900b.exe 68 PID 4972 wrote to memory of 2204 4972 0a06eecf84fedadb26b6bb30b185f4334d886bb7d4718d63414a966c8247900b.exe 68 PID 4972 wrote to memory of 2204 4972 0a06eecf84fedadb26b6bb30b185f4334d886bb7d4718d63414a966c8247900b.exe 68 PID 5044 wrote to memory of 4948 5044 oobeldr.exe 71 PID 5044 wrote to memory of 4948 5044 oobeldr.exe 71 PID 5044 wrote to memory of 4948 5044 oobeldr.exe 71 PID 5044 wrote to memory of 4728 5044 oobeldr.exe 72 PID 5044 wrote to memory of 4728 5044 oobeldr.exe 72 PID 5044 wrote to memory of 4728 5044 oobeldr.exe 72 PID 5044 wrote to memory of 4728 5044 oobeldr.exe 72 PID 5044 wrote to memory of 4728 5044 oobeldr.exe 72 PID 5044 wrote to memory of 4728 5044 oobeldr.exe 72 PID 5044 wrote to memory of 4728 5044 oobeldr.exe 72 PID 5044 wrote to memory of 4728 5044 oobeldr.exe 72 PID 5044 wrote to memory of 4728 5044 oobeldr.exe 72 PID 4728 wrote to memory of 5108 4728 oobeldr.exe 73 PID 4728 wrote to memory of 5108 4728 oobeldr.exe 73 PID 4728 wrote to memory of 5108 4728 oobeldr.exe 73 PID 3168 wrote to memory of 1184 3168 oobeldr.exe 76 PID 3168 wrote to memory of 1184 3168 oobeldr.exe 76 PID 3168 wrote to memory of 1184 3168 oobeldr.exe 76 PID 3168 wrote to memory of 1184 3168 oobeldr.exe 76 PID 3168 wrote to memory of 1184 3168 oobeldr.exe 76 PID 3168 wrote to memory of 1184 3168 oobeldr.exe 76 PID 3168 wrote to memory of 1184 3168 oobeldr.exe 76 PID 3168 wrote to memory of 1184 3168 oobeldr.exe 76 PID 3168 wrote to memory of 1184 3168 oobeldr.exe 76
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a06eecf84fedadb26b6bb30b185f4334d886bb7d4718d63414a966c8247900b.exe"C:\Users\Admin\AppData\Local\Temp\0a06eecf84fedadb26b6bb30b185f4334d886bb7d4718d63414a966c8247900b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\0a06eecf84fedadb26b6bb30b185f4334d886bb7d4718d63414a966c8247900b.exeC:\Users\Admin\AppData\Local\Temp\0a06eecf84fedadb26b6bb30b185f4334d886bb7d4718d63414a966c8247900b.exe2⤵PID:5000
-
-
C:\Users\Admin\AppData\Local\Temp\0a06eecf84fedadb26b6bb30b185f4334d886bb7d4718d63414a966c8247900b.exeC:\Users\Admin\AppData\Local\Temp\0a06eecf84fedadb26b6bb30b185f4334d886bb7d4718d63414a966c8247900b.exe2⤵
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
PID:2204
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
PID:4948
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
PID:5108
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
PID:1184
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
789B
MD5db5ef8d7c51bad129d9097bf953e4913
SHA18439db960aa2d431bf5ec3c37af775b45eb07e06
SHA2561248e67f10b47b397af3c8cbe342bad4be75c68b8e10f4ec6341195cc3138bd9
SHA51204572485790b25e1751347e43b47174051cd153dd75fd55ee5590d25a2579f344cd96cf86cf45bdb7759e3e6d0f734d0ff717148ca70f501b9869e964e036fee
-
Filesize
324KB
MD5c1f4f4c8b5c1e95034c539eb94d4316a
SHA18bae8ed24d9d86daf76d70484845113fb62d71f7
SHA2560a06eecf84fedadb26b6bb30b185f4334d886bb7d4718d63414a966c8247900b
SHA51245c1a921f64ba92d8573ce4cdfdb9979a5544a72444082a6928e1836fd52d6afcaf78132bab166e2a227dde83a4bda14823e507b838370d09e2923db6388fef9
-
Filesize
324KB
MD5c1f4f4c8b5c1e95034c539eb94d4316a
SHA18bae8ed24d9d86daf76d70484845113fb62d71f7
SHA2560a06eecf84fedadb26b6bb30b185f4334d886bb7d4718d63414a966c8247900b
SHA51245c1a921f64ba92d8573ce4cdfdb9979a5544a72444082a6928e1836fd52d6afcaf78132bab166e2a227dde83a4bda14823e507b838370d09e2923db6388fef9
-
Filesize
324KB
MD5c1f4f4c8b5c1e95034c539eb94d4316a
SHA18bae8ed24d9d86daf76d70484845113fb62d71f7
SHA2560a06eecf84fedadb26b6bb30b185f4334d886bb7d4718d63414a966c8247900b
SHA51245c1a921f64ba92d8573ce4cdfdb9979a5544a72444082a6928e1836fd52d6afcaf78132bab166e2a227dde83a4bda14823e507b838370d09e2923db6388fef9
-
Filesize
324KB
MD5c1f4f4c8b5c1e95034c539eb94d4316a
SHA18bae8ed24d9d86daf76d70484845113fb62d71f7
SHA2560a06eecf84fedadb26b6bb30b185f4334d886bb7d4718d63414a966c8247900b
SHA51245c1a921f64ba92d8573ce4cdfdb9979a5544a72444082a6928e1836fd52d6afcaf78132bab166e2a227dde83a4bda14823e507b838370d09e2923db6388fef9
-
Filesize
324KB
MD5c1f4f4c8b5c1e95034c539eb94d4316a
SHA18bae8ed24d9d86daf76d70484845113fb62d71f7
SHA2560a06eecf84fedadb26b6bb30b185f4334d886bb7d4718d63414a966c8247900b
SHA51245c1a921f64ba92d8573ce4cdfdb9979a5544a72444082a6928e1836fd52d6afcaf78132bab166e2a227dde83a4bda14823e507b838370d09e2923db6388fef9
-
Filesize
324KB
MD5c1f4f4c8b5c1e95034c539eb94d4316a
SHA18bae8ed24d9d86daf76d70484845113fb62d71f7
SHA2560a06eecf84fedadb26b6bb30b185f4334d886bb7d4718d63414a966c8247900b
SHA51245c1a921f64ba92d8573ce4cdfdb9979a5544a72444082a6928e1836fd52d6afcaf78132bab166e2a227dde83a4bda14823e507b838370d09e2923db6388fef9