Analysis
-
max time kernel
147s -
max time network
102s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
01/11/2022, 11:43
Static task
static1
Behavioral task
behavioral1
Sample
2ec74582c87c54f18968a1251ffe040d74a25d2b8c30be71c493f7bc0b31e22a.exe
Resource
win10-20220812-en
General
-
Target
2ec74582c87c54f18968a1251ffe040d74a25d2b8c30be71c493f7bc0b31e22a.exe
-
Size
324KB
-
MD5
f0578e7e2a9ab0327f1ebf4fbcbb5f66
-
SHA1
9b2a3f5a1f704f2629163594d4a4451fe51163a6
-
SHA256
2ec74582c87c54f18968a1251ffe040d74a25d2b8c30be71c493f7bc0b31e22a
-
SHA512
c8761469848b8ccefabb59b7fb783c72aa70a08d335015df64d59811b84d8667e77db7881ccc34174a4135018464b565e2a74bd8d9aa67b3cce8da5cb8340793
-
SSDEEP
6144:eKlzr1sYCzek2ciDaP9Xk6Ln1W8W/9InBSkZZmLdGcAdgdY6RKpjS:eGhQ2ciDq9ZL1W8q9InBRqELdolRKpj
Malware Config
Signatures
-
Executes dropped EXE 8 IoCs
pid Process 1132 oobeldr.exe 4224 oobeldr.exe 4708 oobeldr.exe 612 oobeldr.exe 3344 oobeldr.exe 2872 oobeldr.exe 4028 oobeldr.exe 2620 oobeldr.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 2760 set thread context of 2816 2760 2ec74582c87c54f18968a1251ffe040d74a25d2b8c30be71c493f7bc0b31e22a.exe 66 PID 1132 set thread context of 4224 1132 oobeldr.exe 70 PID 4708 set thread context of 612 4708 oobeldr.exe 74 PID 3344 set thread context of 2620 3344 oobeldr.exe 78 -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3220 schtasks.exe 3332 schtasks.exe -
Suspicious use of WriteProcessMemory 48 IoCs
description pid Process procid_target PID 2760 wrote to memory of 2816 2760 2ec74582c87c54f18968a1251ffe040d74a25d2b8c30be71c493f7bc0b31e22a.exe 66 PID 2760 wrote to memory of 2816 2760 2ec74582c87c54f18968a1251ffe040d74a25d2b8c30be71c493f7bc0b31e22a.exe 66 PID 2760 wrote to memory of 2816 2760 2ec74582c87c54f18968a1251ffe040d74a25d2b8c30be71c493f7bc0b31e22a.exe 66 PID 2760 wrote to memory of 2816 2760 2ec74582c87c54f18968a1251ffe040d74a25d2b8c30be71c493f7bc0b31e22a.exe 66 PID 2760 wrote to memory of 2816 2760 2ec74582c87c54f18968a1251ffe040d74a25d2b8c30be71c493f7bc0b31e22a.exe 66 PID 2760 wrote to memory of 2816 2760 2ec74582c87c54f18968a1251ffe040d74a25d2b8c30be71c493f7bc0b31e22a.exe 66 PID 2760 wrote to memory of 2816 2760 2ec74582c87c54f18968a1251ffe040d74a25d2b8c30be71c493f7bc0b31e22a.exe 66 PID 2760 wrote to memory of 2816 2760 2ec74582c87c54f18968a1251ffe040d74a25d2b8c30be71c493f7bc0b31e22a.exe 66 PID 2760 wrote to memory of 2816 2760 2ec74582c87c54f18968a1251ffe040d74a25d2b8c30be71c493f7bc0b31e22a.exe 66 PID 2816 wrote to memory of 3220 2816 2ec74582c87c54f18968a1251ffe040d74a25d2b8c30be71c493f7bc0b31e22a.exe 67 PID 2816 wrote to memory of 3220 2816 2ec74582c87c54f18968a1251ffe040d74a25d2b8c30be71c493f7bc0b31e22a.exe 67 PID 2816 wrote to memory of 3220 2816 2ec74582c87c54f18968a1251ffe040d74a25d2b8c30be71c493f7bc0b31e22a.exe 67 PID 1132 wrote to memory of 4224 1132 oobeldr.exe 70 PID 1132 wrote to memory of 4224 1132 oobeldr.exe 70 PID 1132 wrote to memory of 4224 1132 oobeldr.exe 70 PID 1132 wrote to memory of 4224 1132 oobeldr.exe 70 PID 1132 wrote to memory of 4224 1132 oobeldr.exe 70 PID 1132 wrote to memory of 4224 1132 oobeldr.exe 70 PID 1132 wrote to memory of 4224 1132 oobeldr.exe 70 PID 1132 wrote to memory of 4224 1132 oobeldr.exe 70 PID 1132 wrote to memory of 4224 1132 oobeldr.exe 70 PID 4224 wrote to memory of 3332 4224 oobeldr.exe 71 PID 4224 wrote to memory of 3332 4224 oobeldr.exe 71 PID 4224 wrote to memory of 3332 4224 oobeldr.exe 71 PID 4708 wrote to memory of 612 4708 oobeldr.exe 74 PID 4708 wrote to memory of 612 4708 oobeldr.exe 74 PID 4708 wrote to memory of 612 4708 oobeldr.exe 74 PID 4708 wrote to memory of 612 4708 oobeldr.exe 74 PID 4708 wrote to memory of 612 4708 oobeldr.exe 74 PID 4708 wrote to memory of 612 4708 oobeldr.exe 74 PID 4708 wrote to memory of 612 4708 oobeldr.exe 74 PID 4708 wrote to memory of 612 4708 oobeldr.exe 74 PID 4708 wrote to memory of 612 4708 oobeldr.exe 74 PID 3344 wrote to memory of 2872 3344 oobeldr.exe 76 PID 3344 wrote to memory of 2872 3344 oobeldr.exe 76 PID 3344 wrote to memory of 2872 3344 oobeldr.exe 76 PID 3344 wrote to memory of 4028 3344 oobeldr.exe 77 PID 3344 wrote to memory of 4028 3344 oobeldr.exe 77 PID 3344 wrote to memory of 4028 3344 oobeldr.exe 77 PID 3344 wrote to memory of 2620 3344 oobeldr.exe 78 PID 3344 wrote to memory of 2620 3344 oobeldr.exe 78 PID 3344 wrote to memory of 2620 3344 oobeldr.exe 78 PID 3344 wrote to memory of 2620 3344 oobeldr.exe 78 PID 3344 wrote to memory of 2620 3344 oobeldr.exe 78 PID 3344 wrote to memory of 2620 3344 oobeldr.exe 78 PID 3344 wrote to memory of 2620 3344 oobeldr.exe 78 PID 3344 wrote to memory of 2620 3344 oobeldr.exe 78 PID 3344 wrote to memory of 2620 3344 oobeldr.exe 78
Processes
-
C:\Users\Admin\AppData\Local\Temp\2ec74582c87c54f18968a1251ffe040d74a25d2b8c30be71c493f7bc0b31e22a.exe"C:\Users\Admin\AppData\Local\Temp\2ec74582c87c54f18968a1251ffe040d74a25d2b8c30be71c493f7bc0b31e22a.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\2ec74582c87c54f18968a1251ffe040d74a25d2b8c30be71c493f7bc0b31e22a.exeC:\Users\Admin\AppData\Local\Temp\2ec74582c87c54f18968a1251ffe040d74a25d2b8c30be71c493f7bc0b31e22a.exe2⤵
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
PID:3220
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
PID:3332
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
PID:612
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
PID:2872
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
PID:4028
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
PID:2620
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
789B
MD5db5ef8d7c51bad129d9097bf953e4913
SHA18439db960aa2d431bf5ec3c37af775b45eb07e06
SHA2561248e67f10b47b397af3c8cbe342bad4be75c68b8e10f4ec6341195cc3138bd9
SHA51204572485790b25e1751347e43b47174051cd153dd75fd55ee5590d25a2579f344cd96cf86cf45bdb7759e3e6d0f734d0ff717148ca70f501b9869e964e036fee
-
Filesize
324KB
MD5f0578e7e2a9ab0327f1ebf4fbcbb5f66
SHA19b2a3f5a1f704f2629163594d4a4451fe51163a6
SHA2562ec74582c87c54f18968a1251ffe040d74a25d2b8c30be71c493f7bc0b31e22a
SHA512c8761469848b8ccefabb59b7fb783c72aa70a08d335015df64d59811b84d8667e77db7881ccc34174a4135018464b565e2a74bd8d9aa67b3cce8da5cb8340793
-
Filesize
324KB
MD5f0578e7e2a9ab0327f1ebf4fbcbb5f66
SHA19b2a3f5a1f704f2629163594d4a4451fe51163a6
SHA2562ec74582c87c54f18968a1251ffe040d74a25d2b8c30be71c493f7bc0b31e22a
SHA512c8761469848b8ccefabb59b7fb783c72aa70a08d335015df64d59811b84d8667e77db7881ccc34174a4135018464b565e2a74bd8d9aa67b3cce8da5cb8340793
-
Filesize
324KB
MD5f0578e7e2a9ab0327f1ebf4fbcbb5f66
SHA19b2a3f5a1f704f2629163594d4a4451fe51163a6
SHA2562ec74582c87c54f18968a1251ffe040d74a25d2b8c30be71c493f7bc0b31e22a
SHA512c8761469848b8ccefabb59b7fb783c72aa70a08d335015df64d59811b84d8667e77db7881ccc34174a4135018464b565e2a74bd8d9aa67b3cce8da5cb8340793
-
Filesize
324KB
MD5f0578e7e2a9ab0327f1ebf4fbcbb5f66
SHA19b2a3f5a1f704f2629163594d4a4451fe51163a6
SHA2562ec74582c87c54f18968a1251ffe040d74a25d2b8c30be71c493f7bc0b31e22a
SHA512c8761469848b8ccefabb59b7fb783c72aa70a08d335015df64d59811b84d8667e77db7881ccc34174a4135018464b565e2a74bd8d9aa67b3cce8da5cb8340793
-
Filesize
324KB
MD5f0578e7e2a9ab0327f1ebf4fbcbb5f66
SHA19b2a3f5a1f704f2629163594d4a4451fe51163a6
SHA2562ec74582c87c54f18968a1251ffe040d74a25d2b8c30be71c493f7bc0b31e22a
SHA512c8761469848b8ccefabb59b7fb783c72aa70a08d335015df64d59811b84d8667e77db7881ccc34174a4135018464b565e2a74bd8d9aa67b3cce8da5cb8340793
-
Filesize
324KB
MD5f0578e7e2a9ab0327f1ebf4fbcbb5f66
SHA19b2a3f5a1f704f2629163594d4a4451fe51163a6
SHA2562ec74582c87c54f18968a1251ffe040d74a25d2b8c30be71c493f7bc0b31e22a
SHA512c8761469848b8ccefabb59b7fb783c72aa70a08d335015df64d59811b84d8667e77db7881ccc34174a4135018464b565e2a74bd8d9aa67b3cce8da5cb8340793
-
Filesize
324KB
MD5f0578e7e2a9ab0327f1ebf4fbcbb5f66
SHA19b2a3f5a1f704f2629163594d4a4451fe51163a6
SHA2562ec74582c87c54f18968a1251ffe040d74a25d2b8c30be71c493f7bc0b31e22a
SHA512c8761469848b8ccefabb59b7fb783c72aa70a08d335015df64d59811b84d8667e77db7881ccc34174a4135018464b565e2a74bd8d9aa67b3cce8da5cb8340793
-
Filesize
324KB
MD5f0578e7e2a9ab0327f1ebf4fbcbb5f66
SHA19b2a3f5a1f704f2629163594d4a4451fe51163a6
SHA2562ec74582c87c54f18968a1251ffe040d74a25d2b8c30be71c493f7bc0b31e22a
SHA512c8761469848b8ccefabb59b7fb783c72aa70a08d335015df64d59811b84d8667e77db7881ccc34174a4135018464b565e2a74bd8d9aa67b3cce8da5cb8340793
-
Filesize
324KB
MD5f0578e7e2a9ab0327f1ebf4fbcbb5f66
SHA19b2a3f5a1f704f2629163594d4a4451fe51163a6
SHA2562ec74582c87c54f18968a1251ffe040d74a25d2b8c30be71c493f7bc0b31e22a
SHA512c8761469848b8ccefabb59b7fb783c72aa70a08d335015df64d59811b84d8667e77db7881ccc34174a4135018464b565e2a74bd8d9aa67b3cce8da5cb8340793