Analysis
- max time kernel
145s - max time network
147s - platform
windows10-1703_x64 - resource
win10-20220812-en - resource tags
- submitted
01/11/2022, 11:48
General
- Target 3f475c3b7d7f3885c395aad53e6366e7c0220292ebeb3778e85333d544bb9d7d.exe
- Size 324KB
- Sample221101-nyfc4acedp
- SHA256 3f475c3b7d7f3885c395aad53e6366e7c0220292ebeb3778e85333d544bb9d7d
Malware Config
Signatures
- Suspicious use of SetThreadContext 1 IoCs
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3f475c3b7d7f3885c395aad53e6366e7c0220292ebeb3778e85333d544bb9d7d.exe"C:\Users\Admin\AppData\Local\Temp\3f475c3b7d7f3885c395aad53e6366e7c0220292ebeb3778e85333d544bb9d7d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3f475c3b7d7f3885c395aad53e6366e7c0220292ebeb3778e85333d544bb9d7d.exeC:\Users\Admin\AppData\Local\Temp\3f475c3b7d7f3885c395aad53e6366e7c0220292ebeb3778e85333d544bb9d7d.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\3f475c3b7d7f3885c395aad53e6366e7c0220292ebeb3778e85333d544bb9d7d.exeC:\Users\Admin\AppData\Local\Temp\3f475c3b7d7f3885c395aad53e6366e7c0220292ebeb3778e85333d544bb9d7d.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\3f475c3b7d7f3885c395aad53e6366e7c0220292ebeb3778e85333d544bb9d7d.exeC:\Users\Admin\AppData\Local\Temp\3f475c3b7d7f3885c395aad53e6366e7c0220292ebeb3778e85333d544bb9d7d.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4976-116-0x0000000077A00000-0x0000000077B8E000-memory.dmp
memory/4976-117-0x0000000077A00000-0x0000000077B8E000-memory.dmp
memory/4976-118-0x0000000077A00000-0x0000000077B8E000-memory.dmp
memory/4976-119-0x0000000077A00000-0x0000000077B8E000-memory.dmp
memory/4976-120-0x0000000077A00000-0x0000000077B8E000-memory.dmp
memory/4976-121-0x0000000077A00000-0x0000000077B8E000-memory.dmp
memory/4976-122-0x0000000077A00000-0x0000000077B8E000-memory.dmp
memory/4976-123-0x0000000077A00000-0x0000000077B8E000-memory.dmp
memory/4976-124-0x0000000077A00000-0x0000000077B8E000-memory.dmp
memory/4976-125-0x0000000077A00000-0x0000000077B8E000-memory.dmp
memory/4976-126-0x0000000077A00000-0x0000000077B8E000-memory.dmp
memory/4976-127-0x0000000077A00000-0x0000000077B8E000-memory.dmp
memory/4976-129-0x0000000077A00000-0x0000000077B8E000-memory.dmp
memory/4976-128-0x0000000077A00000-0x0000000077B8E000-memory.dmp
memory/4976-130-0x0000000077A00000-0x0000000077B8E000-memory.dmp
memory/4976-131-0x0000000077A00000-0x0000000077B8E000-memory.dmp
memory/4976-132-0x0000000077A00000-0x0000000077B8E000-memory.dmp
memory/4976-133-0x0000000077A00000-0x0000000077B8E000-memory.dmp
memory/4976-134-0x0000000077A00000-0x0000000077B8E000-memory.dmp
memory/4976-135-0x0000000077A00000-0x0000000077B8E000-memory.dmp
memory/4976-136-0x0000000077A00000-0x0000000077B8E000-memory.dmp
memory/4976-138-0x0000000077A00000-0x0000000077B8E000-memory.dmp
memory/4976-139-0x0000000077A00000-0x0000000077B8E000-memory.dmp
memory/4976-137-0x0000000077A00000-0x0000000077B8E000-memory.dmp
memory/4976-140-0x0000000077A00000-0x0000000077B8E000-memory.dmp
memory/4976-141-0x0000000077A00000-0x0000000077B8E000-memory.dmp
memory/4976-142-0x0000000077A00000-0x0000000077B8E000-memory.dmp
memory/4976-143-0x0000000077A00000-0x0000000077B8E000-memory.dmp
memory/4976-144-0x0000000077A00000-0x0000000077B8E000-memory.dmp
memory/4976-145-0x0000000077A00000-0x0000000077B8E000-memory.dmp
memory/4976-146-0x0000000077A00000-0x0000000077B8E000-memory.dmp
memory/4976-147-0x0000000077A00000-0x0000000077B8E000-memory.dmp
memory/4976-148-0x0000000077A00000-0x0000000077B8E000-memory.dmp
memory/4976-149-0x0000000077A00000-0x0000000077B8E000-memory.dmp
memory/4976-150-0x0000000000D60000-0x0000000000DB6000-memory.dmp
memory/4976-151-0x0000000077A00000-0x0000000077B8E000-memory.dmp
memory/4976-152-0x0000000077A00000-0x0000000077B8E000-memory.dmp
memory/4976-153-0x0000000077A00000-0x0000000077B8E000-memory.dmp
memory/4976-154-0x0000000077A00000-0x0000000077B8E000-memory.dmp
memory/4976-155-0x0000000077A00000-0x0000000077B8E000-memory.dmp
memory/4976-156-0x0000000077A00000-0x0000000077B8E000-memory.dmp
memory/4976-157-0x0000000007C40000-0x0000000007D0C000-memory.dmp
memory/4976-158-0x0000000008210000-0x000000000870E000-memory.dmp
memory/4976-159-0x0000000077A00000-0x0000000077B8E000-memory.dmp
memory/4976-160-0x0000000007D10000-0x0000000007DA2000-memory.dmp
memory/4976-161-0x00000000056C0000-0x00000000056C6000-memory.dmp
memory/4976-162-0x0000000077A00000-0x0000000077B8E000-memory.dmp
memory/4976-163-0x0000000008030000-0x00000000080A6000-memory.dmp
memory/4976-164-0x0000000077A00000-0x0000000077B8E000-memory.dmp
memory/4976-166-0x0000000077A00000-0x0000000077B8E000-memory.dmp
memory/4976-165-0x0000000077A00000-0x0000000077B8E000-memory.dmp
memory/4976-167-0x0000000005710000-0x000000000572E000-memory.dmp
memory/4976-169-0x0000000077A00000-0x0000000077B8E000-memory.dmp
memory/4976-168-0x0000000077A00000-0x0000000077B8E000-memory.dmp
memory/4976-170-0x0000000077A00000-0x0000000077B8E000-memory.dmp
memory/4976-171-0x0000000077A00000-0x0000000077B8E000-memory.dmp
memory/4976-172-0x0000000077A00000-0x0000000077B8E000-memory.dmp
memory/4976-173-0x0000000077A00000-0x0000000077B8E000-memory.dmp
memory/4976-180-0x0000000077A00000-0x0000000077B8E000-memory.dmp
memory/5016-174-0x0000000000400000-0x0000000000406000-memory.dmp
memory/5016-176-0x0000000077A00000-0x0000000077B8E000-memory.dmp
memory/5016-177-0x0000000077A00000-0x0000000077B8E000-memory.dmp
memory/5016-178-0x0000000077A00000-0x0000000077B8E000-memory.dmp
memory/5016-179-0x0000000077A00000-0x0000000077B8E000-memory.dmp
memory/5016-182-0x0000000077A00000-0x0000000077B8E000-memory.dmp
memory/5016-183-0x0000000077A00000-0x0000000077B8E000-memory.dmp
memory/5016-184-0x0000000077A00000-0x0000000077B8E000-memory.dmp
memory/5016-185-0x0000000077A00000-0x0000000077B8E000-memory.dmp
memory/5016-186-0x0000000077A00000-0x0000000077B8E000-memory.dmp
memory/5016-187-0x0000000077A00000-0x0000000077B8E000-memory.dmp
memory/5016-228-0x0000000000400000-0x0000000000406000-memory.dmp