a41693fcb890c5cc2b46a60da9972b2fdae2fffbdaeafcdc06d0beb619b779fa

General

Target

a41693fcb890c5cc2b46a60da9972b2fdae2fffbdaeafcdc06d0beb619b779fa.exe
Size

322KB
MD5

22e08e07e3c7fde0d0044f2a5cfccc10
SHA1

fd925f9dd38fe4b73c8692547c9f113eefe91655
SHA256

a41693fcb890c5cc2b46a60da9972b2fdae2fffbdaeafcdc06d0beb619b779fa
SHA512

16c9db4a29803acbf5e1083880664d8c0f544e757d3baea998a6f31bd2331c9a197e92ab93041760a2fb7cb9a94285f9eb68d73fcfdd7344b43bcad1286a7833
SSDEEP

6144:eKlzr1sYCzek2ciDaP9Xk6Ln1W8W/9InBSkZZmLdGcAdgdY6RKpjS:eGhQ2ciDq9ZL1W8q9InBRqELdolRKpj

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1384	oobeldr.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3564 set thread context of 3580	3564	a41693fcb890c5cc2b46a60da9972b2fdae2fffbdaeafcdc06d0beb619b779fa.exe	88

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
5072	schtasks.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3564 wrote to memory of 4976	3564	a41693fcb890c5cc2b46a60da9972b2fdae2fffbdaeafcdc06d0beb619b779fa.exe	83
PID 3564 wrote to memory of 4976	3564	a41693fcb890c5cc2b46a60da9972b2fdae2fffbdaeafcdc06d0beb619b779fa.exe	83
PID 3564 wrote to memory of 4976	3564	a41693fcb890c5cc2b46a60da9972b2fdae2fffbdaeafcdc06d0beb619b779fa.exe	83
PID 3564 wrote to memory of 3580	3564	a41693fcb890c5cc2b46a60da9972b2fdae2fffbdaeafcdc06d0beb619b779fa.exe	88
PID 3564 wrote to memory of 3580	3564	a41693fcb890c5cc2b46a60da9972b2fdae2fffbdaeafcdc06d0beb619b779fa.exe	88
PID 3564 wrote to memory of 3580	3564	a41693fcb890c5cc2b46a60da9972b2fdae2fffbdaeafcdc06d0beb619b779fa.exe	88
PID 3564 wrote to memory of 3580	3564	a41693fcb890c5cc2b46a60da9972b2fdae2fffbdaeafcdc06d0beb619b779fa.exe	88
PID 3564 wrote to memory of 3580	3564	a41693fcb890c5cc2b46a60da9972b2fdae2fffbdaeafcdc06d0beb619b779fa.exe	88
PID 3564 wrote to memory of 3580	3564	a41693fcb890c5cc2b46a60da9972b2fdae2fffbdaeafcdc06d0beb619b779fa.exe	88
PID 3564 wrote to memory of 3580	3564	a41693fcb890c5cc2b46a60da9972b2fdae2fffbdaeafcdc06d0beb619b779fa.exe	88
PID 3564 wrote to memory of 3580	3564	a41693fcb890c5cc2b46a60da9972b2fdae2fffbdaeafcdc06d0beb619b779fa.exe	88
PID 3564 wrote to memory of 3580	3564	a41693fcb890c5cc2b46a60da9972b2fdae2fffbdaeafcdc06d0beb619b779fa.exe	88
PID 3580 wrote to memory of 5072	3580	a41693fcb890c5cc2b46a60da9972b2fdae2fffbdaeafcdc06d0beb619b779fa.exe	91
PID 3580 wrote to memory of 5072	3580	a41693fcb890c5cc2b46a60da9972b2fdae2fffbdaeafcdc06d0beb619b779fa.exe	91
PID 3580 wrote to memory of 5072	3580	a41693fcb890c5cc2b46a60da9972b2fdae2fffbdaeafcdc06d0beb619b779fa.exe	91

C:\Users\Admin\AppData\Local\Temp\a41693fcb890c5cc2b46a60da9972b2fdae2fffbdaeafcdc06d0beb619b779fa.exe
"C:\Users\Admin\AppData\Local\Temp\a41693fcb890c5cc2b46a60da9972b2fdae2fffbdaeafcdc06d0beb619b779fa.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3564
- C:\Users\Admin\AppData\Local\Temp\a41693fcb890c5cc2b46a60da9972b2fdae2fffbdaeafcdc06d0beb619b779fa.exe
  C:\Users\Admin\AppData\Local\Temp\a41693fcb890c5cc2b46a60da9972b2fdae2fffbdaeafcdc06d0beb619b779fa.exe
  2⤵
  PID:4976
- C:\Users\Admin\AppData\Local\Temp\a41693fcb890c5cc2b46a60da9972b2fdae2fffbdaeafcdc06d0beb619b779fa.exe
  C:\Users\Admin\AppData\Local\Temp\a41693fcb890c5cc2b46a60da9972b2fdae2fffbdaeafcdc06d0beb619b779fa.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3580
- - C:\Windows\SysWOW64\schtasks.exe
    /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
    3⤵
    - Creates scheduled task(s)
    PID:5072

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
1⤵
- Executes dropped EXE
PID:1384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe

Filesize
322KB

MD5
22e08e07e3c7fde0d0044f2a5cfccc10

SHA1
fd925f9dd38fe4b73c8692547c9f113eefe91655

SHA256
a41693fcb890c5cc2b46a60da9972b2fdae2fffbdaeafcdc06d0beb619b779fa

SHA512
16c9db4a29803acbf5e1083880664d8c0f544e757d3baea998a6f31bd2331c9a197e92ab93041760a2fb7cb9a94285f9eb68d73fcfdd7344b43bcad1286a7833

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe

Filesize
322KB

MD5
22e08e07e3c7fde0d0044f2a5cfccc10

SHA1
fd925f9dd38fe4b73c8692547c9f113eefe91655

SHA256
a41693fcb890c5cc2b46a60da9972b2fdae2fffbdaeafcdc06d0beb619b779fa

SHA512
16c9db4a29803acbf5e1083880664d8c0f544e757d3baea998a6f31bd2331c9a197e92ab93041760a2fb7cb9a94285f9eb68d73fcfdd7344b43bcad1286a7833

Download Submit
memory/1384-18-0x0000000074D50000-0x0000000075500000-memory.dmp

Filesize
7.7MB

Download
memory/3564-8-0x0000000007000000-0x000000000701E000-memory.dmp

Filesize
120KB

Download
memory/3564-4-0x0000000007060000-0x00000000070F2000-memory.dmp

Filesize
584KB

Download
memory/3564-5-0x0000000004430000-0x0000000004436000-memory.dmp

Filesize
24KB

Download
memory/3564-6-0x0000000004A20000-0x0000000004A30000-memory.dmp

Filesize
64KB

Download
memory/3564-7-0x0000000007300000-0x0000000007376000-memory.dmp

Filesize
472KB

Download
memory/3564-0-0x0000000074D50000-0x0000000075500000-memory.dmp

Filesize
7.7MB

Download
memory/3564-14-0x0000000074D50000-0x0000000075500000-memory.dmp

Filesize
7.7MB

Download
memory/3564-3-0x0000000007570000-0x0000000007B14000-memory.dmp

Filesize
5.6MB

Download
memory/3564-2-0x0000000006EF0000-0x0000000006FBC000-memory.dmp

Filesize
816KB

Download
memory/3564-1-0x0000000000030000-0x0000000000086000-memory.dmp

Filesize
344KB

Download
memory/3580-9-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3580-11-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3580-15-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads