Analysis
- max time kernel
108s - max time network
59s - platform
windows10-1703_x64 - resource
win10-20220812-en - resource tags
- submitted
01/11/2022, 11:50
General
- Target 4f0630e7f242ce7993fdda5c1718c00dfc34074decb0a19023434b682ca7dd64.exe
- Size 324KB
- Sample221101-nzpcdscefl
- SHA256 4f0630e7f242ce7993fdda5c1718c00dfc34074decb0a19023434b682ca7dd64
Malware Config
Signatures
- Executes dropped EXE 5 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of WriteProcessMemory 36 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4f0630e7f242ce7993fdda5c1718c00dfc34074decb0a19023434b682ca7dd64.exe"C:\Users\Admin\AppData\Local\Temp\4f0630e7f242ce7993fdda5c1718c00dfc34074decb0a19023434b682ca7dd64.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4f0630e7f242ce7993fdda5c1718c00dfc34074decb0a19023434b682ca7dd64.exeC:\Users\Admin\AppData\Local\Temp\4f0630e7f242ce7993fdda5c1718c00dfc34074decb0a19023434b682ca7dd64.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
oobeldr.exe.log
oobeldr.exe
oobeldr.exe
oobeldr.exe
oobeldr.exe
oobeldr.exe
oobeldr.exe
memory/1728-188-0x0000000077580000-0x000000007770E000-memory.dmp
memory/1728-214-0x0000000000400000-0x0000000000406000-memory.dmp
memory/1728-175-0x0000000000400000-0x0000000000406000-memory.dmp
memory/1728-187-0x0000000077580000-0x000000007770E000-memory.dmp
memory/1728-186-0x0000000077580000-0x000000007770E000-memory.dmp
memory/1728-185-0x0000000077580000-0x000000007770E000-memory.dmp
memory/1728-184-0x0000000077580000-0x000000007770E000-memory.dmp
memory/1728-183-0x0000000077580000-0x000000007770E000-memory.dmp
memory/1728-181-0x0000000077580000-0x000000007770E000-memory.dmp
memory/1728-180-0x0000000077580000-0x000000007770E000-memory.dmp
memory/1728-178-0x0000000077580000-0x000000007770E000-memory.dmp
memory/1728-177-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-137-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-169-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-140-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-141-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-142-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-143-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-144-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-145-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-146-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-147-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-148-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-149-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-150-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-151-0x0000000000D00000-0x0000000000D56000-memory.dmp
memory/2500-152-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-153-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-154-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-155-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-157-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-156-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-158-0x0000000007A20000-0x0000000007AEC000-memory.dmp
memory/2500-159-0x0000000007FF0000-0x00000000084EE000-memory.dmp
memory/2500-160-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-161-0x0000000007B90000-0x0000000007C22000-memory.dmp
memory/2500-162-0x0000000005660000-0x0000000005666000-memory.dmp
memory/2500-163-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-164-0x0000000007E30000-0x0000000007EA6000-memory.dmp
memory/2500-165-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-166-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-167-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-168-0x0000000007B10000-0x0000000007B2E000-memory.dmp
memory/2500-139-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-170-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-171-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-172-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-173-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-174-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-138-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-117-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-136-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-135-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-179-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-134-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-133-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-132-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-131-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-129-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-130-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-128-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-127-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-118-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-126-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-125-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-124-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-123-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-122-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-121-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-119-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-120-0x0000000077580000-0x000000007770E000-memory.dmp