Analysis
- max time kernel
104s - max time network
62s - platform
windows10-1703_x64 - resource
win10-20220812-en - resource tags
- submitted
01/11/2022, 11:43
General
- Target 7d5422a80db68833db0400950143ced164fb240b19ede6baec0b0c3c59d6dac2.exe
- Size 324KB
- Sample221101-nvpscscebq
- SHA256 7d5422a80db68833db0400950143ced164fb240b19ede6baec0b0c3c59d6dac2
Malware Config
Signatures
- Executes dropped EXE 4 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of WriteProcessMemory 33 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7d5422a80db68833db0400950143ced164fb240b19ede6baec0b0c3c59d6dac2.exe"C:\Users\Admin\AppData\Local\Temp\7d5422a80db68833db0400950143ced164fb240b19ede6baec0b0c3c59d6dac2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7d5422a80db68833db0400950143ced164fb240b19ede6baec0b0c3c59d6dac2.exeC:\Users\Admin\AppData\Local\Temp\7d5422a80db68833db0400950143ced164fb240b19ede6baec0b0c3c59d6dac2.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
oobeldr.exe.log
oobeldr.exe
oobeldr.exe
oobeldr.exe
oobeldr.exe
oobeldr.exe
memory/2208-158-0x0000000077540000-0x00000000776CE000-memory.dmp
memory/2208-171-0x0000000007330000-0x000000000734E000-memory.dmp
memory/2208-126-0x0000000077540000-0x00000000776CE000-memory.dmp
memory/2208-127-0x0000000077540000-0x00000000776CE000-memory.dmp
memory/2208-128-0x0000000077540000-0x00000000776CE000-memory.dmp
memory/2208-129-0x0000000077540000-0x00000000776CE000-memory.dmp
memory/2208-130-0x0000000077540000-0x00000000776CE000-memory.dmp
memory/2208-131-0x0000000077540000-0x00000000776CE000-memory.dmp
memory/2208-132-0x0000000077540000-0x00000000776CE000-memory.dmp
memory/2208-133-0x0000000077540000-0x00000000776CE000-memory.dmp
memory/2208-134-0x0000000077540000-0x00000000776CE000-memory.dmp
memory/2208-135-0x0000000077540000-0x00000000776CE000-memory.dmp
memory/2208-160-0x0000000077540000-0x00000000776CE000-memory.dmp
memory/2208-137-0x0000000077540000-0x00000000776CE000-memory.dmp
memory/2208-138-0x0000000077540000-0x00000000776CE000-memory.dmp
memory/2208-140-0x0000000077540000-0x00000000776CE000-memory.dmp
memory/2208-139-0x0000000077540000-0x00000000776CE000-memory.dmp
memory/2208-141-0x0000000077540000-0x00000000776CE000-memory.dmp
memory/2208-143-0x0000000077540000-0x00000000776CE000-memory.dmp
memory/2208-142-0x0000000077540000-0x00000000776CE000-memory.dmp
memory/2208-144-0x0000000077540000-0x00000000776CE000-memory.dmp
memory/2208-145-0x0000000077540000-0x00000000776CE000-memory.dmp
memory/2208-146-0x0000000077540000-0x00000000776CE000-memory.dmp
memory/2208-147-0x0000000077540000-0x00000000776CE000-memory.dmp
memory/2208-148-0x0000000077540000-0x00000000776CE000-memory.dmp
memory/2208-149-0x0000000077540000-0x00000000776CE000-memory.dmp
memory/2208-150-0x0000000077540000-0x00000000776CE000-memory.dmp
memory/2208-151-0x0000000077540000-0x00000000776CE000-memory.dmp
memory/2208-152-0x0000000077540000-0x00000000776CE000-memory.dmp
memory/2208-153-0x0000000077540000-0x00000000776CE000-memory.dmp
memory/2208-154-0x0000000000510000-0x0000000000566000-memory.dmp
memory/2208-155-0x0000000077540000-0x00000000776CE000-memory.dmp
memory/2208-156-0x0000000077540000-0x00000000776CE000-memory.dmp
memory/2208-157-0x0000000077540000-0x00000000776CE000-memory.dmp
memory/2208-124-0x0000000077540000-0x00000000776CE000-memory.dmp
memory/2208-159-0x0000000077540000-0x00000000776CE000-memory.dmp
memory/2208-136-0x0000000077540000-0x00000000776CE000-memory.dmp
memory/2208-125-0x0000000077540000-0x00000000776CE000-memory.dmp
memory/2208-176-0x0000000077540000-0x00000000776CE000-memory.dmp
memory/2208-163-0x0000000077540000-0x00000000776CE000-memory.dmp
memory/2208-164-0x00000000073D0000-0x0000000007462000-memory.dmp
memory/2208-165-0x0000000004E40000-0x0000000004E46000-memory.dmp
memory/2208-166-0x0000000077540000-0x00000000776CE000-memory.dmp
memory/2208-167-0x0000000007670000-0x00000000076E6000-memory.dmp
memory/2208-168-0x0000000077540000-0x00000000776CE000-memory.dmp
memory/2208-169-0x0000000077540000-0x00000000776CE000-memory.dmp
memory/2208-170-0x0000000077540000-0x00000000776CE000-memory.dmp
memory/2208-161-0x0000000004CF0000-0x0000000004DBC000-memory.dmp
memory/2208-172-0x0000000077540000-0x00000000776CE000-memory.dmp
memory/2208-173-0x0000000077540000-0x00000000776CE000-memory.dmp
memory/2208-174-0x0000000077540000-0x00000000776CE000-memory.dmp
memory/2208-175-0x0000000077540000-0x00000000776CE000-memory.dmp
memory/2208-162-0x0000000007830000-0x0000000007D2E000-memory.dmp
memory/2208-177-0x0000000077540000-0x00000000776CE000-memory.dmp
memory/2208-186-0x0000000077540000-0x00000000776CE000-memory.dmp
memory/2208-120-0x0000000077540000-0x00000000776CE000-memory.dmp
memory/2208-121-0x0000000077540000-0x00000000776CE000-memory.dmp
memory/2208-122-0x0000000077540000-0x00000000776CE000-memory.dmp
memory/2208-123-0x0000000077540000-0x00000000776CE000-memory.dmp
memory/3780-231-0x0000000000400000-0x0000000000406000-memory.dmp
memory/3780-188-0x0000000077540000-0x00000000776CE000-memory.dmp
memory/3780-187-0x0000000077540000-0x00000000776CE000-memory.dmp
memory/3780-180-0x0000000077540000-0x00000000776CE000-memory.dmp
memory/3780-189-0x0000000077540000-0x00000000776CE000-memory.dmp
memory/3780-183-0x0000000077540000-0x00000000776CE000-memory.dmp
memory/3780-182-0x0000000077540000-0x00000000776CE000-memory.dmp
memory/3780-185-0x0000000077540000-0x00000000776CE000-memory.dmp
memory/3780-181-0x0000000077540000-0x00000000776CE000-memory.dmp
memory/3780-190-0x0000000077540000-0x00000000776CE000-memory.dmp
memory/3780-191-0x0000000077540000-0x00000000776CE000-memory.dmp
memory/3780-178-0x0000000000400000-0x0000000000406000-memory.dmp