Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
01/11/2022, 11:44
Static task
static1
Behavioral task
behavioral1
Sample
4b4c697645d19b2bfc0d2c4cf3bf60fe7f5406d67cd72c44636898396b57c87f.exe
Resource
win10v2004-20220812-en
General
-
Target
4b4c697645d19b2bfc0d2c4cf3bf60fe7f5406d67cd72c44636898396b57c87f.exe
-
Size
324KB
-
MD5
3f8d1dac50f07a02571960564b9b0f57
-
SHA1
4ebf6b8ca96bf0a5708772c59f20f4b9225d28d3
-
SHA256
4b4c697645d19b2bfc0d2c4cf3bf60fe7f5406d67cd72c44636898396b57c87f
-
SHA512
51cea8e195b6e635d04bee4820f9c33d12bf1d26d7ae448c6f77ffd00da4d9621f5e30e6161a34a8e8afb935ed225c75d0a9f059cc805706b91db50019a3a316
-
SSDEEP
6144:eKlzr1sYCzek2ciDaP9Xk6Ln1W8W/9InBSkZZmLdGcAdgdY6RKpjS:eGhQ2ciDq9ZL1W8q9InBRqELdolRKpj
Malware Config
Signatures
-
Executes dropped EXE 8 IoCs
pid Process 2608 oobeldr.exe 4260 oobeldr.exe 4356 oobeldr.exe 3100 oobeldr.exe 4432 oobeldr.exe 1800 oobeldr.exe 4252 oobeldr.exe 2400 oobeldr.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 4344 set thread context of 4784 4344 4b4c697645d19b2bfc0d2c4cf3bf60fe7f5406d67cd72c44636898396b57c87f.exe 84 PID 2608 set thread context of 4260 2608 oobeldr.exe 91 PID 4356 set thread context of 4432 4356 oobeldr.exe 97 -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4308 schtasks.exe 3128 schtasks.exe -
Suspicious use of WriteProcessMemory 48 IoCs
description pid Process procid_target PID 4344 wrote to memory of 392 4344 4b4c697645d19b2bfc0d2c4cf3bf60fe7f5406d67cd72c44636898396b57c87f.exe 80 PID 4344 wrote to memory of 392 4344 4b4c697645d19b2bfc0d2c4cf3bf60fe7f5406d67cd72c44636898396b57c87f.exe 80 PID 4344 wrote to memory of 392 4344 4b4c697645d19b2bfc0d2c4cf3bf60fe7f5406d67cd72c44636898396b57c87f.exe 80 PID 4344 wrote to memory of 4784 4344 4b4c697645d19b2bfc0d2c4cf3bf60fe7f5406d67cd72c44636898396b57c87f.exe 84 PID 4344 wrote to memory of 4784 4344 4b4c697645d19b2bfc0d2c4cf3bf60fe7f5406d67cd72c44636898396b57c87f.exe 84 PID 4344 wrote to memory of 4784 4344 4b4c697645d19b2bfc0d2c4cf3bf60fe7f5406d67cd72c44636898396b57c87f.exe 84 PID 4344 wrote to memory of 4784 4344 4b4c697645d19b2bfc0d2c4cf3bf60fe7f5406d67cd72c44636898396b57c87f.exe 84 PID 4344 wrote to memory of 4784 4344 4b4c697645d19b2bfc0d2c4cf3bf60fe7f5406d67cd72c44636898396b57c87f.exe 84 PID 4344 wrote to memory of 4784 4344 4b4c697645d19b2bfc0d2c4cf3bf60fe7f5406d67cd72c44636898396b57c87f.exe 84 PID 4344 wrote to memory of 4784 4344 4b4c697645d19b2bfc0d2c4cf3bf60fe7f5406d67cd72c44636898396b57c87f.exe 84 PID 4344 wrote to memory of 4784 4344 4b4c697645d19b2bfc0d2c4cf3bf60fe7f5406d67cd72c44636898396b57c87f.exe 84 PID 4344 wrote to memory of 4784 4344 4b4c697645d19b2bfc0d2c4cf3bf60fe7f5406d67cd72c44636898396b57c87f.exe 84 PID 4784 wrote to memory of 4308 4784 4b4c697645d19b2bfc0d2c4cf3bf60fe7f5406d67cd72c44636898396b57c87f.exe 86 PID 4784 wrote to memory of 4308 4784 4b4c697645d19b2bfc0d2c4cf3bf60fe7f5406d67cd72c44636898396b57c87f.exe 86 PID 4784 wrote to memory of 4308 4784 4b4c697645d19b2bfc0d2c4cf3bf60fe7f5406d67cd72c44636898396b57c87f.exe 86 PID 2608 wrote to memory of 4260 2608 oobeldr.exe 91 PID 2608 wrote to memory of 4260 2608 oobeldr.exe 91 PID 2608 wrote to memory of 4260 2608 oobeldr.exe 91 PID 2608 wrote to memory of 4260 2608 oobeldr.exe 91 PID 2608 wrote to memory of 4260 2608 oobeldr.exe 91 PID 2608 wrote to memory of 4260 2608 oobeldr.exe 91 PID 2608 wrote to memory of 4260 2608 oobeldr.exe 91 PID 2608 wrote to memory of 4260 2608 oobeldr.exe 91 PID 2608 wrote to memory of 4260 2608 oobeldr.exe 91 PID 4260 wrote to memory of 3128 4260 oobeldr.exe 92 PID 4260 wrote to memory of 3128 4260 oobeldr.exe 92 PID 4260 wrote to memory of 3128 4260 oobeldr.exe 92 PID 4356 wrote to memory of 3100 4356 oobeldr.exe 96 PID 4356 wrote to memory of 3100 4356 oobeldr.exe 96 PID 4356 wrote to memory of 3100 4356 oobeldr.exe 96 PID 4356 wrote to memory of 4432 4356 oobeldr.exe 97 PID 4356 wrote to memory of 4432 4356 oobeldr.exe 97 PID 4356 wrote to memory of 4432 4356 oobeldr.exe 97 PID 4356 wrote to memory of 4432 4356 oobeldr.exe 97 PID 4356 wrote to memory of 4432 4356 oobeldr.exe 97 PID 4356 wrote to memory of 4432 4356 oobeldr.exe 97 PID 4356 wrote to memory of 4432 4356 oobeldr.exe 97 PID 4356 wrote to memory of 4432 4356 oobeldr.exe 97 PID 4356 wrote to memory of 4432 4356 oobeldr.exe 97 PID 1800 wrote to memory of 4252 1800 oobeldr.exe 99 PID 1800 wrote to memory of 4252 1800 oobeldr.exe 99 PID 1800 wrote to memory of 4252 1800 oobeldr.exe 99 PID 1800 wrote to memory of 2400 1800 oobeldr.exe 100 PID 1800 wrote to memory of 2400 1800 oobeldr.exe 100 PID 1800 wrote to memory of 2400 1800 oobeldr.exe 100 PID 1800 wrote to memory of 1640 1800 oobeldr.exe 101 PID 1800 wrote to memory of 1640 1800 oobeldr.exe 101 PID 1800 wrote to memory of 1640 1800 oobeldr.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\4b4c697645d19b2bfc0d2c4cf3bf60fe7f5406d67cd72c44636898396b57c87f.exe"C:\Users\Admin\AppData\Local\Temp\4b4c697645d19b2bfc0d2c4cf3bf60fe7f5406d67cd72c44636898396b57c87f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\4b4c697645d19b2bfc0d2c4cf3bf60fe7f5406d67cd72c44636898396b57c87f.exeC:\Users\Admin\AppData\Local\Temp\4b4c697645d19b2bfc0d2c4cf3bf60fe7f5406d67cd72c44636898396b57c87f.exe2⤵PID:392
-
-
C:\Users\Admin\AppData\Local\Temp\4b4c697645d19b2bfc0d2c4cf3bf60fe7f5406d67cd72c44636898396b57c87f.exeC:\Users\Admin\AppData\Local\Temp\4b4c697645d19b2bfc0d2c4cf3bf60fe7f5406d67cd72c44636898396b57c87f.exe2⤵
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
PID:4308
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
PID:3128
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
PID:3100
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
PID:4432
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
PID:4252
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
PID:2400
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵PID:1640
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
789B
MD503d2df1e8834bc4ec1756735429b458c
SHA14ee6c0f5b04c8e0c5076219c5724032daab11d40
SHA256745ab70552d9a0463b791fd8dc1942838ac3e34fb1a68f09ed3766c7e3b05631
SHA5122482c3d4478125ccbc7f224f50e86b7bf925ed438b59f4dce57b9b6bcdb59df51417049096b131b6b911173550eed98bc92aba7050861de303a692f0681b197b
-
Filesize
324KB
MD53f8d1dac50f07a02571960564b9b0f57
SHA14ebf6b8ca96bf0a5708772c59f20f4b9225d28d3
SHA2564b4c697645d19b2bfc0d2c4cf3bf60fe7f5406d67cd72c44636898396b57c87f
SHA51251cea8e195b6e635d04bee4820f9c33d12bf1d26d7ae448c6f77ffd00da4d9621f5e30e6161a34a8e8afb935ed225c75d0a9f059cc805706b91db50019a3a316
-
Filesize
324KB
MD53f8d1dac50f07a02571960564b9b0f57
SHA14ebf6b8ca96bf0a5708772c59f20f4b9225d28d3
SHA2564b4c697645d19b2bfc0d2c4cf3bf60fe7f5406d67cd72c44636898396b57c87f
SHA51251cea8e195b6e635d04bee4820f9c33d12bf1d26d7ae448c6f77ffd00da4d9621f5e30e6161a34a8e8afb935ed225c75d0a9f059cc805706b91db50019a3a316
-
Filesize
324KB
MD53f8d1dac50f07a02571960564b9b0f57
SHA14ebf6b8ca96bf0a5708772c59f20f4b9225d28d3
SHA2564b4c697645d19b2bfc0d2c4cf3bf60fe7f5406d67cd72c44636898396b57c87f
SHA51251cea8e195b6e635d04bee4820f9c33d12bf1d26d7ae448c6f77ffd00da4d9621f5e30e6161a34a8e8afb935ed225c75d0a9f059cc805706b91db50019a3a316
-
Filesize
324KB
MD53f8d1dac50f07a02571960564b9b0f57
SHA14ebf6b8ca96bf0a5708772c59f20f4b9225d28d3
SHA2564b4c697645d19b2bfc0d2c4cf3bf60fe7f5406d67cd72c44636898396b57c87f
SHA51251cea8e195b6e635d04bee4820f9c33d12bf1d26d7ae448c6f77ffd00da4d9621f5e30e6161a34a8e8afb935ed225c75d0a9f059cc805706b91db50019a3a316
-
Filesize
324KB
MD53f8d1dac50f07a02571960564b9b0f57
SHA14ebf6b8ca96bf0a5708772c59f20f4b9225d28d3
SHA2564b4c697645d19b2bfc0d2c4cf3bf60fe7f5406d67cd72c44636898396b57c87f
SHA51251cea8e195b6e635d04bee4820f9c33d12bf1d26d7ae448c6f77ffd00da4d9621f5e30e6161a34a8e8afb935ed225c75d0a9f059cc805706b91db50019a3a316
-
Filesize
324KB
MD53f8d1dac50f07a02571960564b9b0f57
SHA14ebf6b8ca96bf0a5708772c59f20f4b9225d28d3
SHA2564b4c697645d19b2bfc0d2c4cf3bf60fe7f5406d67cd72c44636898396b57c87f
SHA51251cea8e195b6e635d04bee4820f9c33d12bf1d26d7ae448c6f77ffd00da4d9621f5e30e6161a34a8e8afb935ed225c75d0a9f059cc805706b91db50019a3a316
-
Filesize
324KB
MD53f8d1dac50f07a02571960564b9b0f57
SHA14ebf6b8ca96bf0a5708772c59f20f4b9225d28d3
SHA2564b4c697645d19b2bfc0d2c4cf3bf60fe7f5406d67cd72c44636898396b57c87f
SHA51251cea8e195b6e635d04bee4820f9c33d12bf1d26d7ae448c6f77ffd00da4d9621f5e30e6161a34a8e8afb935ed225c75d0a9f059cc805706b91db50019a3a316
-
Filesize
324KB
MD53f8d1dac50f07a02571960564b9b0f57
SHA14ebf6b8ca96bf0a5708772c59f20f4b9225d28d3
SHA2564b4c697645d19b2bfc0d2c4cf3bf60fe7f5406d67cd72c44636898396b57c87f
SHA51251cea8e195b6e635d04bee4820f9c33d12bf1d26d7ae448c6f77ffd00da4d9621f5e30e6161a34a8e8afb935ed225c75d0a9f059cc805706b91db50019a3a316
-
Filesize
324KB
MD53f8d1dac50f07a02571960564b9b0f57
SHA14ebf6b8ca96bf0a5708772c59f20f4b9225d28d3
SHA2564b4c697645d19b2bfc0d2c4cf3bf60fe7f5406d67cd72c44636898396b57c87f
SHA51251cea8e195b6e635d04bee4820f9c33d12bf1d26d7ae448c6f77ffd00da4d9621f5e30e6161a34a8e8afb935ed225c75d0a9f059cc805706b91db50019a3a316