a3b0e38aad8208ef8fc0d5d8a9e2c6d9267f4ad75fb4eac81b511cb48b92e44b

General

Target

a3b0e38aad8208ef8fc0d5d8a9e2c6d9267f4ad75fb4eac81b511cb48b92e44b.exe
Size

328KB
MD5

0c2fbdf76e8f32a03349c136e2a344ce
SHA1

eb13f529644c629e282d3a97d8bf1646f70588b8
SHA256

a3b0e38aad8208ef8fc0d5d8a9e2c6d9267f4ad75fb4eac81b511cb48b92e44b
SHA512

1ac8b806ad589b7712ae5ad30d130d9d6b404ddd6a0295d48962c504af416576bddc9ff717bba65c0f90e7697106af1d10af240fc760d2c9f62f65c50b11d5c3
SSDEEP

6144:eKlzr1sYCzek2ciDaP9Xk6Ln1W8W/9InBSkZZmLdGcAdgdY6RKpjS:eGhQ2ciDq9ZL1W8q9InBRqELdolRKpj

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3772	oobeldr.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2244 set thread context of 2476	2244	a3b0e38aad8208ef8fc0d5d8a9e2c6d9267f4ad75fb4eac81b511cb48b92e44b.exe	84

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2656	schtasks.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 1624	2244	a3b0e38aad8208ef8fc0d5d8a9e2c6d9267f4ad75fb4eac81b511cb48b92e44b.exe	82
PID 2244 wrote to memory of 1624	2244	a3b0e38aad8208ef8fc0d5d8a9e2c6d9267f4ad75fb4eac81b511cb48b92e44b.exe	82
PID 2244 wrote to memory of 1624	2244	a3b0e38aad8208ef8fc0d5d8a9e2c6d9267f4ad75fb4eac81b511cb48b92e44b.exe	82
PID 2244 wrote to memory of 1764	2244	a3b0e38aad8208ef8fc0d5d8a9e2c6d9267f4ad75fb4eac81b511cb48b92e44b.exe	83
PID 2244 wrote to memory of 1764	2244	a3b0e38aad8208ef8fc0d5d8a9e2c6d9267f4ad75fb4eac81b511cb48b92e44b.exe	83
PID 2244 wrote to memory of 1764	2244	a3b0e38aad8208ef8fc0d5d8a9e2c6d9267f4ad75fb4eac81b511cb48b92e44b.exe	83
PID 2244 wrote to memory of 2476	2244	a3b0e38aad8208ef8fc0d5d8a9e2c6d9267f4ad75fb4eac81b511cb48b92e44b.exe	84
PID 2244 wrote to memory of 2476	2244	a3b0e38aad8208ef8fc0d5d8a9e2c6d9267f4ad75fb4eac81b511cb48b92e44b.exe	84
PID 2244 wrote to memory of 2476	2244	a3b0e38aad8208ef8fc0d5d8a9e2c6d9267f4ad75fb4eac81b511cb48b92e44b.exe	84
PID 2244 wrote to memory of 2476	2244	a3b0e38aad8208ef8fc0d5d8a9e2c6d9267f4ad75fb4eac81b511cb48b92e44b.exe	84
PID 2244 wrote to memory of 2476	2244	a3b0e38aad8208ef8fc0d5d8a9e2c6d9267f4ad75fb4eac81b511cb48b92e44b.exe	84
PID 2244 wrote to memory of 2476	2244	a3b0e38aad8208ef8fc0d5d8a9e2c6d9267f4ad75fb4eac81b511cb48b92e44b.exe	84
PID 2244 wrote to memory of 2476	2244	a3b0e38aad8208ef8fc0d5d8a9e2c6d9267f4ad75fb4eac81b511cb48b92e44b.exe	84
PID 2244 wrote to memory of 2476	2244	a3b0e38aad8208ef8fc0d5d8a9e2c6d9267f4ad75fb4eac81b511cb48b92e44b.exe	84
PID 2244 wrote to memory of 2476	2244	a3b0e38aad8208ef8fc0d5d8a9e2c6d9267f4ad75fb4eac81b511cb48b92e44b.exe	84
PID 2476 wrote to memory of 2656	2476	a3b0e38aad8208ef8fc0d5d8a9e2c6d9267f4ad75fb4eac81b511cb48b92e44b.exe	85
PID 2476 wrote to memory of 2656	2476	a3b0e38aad8208ef8fc0d5d8a9e2c6d9267f4ad75fb4eac81b511cb48b92e44b.exe	85
PID 2476 wrote to memory of 2656	2476	a3b0e38aad8208ef8fc0d5d8a9e2c6d9267f4ad75fb4eac81b511cb48b92e44b.exe	85

C:\Users\Admin\AppData\Local\Temp\a3b0e38aad8208ef8fc0d5d8a9e2c6d9267f4ad75fb4eac81b511cb48b92e44b.exe
"C:\Users\Admin\AppData\Local\Temp\a3b0e38aad8208ef8fc0d5d8a9e2c6d9267f4ad75fb4eac81b511cb48b92e44b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Users\Admin\AppData\Local\Temp\a3b0e38aad8208ef8fc0d5d8a9e2c6d9267f4ad75fb4eac81b511cb48b92e44b.exe
  C:\Users\Admin\AppData\Local\Temp\a3b0e38aad8208ef8fc0d5d8a9e2c6d9267f4ad75fb4eac81b511cb48b92e44b.exe
  2⤵
  PID:1624
- C:\Users\Admin\AppData\Local\Temp\a3b0e38aad8208ef8fc0d5d8a9e2c6d9267f4ad75fb4eac81b511cb48b92e44b.exe
  C:\Users\Admin\AppData\Local\Temp\a3b0e38aad8208ef8fc0d5d8a9e2c6d9267f4ad75fb4eac81b511cb48b92e44b.exe
  2⤵
  PID:1764
- C:\Users\Admin\AppData\Local\Temp\a3b0e38aad8208ef8fc0d5d8a9e2c6d9267f4ad75fb4eac81b511cb48b92e44b.exe
  C:\Users\Admin\AppData\Local\Temp\a3b0e38aad8208ef8fc0d5d8a9e2c6d9267f4ad75fb4eac81b511cb48b92e44b.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2476
- - C:\Windows\SysWOW64\schtasks.exe
    /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
    3⤵
    - Creates scheduled task(s)
    PID:2656

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
1⤵
- Executes dropped EXE
PID:3772

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe

Filesize
328KB

MD5
0c2fbdf76e8f32a03349c136e2a344ce

SHA1
eb13f529644c629e282d3a97d8bf1646f70588b8

SHA256
a3b0e38aad8208ef8fc0d5d8a9e2c6d9267f4ad75fb4eac81b511cb48b92e44b

SHA512
1ac8b806ad589b7712ae5ad30d130d9d6b404ddd6a0295d48962c504af416576bddc9ff717bba65c0f90e7697106af1d10af240fc760d2c9f62f65c50b11d5c3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe

Filesize
328KB

MD5
0c2fbdf76e8f32a03349c136e2a344ce

SHA1
eb13f529644c629e282d3a97d8bf1646f70588b8

SHA256
a3b0e38aad8208ef8fc0d5d8a9e2c6d9267f4ad75fb4eac81b511cb48b92e44b

SHA512
1ac8b806ad589b7712ae5ad30d130d9d6b404ddd6a0295d48962c504af416576bddc9ff717bba65c0f90e7697106af1d10af240fc760d2c9f62f65c50b11d5c3

Download Submit
memory/2244-132-0x0000000000D90000-0x0000000000DE6000-memory.dmp

Filesize
344KB

Download
memory/2244-133-0x0000000008280000-0x0000000008824000-memory.dmp

Filesize
5.6MB

Download
memory/2244-134-0x0000000007D70000-0x0000000007E02000-memory.dmp

Filesize
584KB

Download
memory/2244-135-0x0000000008010000-0x0000000008086000-memory.dmp

Filesize
472KB

Download
memory/2244-136-0x0000000005980000-0x000000000599E000-memory.dmp

Filesize
120KB

Download
memory/2476-138-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2476-140-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2476-142-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads