Analysis
-
max time kernel
104s -
max time network
62s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
01/11/2022, 11:43
Static task
static1
Behavioral task
behavioral1
Sample
7d5422a80db68833db0400950143ced164fb240b19ede6baec0b0c3c59d6dac2.exe
Resource
win10-20220812-en
General
-
Target
7d5422a80db68833db0400950143ced164fb240b19ede6baec0b0c3c59d6dac2.exe
-
Size
324KB
-
MD5
fc2b4f3598f9ba20095ca681db0a1903
-
SHA1
7639bbc98df9ee811523d0871f1f3ee34cd5ea8f
-
SHA256
7d5422a80db68833db0400950143ced164fb240b19ede6baec0b0c3c59d6dac2
-
SHA512
404b5d074e30a4f2bd2f9f04a8777b878cd707c161691273666117d6c242ca56d7450820d21fb3f07ec0052228fd59c4a77cf2ece6e0992b1629973ff53d440d
-
SSDEEP
6144:eKlzr1sYCzek2ciDaP9Xk6Ln1W8W/9InBSkZZmLdGcAdgdY6RKpjS:eGhQ2ciDq9ZL1W8q9InBRqELdolRKpj
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 1512 oobeldr.exe 3212 oobeldr.exe 3900 oobeldr.exe 4652 oobeldr.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2208 set thread context of 3780 2208 7d5422a80db68833db0400950143ced164fb240b19ede6baec0b0c3c59d6dac2.exe 66 PID 1512 set thread context of 3212 1512 oobeldr.exe 70 PID 3900 set thread context of 4652 3900 oobeldr.exe 74 -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2236 schtasks.exe 3700 schtasks.exe -
Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 2208 wrote to memory of 3780 2208 7d5422a80db68833db0400950143ced164fb240b19ede6baec0b0c3c59d6dac2.exe 66 PID 2208 wrote to memory of 3780 2208 7d5422a80db68833db0400950143ced164fb240b19ede6baec0b0c3c59d6dac2.exe 66 PID 2208 wrote to memory of 3780 2208 7d5422a80db68833db0400950143ced164fb240b19ede6baec0b0c3c59d6dac2.exe 66 PID 2208 wrote to memory of 3780 2208 7d5422a80db68833db0400950143ced164fb240b19ede6baec0b0c3c59d6dac2.exe 66 PID 2208 wrote to memory of 3780 2208 7d5422a80db68833db0400950143ced164fb240b19ede6baec0b0c3c59d6dac2.exe 66 PID 2208 wrote to memory of 3780 2208 7d5422a80db68833db0400950143ced164fb240b19ede6baec0b0c3c59d6dac2.exe 66 PID 2208 wrote to memory of 3780 2208 7d5422a80db68833db0400950143ced164fb240b19ede6baec0b0c3c59d6dac2.exe 66 PID 2208 wrote to memory of 3780 2208 7d5422a80db68833db0400950143ced164fb240b19ede6baec0b0c3c59d6dac2.exe 66 PID 2208 wrote to memory of 3780 2208 7d5422a80db68833db0400950143ced164fb240b19ede6baec0b0c3c59d6dac2.exe 66 PID 3780 wrote to memory of 2236 3780 7d5422a80db68833db0400950143ced164fb240b19ede6baec0b0c3c59d6dac2.exe 67 PID 3780 wrote to memory of 2236 3780 7d5422a80db68833db0400950143ced164fb240b19ede6baec0b0c3c59d6dac2.exe 67 PID 3780 wrote to memory of 2236 3780 7d5422a80db68833db0400950143ced164fb240b19ede6baec0b0c3c59d6dac2.exe 67 PID 1512 wrote to memory of 3212 1512 oobeldr.exe 70 PID 1512 wrote to memory of 3212 1512 oobeldr.exe 70 PID 1512 wrote to memory of 3212 1512 oobeldr.exe 70 PID 1512 wrote to memory of 3212 1512 oobeldr.exe 70 PID 1512 wrote to memory of 3212 1512 oobeldr.exe 70 PID 1512 wrote to memory of 3212 1512 oobeldr.exe 70 PID 1512 wrote to memory of 3212 1512 oobeldr.exe 70 PID 1512 wrote to memory of 3212 1512 oobeldr.exe 70 PID 1512 wrote to memory of 3212 1512 oobeldr.exe 70 PID 3212 wrote to memory of 3700 3212 oobeldr.exe 71 PID 3212 wrote to memory of 3700 3212 oobeldr.exe 71 PID 3212 wrote to memory of 3700 3212 oobeldr.exe 71 PID 3900 wrote to memory of 4652 3900 oobeldr.exe 74 PID 3900 wrote to memory of 4652 3900 oobeldr.exe 74 PID 3900 wrote to memory of 4652 3900 oobeldr.exe 74 PID 3900 wrote to memory of 4652 3900 oobeldr.exe 74 PID 3900 wrote to memory of 4652 3900 oobeldr.exe 74 PID 3900 wrote to memory of 4652 3900 oobeldr.exe 74 PID 3900 wrote to memory of 4652 3900 oobeldr.exe 74 PID 3900 wrote to memory of 4652 3900 oobeldr.exe 74 PID 3900 wrote to memory of 4652 3900 oobeldr.exe 74
Processes
-
C:\Users\Admin\AppData\Local\Temp\7d5422a80db68833db0400950143ced164fb240b19ede6baec0b0c3c59d6dac2.exe"C:\Users\Admin\AppData\Local\Temp\7d5422a80db68833db0400950143ced164fb240b19ede6baec0b0c3c59d6dac2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\7d5422a80db68833db0400950143ced164fb240b19ede6baec0b0c3c59d6dac2.exeC:\Users\Admin\AppData\Local\Temp\7d5422a80db68833db0400950143ced164fb240b19ede6baec0b0c3c59d6dac2.exe2⤵
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
PID:2236
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
PID:3700
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
PID:4652
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
789B
MD5db5ef8d7c51bad129d9097bf953e4913
SHA18439db960aa2d431bf5ec3c37af775b45eb07e06
SHA2561248e67f10b47b397af3c8cbe342bad4be75c68b8e10f4ec6341195cc3138bd9
SHA51204572485790b25e1751347e43b47174051cd153dd75fd55ee5590d25a2579f344cd96cf86cf45bdb7759e3e6d0f734d0ff717148ca70f501b9869e964e036fee
-
Filesize
324KB
MD5fc2b4f3598f9ba20095ca681db0a1903
SHA17639bbc98df9ee811523d0871f1f3ee34cd5ea8f
SHA2567d5422a80db68833db0400950143ced164fb240b19ede6baec0b0c3c59d6dac2
SHA512404b5d074e30a4f2bd2f9f04a8777b878cd707c161691273666117d6c242ca56d7450820d21fb3f07ec0052228fd59c4a77cf2ece6e0992b1629973ff53d440d
-
Filesize
324KB
MD5fc2b4f3598f9ba20095ca681db0a1903
SHA17639bbc98df9ee811523d0871f1f3ee34cd5ea8f
SHA2567d5422a80db68833db0400950143ced164fb240b19ede6baec0b0c3c59d6dac2
SHA512404b5d074e30a4f2bd2f9f04a8777b878cd707c161691273666117d6c242ca56d7450820d21fb3f07ec0052228fd59c4a77cf2ece6e0992b1629973ff53d440d
-
Filesize
324KB
MD5fc2b4f3598f9ba20095ca681db0a1903
SHA17639bbc98df9ee811523d0871f1f3ee34cd5ea8f
SHA2567d5422a80db68833db0400950143ced164fb240b19ede6baec0b0c3c59d6dac2
SHA512404b5d074e30a4f2bd2f9f04a8777b878cd707c161691273666117d6c242ca56d7450820d21fb3f07ec0052228fd59c4a77cf2ece6e0992b1629973ff53d440d
-
Filesize
324KB
MD5fc2b4f3598f9ba20095ca681db0a1903
SHA17639bbc98df9ee811523d0871f1f3ee34cd5ea8f
SHA2567d5422a80db68833db0400950143ced164fb240b19ede6baec0b0c3c59d6dac2
SHA512404b5d074e30a4f2bd2f9f04a8777b878cd707c161691273666117d6c242ca56d7450820d21fb3f07ec0052228fd59c4a77cf2ece6e0992b1629973ff53d440d
-
Filesize
324KB
MD5fc2b4f3598f9ba20095ca681db0a1903
SHA17639bbc98df9ee811523d0871f1f3ee34cd5ea8f
SHA2567d5422a80db68833db0400950143ced164fb240b19ede6baec0b0c3c59d6dac2
SHA512404b5d074e30a4f2bd2f9f04a8777b878cd707c161691273666117d6c242ca56d7450820d21fb3f07ec0052228fd59c4a77cf2ece6e0992b1629973ff53d440d