Analysis
-
max time kernel
124s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
01/11/2022, 11:44
Static task
static1
Behavioral task
behavioral1
Sample
2ae8e1985a2f4508df64fdd2865d07b8bcc49ac26c23100807be5b222c7ce2ec.exe
Resource
win10v2004-20220812-en
General
-
Target
2ae8e1985a2f4508df64fdd2865d07b8bcc49ac26c23100807be5b222c7ce2ec.exe
-
Size
324KB
-
MD5
eaea4edcd5e0e26f50be48625299187e
-
SHA1
9e16df8a2250695deacacb4c80c5068cc2eb9b4a
-
SHA256
2ae8e1985a2f4508df64fdd2865d07b8bcc49ac26c23100807be5b222c7ce2ec
-
SHA512
8638a1348425f0e480a34efc5b8319fd3c5052150866593a9fbb33b30a54656b536becbcb9008d85bf108f47bcb061b6bd5b102c1e384b3af4f08f18684205ec
-
SSDEEP
6144:eKlzr1sYCzek2ciDaP9Xk6Ln1W8W/9InBSkZZmLdGcAdgdY6RKpjS:eGhQ2ciDq9ZL1W8q9InBRqELdolRKpj
Malware Config
Signatures
-
Executes dropped EXE 6 IoCs
pid Process 3680 oobeldr.exe 484 oobeldr.exe 1528 oobeldr.exe 1416 oobeldr.exe 756 oobeldr.exe 3616 oobeldr.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1048 set thread context of 1560 1048 2ae8e1985a2f4508df64fdd2865d07b8bcc49ac26c23100807be5b222c7ce2ec.exe 83 PID 3680 set thread context of 1528 3680 oobeldr.exe 95 PID 1416 set thread context of 3616 1416 oobeldr.exe 100 -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4460 schtasks.exe 5048 schtasks.exe -
Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 1048 wrote to memory of 3108 1048 2ae8e1985a2f4508df64fdd2865d07b8bcc49ac26c23100807be5b222c7ce2ec.exe 82 PID 1048 wrote to memory of 3108 1048 2ae8e1985a2f4508df64fdd2865d07b8bcc49ac26c23100807be5b222c7ce2ec.exe 82 PID 1048 wrote to memory of 3108 1048 2ae8e1985a2f4508df64fdd2865d07b8bcc49ac26c23100807be5b222c7ce2ec.exe 82 PID 1048 wrote to memory of 1560 1048 2ae8e1985a2f4508df64fdd2865d07b8bcc49ac26c23100807be5b222c7ce2ec.exe 83 PID 1048 wrote to memory of 1560 1048 2ae8e1985a2f4508df64fdd2865d07b8bcc49ac26c23100807be5b222c7ce2ec.exe 83 PID 1048 wrote to memory of 1560 1048 2ae8e1985a2f4508df64fdd2865d07b8bcc49ac26c23100807be5b222c7ce2ec.exe 83 PID 1048 wrote to memory of 1560 1048 2ae8e1985a2f4508df64fdd2865d07b8bcc49ac26c23100807be5b222c7ce2ec.exe 83 PID 1048 wrote to memory of 1560 1048 2ae8e1985a2f4508df64fdd2865d07b8bcc49ac26c23100807be5b222c7ce2ec.exe 83 PID 1048 wrote to memory of 1560 1048 2ae8e1985a2f4508df64fdd2865d07b8bcc49ac26c23100807be5b222c7ce2ec.exe 83 PID 1048 wrote to memory of 1560 1048 2ae8e1985a2f4508df64fdd2865d07b8bcc49ac26c23100807be5b222c7ce2ec.exe 83 PID 1048 wrote to memory of 1560 1048 2ae8e1985a2f4508df64fdd2865d07b8bcc49ac26c23100807be5b222c7ce2ec.exe 83 PID 1048 wrote to memory of 1560 1048 2ae8e1985a2f4508df64fdd2865d07b8bcc49ac26c23100807be5b222c7ce2ec.exe 83 PID 1560 wrote to memory of 4460 1560 2ae8e1985a2f4508df64fdd2865d07b8bcc49ac26c23100807be5b222c7ce2ec.exe 84 PID 1560 wrote to memory of 4460 1560 2ae8e1985a2f4508df64fdd2865d07b8bcc49ac26c23100807be5b222c7ce2ec.exe 84 PID 1560 wrote to memory of 4460 1560 2ae8e1985a2f4508df64fdd2865d07b8bcc49ac26c23100807be5b222c7ce2ec.exe 84 PID 3680 wrote to memory of 484 3680 oobeldr.exe 94 PID 3680 wrote to memory of 484 3680 oobeldr.exe 94 PID 3680 wrote to memory of 484 3680 oobeldr.exe 94 PID 3680 wrote to memory of 1528 3680 oobeldr.exe 95 PID 3680 wrote to memory of 1528 3680 oobeldr.exe 95 PID 3680 wrote to memory of 1528 3680 oobeldr.exe 95 PID 3680 wrote to memory of 1528 3680 oobeldr.exe 95 PID 3680 wrote to memory of 1528 3680 oobeldr.exe 95 PID 3680 wrote to memory of 1528 3680 oobeldr.exe 95 PID 3680 wrote to memory of 1528 3680 oobeldr.exe 95 PID 3680 wrote to memory of 1528 3680 oobeldr.exe 95 PID 3680 wrote to memory of 1528 3680 oobeldr.exe 95 PID 1528 wrote to memory of 5048 1528 oobeldr.exe 96 PID 1528 wrote to memory of 5048 1528 oobeldr.exe 96 PID 1528 wrote to memory of 5048 1528 oobeldr.exe 96 PID 1416 wrote to memory of 756 1416 oobeldr.exe 99 PID 1416 wrote to memory of 756 1416 oobeldr.exe 99 PID 1416 wrote to memory of 756 1416 oobeldr.exe 99 PID 1416 wrote to memory of 3616 1416 oobeldr.exe 100 PID 1416 wrote to memory of 3616 1416 oobeldr.exe 100 PID 1416 wrote to memory of 3616 1416 oobeldr.exe 100 PID 1416 wrote to memory of 3616 1416 oobeldr.exe 100 PID 1416 wrote to memory of 3616 1416 oobeldr.exe 100 PID 1416 wrote to memory of 3616 1416 oobeldr.exe 100 PID 1416 wrote to memory of 3616 1416 oobeldr.exe 100 PID 1416 wrote to memory of 3616 1416 oobeldr.exe 100 PID 1416 wrote to memory of 3616 1416 oobeldr.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\2ae8e1985a2f4508df64fdd2865d07b8bcc49ac26c23100807be5b222c7ce2ec.exe"C:\Users\Admin\AppData\Local\Temp\2ae8e1985a2f4508df64fdd2865d07b8bcc49ac26c23100807be5b222c7ce2ec.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\2ae8e1985a2f4508df64fdd2865d07b8bcc49ac26c23100807be5b222c7ce2ec.exeC:\Users\Admin\AppData\Local\Temp\2ae8e1985a2f4508df64fdd2865d07b8bcc49ac26c23100807be5b222c7ce2ec.exe2⤵PID:3108
-
-
C:\Users\Admin\AppData\Local\Temp\2ae8e1985a2f4508df64fdd2865d07b8bcc49ac26c23100807be5b222c7ce2ec.exeC:\Users\Admin\AppData\Local\Temp\2ae8e1985a2f4508df64fdd2865d07b8bcc49ac26c23100807be5b222c7ce2ec.exe2⤵
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
PID:4460
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
PID:484
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
PID:5048
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
PID:756
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
PID:3616
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
789B
MD503d2df1e8834bc4ec1756735429b458c
SHA14ee6c0f5b04c8e0c5076219c5724032daab11d40
SHA256745ab70552d9a0463b791fd8dc1942838ac3e34fb1a68f09ed3766c7e3b05631
SHA5122482c3d4478125ccbc7f224f50e86b7bf925ed438b59f4dce57b9b6bcdb59df51417049096b131b6b911173550eed98bc92aba7050861de303a692f0681b197b
-
Filesize
324KB
MD5eaea4edcd5e0e26f50be48625299187e
SHA19e16df8a2250695deacacb4c80c5068cc2eb9b4a
SHA2562ae8e1985a2f4508df64fdd2865d07b8bcc49ac26c23100807be5b222c7ce2ec
SHA5128638a1348425f0e480a34efc5b8319fd3c5052150866593a9fbb33b30a54656b536becbcb9008d85bf108f47bcb061b6bd5b102c1e384b3af4f08f18684205ec
-
Filesize
324KB
MD5eaea4edcd5e0e26f50be48625299187e
SHA19e16df8a2250695deacacb4c80c5068cc2eb9b4a
SHA2562ae8e1985a2f4508df64fdd2865d07b8bcc49ac26c23100807be5b222c7ce2ec
SHA5128638a1348425f0e480a34efc5b8319fd3c5052150866593a9fbb33b30a54656b536becbcb9008d85bf108f47bcb061b6bd5b102c1e384b3af4f08f18684205ec
-
Filesize
324KB
MD5eaea4edcd5e0e26f50be48625299187e
SHA19e16df8a2250695deacacb4c80c5068cc2eb9b4a
SHA2562ae8e1985a2f4508df64fdd2865d07b8bcc49ac26c23100807be5b222c7ce2ec
SHA5128638a1348425f0e480a34efc5b8319fd3c5052150866593a9fbb33b30a54656b536becbcb9008d85bf108f47bcb061b6bd5b102c1e384b3af4f08f18684205ec
-
Filesize
324KB
MD5eaea4edcd5e0e26f50be48625299187e
SHA19e16df8a2250695deacacb4c80c5068cc2eb9b4a
SHA2562ae8e1985a2f4508df64fdd2865d07b8bcc49ac26c23100807be5b222c7ce2ec
SHA5128638a1348425f0e480a34efc5b8319fd3c5052150866593a9fbb33b30a54656b536becbcb9008d85bf108f47bcb061b6bd5b102c1e384b3af4f08f18684205ec
-
Filesize
324KB
MD5eaea4edcd5e0e26f50be48625299187e
SHA19e16df8a2250695deacacb4c80c5068cc2eb9b4a
SHA2562ae8e1985a2f4508df64fdd2865d07b8bcc49ac26c23100807be5b222c7ce2ec
SHA5128638a1348425f0e480a34efc5b8319fd3c5052150866593a9fbb33b30a54656b536becbcb9008d85bf108f47bcb061b6bd5b102c1e384b3af4f08f18684205ec
-
Filesize
324KB
MD5eaea4edcd5e0e26f50be48625299187e
SHA19e16df8a2250695deacacb4c80c5068cc2eb9b4a
SHA2562ae8e1985a2f4508df64fdd2865d07b8bcc49ac26c23100807be5b222c7ce2ec
SHA5128638a1348425f0e480a34efc5b8319fd3c5052150866593a9fbb33b30a54656b536becbcb9008d85bf108f47bcb061b6bd5b102c1e384b3af4f08f18684205ec
-
Filesize
324KB
MD5eaea4edcd5e0e26f50be48625299187e
SHA19e16df8a2250695deacacb4c80c5068cc2eb9b4a
SHA2562ae8e1985a2f4508df64fdd2865d07b8bcc49ac26c23100807be5b222c7ce2ec
SHA5128638a1348425f0e480a34efc5b8319fd3c5052150866593a9fbb33b30a54656b536becbcb9008d85bf108f47bcb061b6bd5b102c1e384b3af4f08f18684205ec