Analysis

  • max time kernel
    134s
  • max time network
    146s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    01-11-2022 19:31

General

  • Target

    c27e4e6fe14921b13d50a4b152c302dedc009e0218d96819138ab1b04c4dafb1.exe

  • Size

    325KB

  • MD5

    1a1805e61c9605fa12406427be99616c

  • SHA1

    8c02ae4fc2e65d77355b26018a40cb3b23e44b76

  • SHA256

    c27e4e6fe14921b13d50a4b152c302dedc009e0218d96819138ab1b04c4dafb1

  • SHA512

    97f08eec62c261960e25676fa88631e3e63c682f75e1d44bc2da53b7796651f42402e420c520114432ef9cc5c2b9cb22e4c54c016bf6bf1d73dec1487502bed7

  • SSDEEP

    6144:eKlzr1sYCzek2ciDaP9Xk6Ln1W8W/9InBSkZZmLdGcAdgdY6RKpjS:eGhQ2ciDq9ZL1W8q9InBRqELdolRKpj

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 4 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c27e4e6fe14921b13d50a4b152c302dedc009e0218d96819138ab1b04c4dafb1.exe
    "C:\Users\Admin\AppData\Local\Temp\c27e4e6fe14921b13d50a4b152c302dedc009e0218d96819138ab1b04c4dafb1.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2660
    • C:\Users\Admin\AppData\Local\Temp\c27e4e6fe14921b13d50a4b152c302dedc009e0218d96819138ab1b04c4dafb1.exe
      C:\Users\Admin\AppData\Local\Temp\c27e4e6fe14921b13d50a4b152c302dedc009e0218d96819138ab1b04c4dafb1.exe
      2⤵
        PID:3368
      • C:\Users\Admin\AppData\Local\Temp\c27e4e6fe14921b13d50a4b152c302dedc009e0218d96819138ab1b04c4dafb1.exe
        C:\Users\Admin\AppData\Local\Temp\c27e4e6fe14921b13d50a4b152c302dedc009e0218d96819138ab1b04c4dafb1.exe
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4640
        • C:\Windows\SysWOW64\schtasks.exe
          /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
          3⤵
          • Creates scheduled task(s)
          PID:4624
    • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:4080
      • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
        2⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3876
        • C:\Windows\SysWOW64\schtasks.exe
          /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
          3⤵
          • Creates scheduled task(s)
          PID:4540
    • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:5060
      • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
        2⤵
        • Executes dropped EXE
        PID:4960

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\oobeldr.exe.log

      Filesize

      789B

      MD5

      db5ef8d7c51bad129d9097bf953e4913

      SHA1

      8439db960aa2d431bf5ec3c37af775b45eb07e06

      SHA256

      1248e67f10b47b397af3c8cbe342bad4be75c68b8e10f4ec6341195cc3138bd9

      SHA512

      04572485790b25e1751347e43b47174051cd153dd75fd55ee5590d25a2579f344cd96cf86cf45bdb7759e3e6d0f734d0ff717148ca70f501b9869e964e036fee

    • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe

      Filesize

      325KB

      MD5

      1a1805e61c9605fa12406427be99616c

      SHA1

      8c02ae4fc2e65d77355b26018a40cb3b23e44b76

      SHA256

      c27e4e6fe14921b13d50a4b152c302dedc009e0218d96819138ab1b04c4dafb1

      SHA512

      97f08eec62c261960e25676fa88631e3e63c682f75e1d44bc2da53b7796651f42402e420c520114432ef9cc5c2b9cb22e4c54c016bf6bf1d73dec1487502bed7

    • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe

      Filesize

      325KB

      MD5

      1a1805e61c9605fa12406427be99616c

      SHA1

      8c02ae4fc2e65d77355b26018a40cb3b23e44b76

      SHA256

      c27e4e6fe14921b13d50a4b152c302dedc009e0218d96819138ab1b04c4dafb1

      SHA512

      97f08eec62c261960e25676fa88631e3e63c682f75e1d44bc2da53b7796651f42402e420c520114432ef9cc5c2b9cb22e4c54c016bf6bf1d73dec1487502bed7

    • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe

      Filesize

      325KB

      MD5

      1a1805e61c9605fa12406427be99616c

      SHA1

      8c02ae4fc2e65d77355b26018a40cb3b23e44b76

      SHA256

      c27e4e6fe14921b13d50a4b152c302dedc009e0218d96819138ab1b04c4dafb1

      SHA512

      97f08eec62c261960e25676fa88631e3e63c682f75e1d44bc2da53b7796651f42402e420c520114432ef9cc5c2b9cb22e4c54c016bf6bf1d73dec1487502bed7

    • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe

      Filesize

      325KB

      MD5

      1a1805e61c9605fa12406427be99616c

      SHA1

      8c02ae4fc2e65d77355b26018a40cb3b23e44b76

      SHA256

      c27e4e6fe14921b13d50a4b152c302dedc009e0218d96819138ab1b04c4dafb1

      SHA512

      97f08eec62c261960e25676fa88631e3e63c682f75e1d44bc2da53b7796651f42402e420c520114432ef9cc5c2b9cb22e4c54c016bf6bf1d73dec1487502bed7

    • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe

      Filesize

      325KB

      MD5

      1a1805e61c9605fa12406427be99616c

      SHA1

      8c02ae4fc2e65d77355b26018a40cb3b23e44b76

      SHA256

      c27e4e6fe14921b13d50a4b152c302dedc009e0218d96819138ab1b04c4dafb1

      SHA512

      97f08eec62c261960e25676fa88631e3e63c682f75e1d44bc2da53b7796651f42402e420c520114432ef9cc5c2b9cb22e4c54c016bf6bf1d73dec1487502bed7

    • memory/2660-157-0x0000000077730000-0x00000000778BE000-memory.dmp

      Filesize

      1.6MB

    • memory/2660-185-0x0000000077730000-0x00000000778BE000-memory.dmp

      Filesize

      1.6MB

    • memory/2660-125-0x0000000077730000-0x00000000778BE000-memory.dmp

      Filesize

      1.6MB

    • memory/2660-126-0x0000000077730000-0x00000000778BE000-memory.dmp

      Filesize

      1.6MB

    • memory/2660-127-0x0000000077730000-0x00000000778BE000-memory.dmp

      Filesize

      1.6MB

    • memory/2660-128-0x0000000077730000-0x00000000778BE000-memory.dmp

      Filesize

      1.6MB

    • memory/2660-129-0x0000000077730000-0x00000000778BE000-memory.dmp

      Filesize

      1.6MB

    • memory/2660-130-0x0000000077730000-0x00000000778BE000-memory.dmp

      Filesize

      1.6MB

    • memory/2660-131-0x0000000077730000-0x00000000778BE000-memory.dmp

      Filesize

      1.6MB

    • memory/2660-132-0x0000000077730000-0x00000000778BE000-memory.dmp

      Filesize

      1.6MB

    • memory/2660-133-0x0000000077730000-0x00000000778BE000-memory.dmp

      Filesize

      1.6MB

    • memory/2660-134-0x0000000077730000-0x00000000778BE000-memory.dmp

      Filesize

      1.6MB

    • memory/2660-135-0x0000000077730000-0x00000000778BE000-memory.dmp

      Filesize

      1.6MB

    • memory/2660-136-0x0000000077730000-0x00000000778BE000-memory.dmp

      Filesize

      1.6MB

    • memory/2660-137-0x0000000077730000-0x00000000778BE000-memory.dmp

      Filesize

      1.6MB

    • memory/2660-138-0x0000000077730000-0x00000000778BE000-memory.dmp

      Filesize

      1.6MB

    • memory/2660-139-0x0000000077730000-0x00000000778BE000-memory.dmp

      Filesize

      1.6MB

    • memory/2660-140-0x0000000077730000-0x00000000778BE000-memory.dmp

      Filesize

      1.6MB

    • memory/2660-141-0x0000000077730000-0x00000000778BE000-memory.dmp

      Filesize

      1.6MB

    • memory/2660-142-0x0000000077730000-0x00000000778BE000-memory.dmp

      Filesize

      1.6MB

    • memory/2660-143-0x0000000077730000-0x00000000778BE000-memory.dmp

      Filesize

      1.6MB

    • memory/2660-144-0x0000000077730000-0x00000000778BE000-memory.dmp

      Filesize

      1.6MB

    • memory/2660-145-0x0000000077730000-0x00000000778BE000-memory.dmp

      Filesize

      1.6MB

    • memory/2660-146-0x0000000077730000-0x00000000778BE000-memory.dmp

      Filesize

      1.6MB

    • memory/2660-147-0x0000000077730000-0x00000000778BE000-memory.dmp

      Filesize

      1.6MB

    • memory/2660-148-0x0000000077730000-0x00000000778BE000-memory.dmp

      Filesize

      1.6MB

    • memory/2660-149-0x0000000077730000-0x00000000778BE000-memory.dmp

      Filesize

      1.6MB

    • memory/2660-150-0x0000000077730000-0x00000000778BE000-memory.dmp

      Filesize

      1.6MB

    • memory/2660-151-0x0000000077730000-0x00000000778BE000-memory.dmp

      Filesize

      1.6MB

    • memory/2660-152-0x0000000077730000-0x00000000778BE000-memory.dmp

      Filesize

      1.6MB

    • memory/2660-153-0x0000000077730000-0x00000000778BE000-memory.dmp

      Filesize

      1.6MB

    • memory/2660-154-0x0000000000C60000-0x0000000000CB6000-memory.dmp

      Filesize

      344KB

    • memory/2660-155-0x0000000077730000-0x00000000778BE000-memory.dmp

      Filesize

      1.6MB

    • memory/2660-156-0x0000000077730000-0x00000000778BE000-memory.dmp

      Filesize

      1.6MB

    • memory/2660-123-0x0000000077730000-0x00000000778BE000-memory.dmp

      Filesize

      1.6MB

    • memory/2660-158-0x0000000077730000-0x00000000778BE000-memory.dmp

      Filesize

      1.6MB

    • memory/2660-171-0x0000000007A80000-0x0000000007A9E000-memory.dmp

      Filesize

      120KB

    • memory/2660-120-0x0000000077730000-0x00000000778BE000-memory.dmp

      Filesize

      1.6MB

    • memory/2660-160-0x0000000077730000-0x00000000778BE000-memory.dmp

      Filesize

      1.6MB

    • memory/2660-162-0x0000000007F60000-0x000000000845E000-memory.dmp

      Filesize

      5.0MB

    • memory/2660-163-0x0000000077730000-0x00000000778BE000-memory.dmp

      Filesize

      1.6MB

    • memory/2660-164-0x0000000007B00000-0x0000000007B92000-memory.dmp

      Filesize

      584KB

    • memory/2660-165-0x00000000054B0000-0x00000000054B6000-memory.dmp

      Filesize

      24KB

    • memory/2660-166-0x0000000077730000-0x00000000778BE000-memory.dmp

      Filesize

      1.6MB

    • memory/2660-167-0x0000000007DA0000-0x0000000007E16000-memory.dmp

      Filesize

      472KB

    • memory/2660-168-0x0000000077730000-0x00000000778BE000-memory.dmp

      Filesize

      1.6MB

    • memory/2660-169-0x0000000077730000-0x00000000778BE000-memory.dmp

      Filesize

      1.6MB

    • memory/2660-170-0x0000000077730000-0x00000000778BE000-memory.dmp

      Filesize

      1.6MB

    • memory/2660-159-0x0000000077730000-0x00000000778BE000-memory.dmp

      Filesize

      1.6MB

    • memory/2660-172-0x0000000077730000-0x00000000778BE000-memory.dmp

      Filesize

      1.6MB

    • memory/2660-173-0x0000000077730000-0x00000000778BE000-memory.dmp

      Filesize

      1.6MB

    • memory/2660-174-0x0000000077730000-0x00000000778BE000-memory.dmp

      Filesize

      1.6MB

    • memory/2660-175-0x0000000077730000-0x00000000778BE000-memory.dmp

      Filesize

      1.6MB

    • memory/2660-176-0x0000000077730000-0x00000000778BE000-memory.dmp

      Filesize

      1.6MB

    • memory/2660-177-0x0000000077730000-0x00000000778BE000-memory.dmp

      Filesize

      1.6MB

    • memory/2660-124-0x0000000077730000-0x00000000778BE000-memory.dmp

      Filesize

      1.6MB

    • memory/2660-121-0x0000000077730000-0x00000000778BE000-memory.dmp

      Filesize

      1.6MB

    • memory/2660-122-0x0000000077730000-0x00000000778BE000-memory.dmp

      Filesize

      1.6MB

    • memory/2660-161-0x00000000055F0000-0x00000000056BC000-memory.dmp

      Filesize

      816KB

    • memory/3876-289-0x0000000000402354-mapping.dmp

    • memory/4540-323-0x0000000000000000-mapping.dmp

    • memory/4624-213-0x0000000000000000-mapping.dmp

    • memory/4640-181-0x0000000077730000-0x00000000778BE000-memory.dmp

      Filesize

      1.6MB

    • memory/4640-178-0x0000000000400000-0x0000000000406000-memory.dmp

      Filesize

      24KB

    • memory/4640-179-0x0000000000402354-mapping.dmp

    • memory/4640-188-0x0000000077730000-0x00000000778BE000-memory.dmp

      Filesize

      1.6MB

    • memory/4640-191-0x0000000077730000-0x00000000778BE000-memory.dmp

      Filesize

      1.6MB

    • memory/4640-180-0x0000000077730000-0x00000000778BE000-memory.dmp

      Filesize

      1.6MB

    • memory/4640-182-0x0000000077730000-0x00000000778BE000-memory.dmp

      Filesize

      1.6MB

    • memory/4640-186-0x0000000077730000-0x00000000778BE000-memory.dmp

      Filesize

      1.6MB

    • memory/4640-183-0x0000000077730000-0x00000000778BE000-memory.dmp

      Filesize

      1.6MB

    • memory/4640-190-0x0000000077730000-0x00000000778BE000-memory.dmp

      Filesize

      1.6MB

    • memory/4640-187-0x0000000077730000-0x00000000778BE000-memory.dmp

      Filesize

      1.6MB

    • memory/4640-232-0x0000000000400000-0x0000000000406000-memory.dmp

      Filesize

      24KB

    • memory/4640-189-0x0000000077730000-0x00000000778BE000-memory.dmp

      Filesize

      1.6MB

    • memory/4960-396-0x0000000000402354-mapping.dmp