f327c2b5ab1d98f0382a35cd78f694d487c74a7290f1ff7be53f42e23021e599

Analysis

max time kernel
145s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
16/06/2023, 05:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
af6e384dfabdad52d43cf8429ad8779c.exe
Size 4.4MB
Sample230616-ggvywsda95
SHA256 f327c2b5ab1d98f0382a35cd78f694d487c74a7290f1ff7be53f42e23021e599
MD5 af6e384dfabdad52d43cf8429ad8779c
SHA1 c78e8cd8c74ad9d598f591de5e49f73ce3373791
SHA512 b55ba87b275a475e751e13ec9bac2e7f1a3484057844e210168e2256d73d9b6a7c7c7592845d4a3bf8163cf0d479315418a9f3cb8f2f4832af88a06867e3df93
SSDEEP 98304:RpvmMxvdjYr/2BLOizdh/0Rzs24+WhXWXfRqCFh6MacgD5hB:vlVjMuBx0R7RrXpqiUhB
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4128	oobeldr.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1540	schtasks.exe
3448	schtasks.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4600 wrote to memory of 1540	4600	af6e384dfabdad52d43cf8429ad8779c.exe	83
PID 4600 wrote to memory of 1540	4600	af6e384dfabdad52d43cf8429ad8779c.exe	83
PID 4600 wrote to memory of 1540	4600	af6e384dfabdad52d43cf8429ad8779c.exe	83
PID 4128 wrote to memory of 3448	4128	oobeldr.exe	93
PID 4128 wrote to memory of 3448	4128	oobeldr.exe	93
PID 4128 wrote to memory of 3448	4128	oobeldr.exe	93

C:\Users\Admin\AppData\Local\Temp\af6e384dfabdad52d43cf8429ad8779c.exe
"C:\Users\Admin\AppData\Local\Temp\af6e384dfabdad52d43cf8429ad8779c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4600
- C:\Windows\SysWOW64\schtasks.exe
  /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
  2⤵
  - Creates scheduled task(s)
  PID:1540

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128
- C:\Windows\SysWOW64\schtasks.exe
  /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
  2⤵
  - Creates scheduled task(s)
  PID:3448

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

oobeldr.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
Size 4.4MB
SHA256 f327c2b5ab1d98f0382a35cd78f694d487c74a7290f1ff7be53f42e23021e599
MD5 af6e384dfabdad52d43cf8429ad8779c
SHA1 c78e8cd8c74ad9d598f591de5e49f73ce3373791
SHA512 b55ba87b275a475e751e13ec9bac2e7f1a3484057844e210168e2256d73d9b6a7c7c7592845d4a3bf8163cf0d479315418a9f3cb8f2f4832af88a06867e3df93
SSDEEP 98304:RpvmMxvdjYr/2BLOizdh/0Rzs24+WhXWXfRqCFh6MacgD5hB:vlVjMuBx0R7RrXpqiUhB
MD5 SHA1 SHA512 SSDEEP

Submit Download

oobeldr.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
Size 4.4MB
SHA256 f327c2b5ab1d98f0382a35cd78f694d487c74a7290f1ff7be53f42e23021e599
MD5 af6e384dfabdad52d43cf8429ad8779c
SHA1 c78e8cd8c74ad9d598f591de5e49f73ce3373791
SHA512 b55ba87b275a475e751e13ec9bac2e7f1a3484057844e210168e2256d73d9b6a7c7c7592845d4a3bf8163cf0d479315418a9f3cb8f2f4832af88a06867e3df93
SSDEEP 98304:RpvmMxvdjYr/2BLOizdh/0Rzs24+WhXWXfRqCFh6MacgD5hB:vlVjMuBx0R7RrXpqiUhB
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4128-142-0x0000000000400000-0x0000000000BD9000-memory.dmp

Download

memory/4128-144-0x0000000000400000-0x0000000000BD9000-memory.dmp

Download

memory/4600-133-0x0000000000400000-0x0000000000BD9000-memory.dmp

Download

memory/4600-134-0x0000000000400000-0x0000000000BD9000-memory.dmp

Download

memory/4600-135-0x0000000000400000-0x0000000000BD9000-memory.dmp

Download

memory/4600-138-0x0000000000400000-0x0000000000BD9000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads