95d7fa71208b656e9822114a36d43380761d6bde85cb1599c46f75e39b5a7f97

Analysis

max time kernel
292s
max time network
258s
platform
windows10-1703_x64
resource
win10-20231023-en
resource tags

arch:x64arch:x86image:win10-20231023-enlocale:en-usos:windows10-1703-x64system
submitted
20-11-2023 04:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

95d7fa71208b656e9822114a36d43380761d6bde85cb1599c46f75e39b5a7f97.exe
Size

323KB
MD5

5c6f854f8379603767c3ce0ae4acea02
SHA1

38efae630aae8bdc6d5252909c238c1ea399e24d
SHA256

95d7fa71208b656e9822114a36d43380761d6bde85cb1599c46f75e39b5a7f97
SHA512

db89c04b7427d741d51cd647ee5a051699209df4e3f0086e9f4eec310bbb22e472ab5a0a01245e0c4c154468b9b9e645539537559428ad9e7f374dede566e610
SSDEEP

6144:eKlzr1sYCzek2ciDaP9Xk6Ln1W8W/9InBSkZZmLdGcAdgdY6RKpjS:eGhQ2ciDq9ZL1W8q9InBRqELdolRKpj

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
4520	oobeldr.exe
4744	oobeldr.exe
3720	oobeldr.exe
3416	oobeldr.exe
4312	oobeldr.exe
3232	oobeldr.exe
4924	oobeldr.exe
3396	oobeldr.exe
4444	oobeldr.exe
2052	oobeldr.exe

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 4352 set thread context of 2064	4352	95d7fa71208b656e9822114a36d43380761d6bde85cb1599c46f75e39b5a7f97.exe	71
PID 4520 set thread context of 4744	4520	oobeldr.exe	75
PID 3720 set thread context of 3416	3720	oobeldr.exe	79
PID 4312 set thread context of 3232	4312	oobeldr.exe	81
PID 4924 set thread context of 3396	4924	oobeldr.exe	83
PID 4444 set thread context of 2052	4444	oobeldr.exe	85

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
5040	schtasks.exe
2812	schtasks.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 4352 wrote to memory of 2064	4352	95d7fa71208b656e9822114a36d43380761d6bde85cb1599c46f75e39b5a7f97.exe	71
PID 4352 wrote to memory of 2064	4352	95d7fa71208b656e9822114a36d43380761d6bde85cb1599c46f75e39b5a7f97.exe	71
PID 4352 wrote to memory of 2064	4352	95d7fa71208b656e9822114a36d43380761d6bde85cb1599c46f75e39b5a7f97.exe	71
PID 4352 wrote to memory of 2064	4352	95d7fa71208b656e9822114a36d43380761d6bde85cb1599c46f75e39b5a7f97.exe	71
PID 4352 wrote to memory of 2064	4352	95d7fa71208b656e9822114a36d43380761d6bde85cb1599c46f75e39b5a7f97.exe	71
PID 4352 wrote to memory of 2064	4352	95d7fa71208b656e9822114a36d43380761d6bde85cb1599c46f75e39b5a7f97.exe	71
PID 4352 wrote to memory of 2064	4352	95d7fa71208b656e9822114a36d43380761d6bde85cb1599c46f75e39b5a7f97.exe	71
PID 4352 wrote to memory of 2064	4352	95d7fa71208b656e9822114a36d43380761d6bde85cb1599c46f75e39b5a7f97.exe	71
PID 4352 wrote to memory of 2064	4352	95d7fa71208b656e9822114a36d43380761d6bde85cb1599c46f75e39b5a7f97.exe	71
PID 2064 wrote to memory of 2812	2064	95d7fa71208b656e9822114a36d43380761d6bde85cb1599c46f75e39b5a7f97.exe	72
PID 2064 wrote to memory of 2812	2064	95d7fa71208b656e9822114a36d43380761d6bde85cb1599c46f75e39b5a7f97.exe	72
PID 2064 wrote to memory of 2812	2064	95d7fa71208b656e9822114a36d43380761d6bde85cb1599c46f75e39b5a7f97.exe	72
PID 4520 wrote to memory of 4744	4520	oobeldr.exe	75
PID 4520 wrote to memory of 4744	4520	oobeldr.exe	75
PID 4520 wrote to memory of 4744	4520	oobeldr.exe	75
PID 4520 wrote to memory of 4744	4520	oobeldr.exe	75
PID 4520 wrote to memory of 4744	4520	oobeldr.exe	75
PID 4520 wrote to memory of 4744	4520	oobeldr.exe	75
PID 4520 wrote to memory of 4744	4520	oobeldr.exe	75
PID 4520 wrote to memory of 4744	4520	oobeldr.exe	75
PID 4520 wrote to memory of 4744	4520	oobeldr.exe	75
PID 4744 wrote to memory of 5040	4744	oobeldr.exe	76
PID 4744 wrote to memory of 5040	4744	oobeldr.exe	76
PID 4744 wrote to memory of 5040	4744	oobeldr.exe	76
PID 3720 wrote to memory of 3416	3720	oobeldr.exe	79
PID 3720 wrote to memory of 3416	3720	oobeldr.exe	79
PID 3720 wrote to memory of 3416	3720	oobeldr.exe	79
PID 3720 wrote to memory of 3416	3720	oobeldr.exe	79
PID 3720 wrote to memory of 3416	3720	oobeldr.exe	79
PID 3720 wrote to memory of 3416	3720	oobeldr.exe	79
PID 3720 wrote to memory of 3416	3720	oobeldr.exe	79
PID 3720 wrote to memory of 3416	3720	oobeldr.exe	79
PID 3720 wrote to memory of 3416	3720	oobeldr.exe	79
PID 4312 wrote to memory of 3232	4312	oobeldr.exe	81
PID 4312 wrote to memory of 3232	4312	oobeldr.exe	81
PID 4312 wrote to memory of 3232	4312	oobeldr.exe	81
PID 4312 wrote to memory of 3232	4312	oobeldr.exe	81
PID 4312 wrote to memory of 3232	4312	oobeldr.exe	81
PID 4312 wrote to memory of 3232	4312	oobeldr.exe	81
PID 4312 wrote to memory of 3232	4312	oobeldr.exe	81
PID 4312 wrote to memory of 3232	4312	oobeldr.exe	81
PID 4312 wrote to memory of 3232	4312	oobeldr.exe	81
PID 4924 wrote to memory of 3396	4924	oobeldr.exe	83
PID 4924 wrote to memory of 3396	4924	oobeldr.exe	83
PID 4924 wrote to memory of 3396	4924	oobeldr.exe	83
PID 4924 wrote to memory of 3396	4924	oobeldr.exe	83
PID 4924 wrote to memory of 3396	4924	oobeldr.exe	83
PID 4924 wrote to memory of 3396	4924	oobeldr.exe	83
PID 4924 wrote to memory of 3396	4924	oobeldr.exe	83
PID 4924 wrote to memory of 3396	4924	oobeldr.exe	83
PID 4924 wrote to memory of 3396	4924	oobeldr.exe	83
PID 4444 wrote to memory of 2052	4444	oobeldr.exe	85
PID 4444 wrote to memory of 2052	4444	oobeldr.exe	85
PID 4444 wrote to memory of 2052	4444	oobeldr.exe	85
PID 4444 wrote to memory of 2052	4444	oobeldr.exe	85
PID 4444 wrote to memory of 2052	4444	oobeldr.exe	85
PID 4444 wrote to memory of 2052	4444	oobeldr.exe	85
PID 4444 wrote to memory of 2052	4444	oobeldr.exe	85
PID 4444 wrote to memory of 2052	4444	oobeldr.exe	85
PID 4444 wrote to memory of 2052	4444	oobeldr.exe	85

C:\Users\Admin\AppData\Local\Temp\95d7fa71208b656e9822114a36d43380761d6bde85cb1599c46f75e39b5a7f97.exe
"C:\Users\Admin\AppData\Local\Temp\95d7fa71208b656e9822114a36d43380761d6bde85cb1599c46f75e39b5a7f97.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4352
- C:\Users\Admin\AppData\Local\Temp\95d7fa71208b656e9822114a36d43380761d6bde85cb1599c46f75e39b5a7f97.exe
  C:\Users\Admin\AppData\Local\Temp\95d7fa71208b656e9822114a36d43380761d6bde85cb1599c46f75e39b5a7f97.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2064
- - C:\Windows\SysWOW64\schtasks.exe
    /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
    3⤵
    - Creates scheduled task(s)
    PID:2812

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4520
- C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4744
- - C:\Windows\SysWOW64\schtasks.exe
    /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
    3⤵
    - Creates scheduled task(s)
    PID:5040

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3720
- C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
  2⤵
  - Executes dropped EXE
  PID:3416

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4312
- C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
  2⤵
  - Executes dropped EXE
  PID:3232

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4924
- C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
  2⤵
  - Executes dropped EXE
  PID:3396

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4444
- C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
  2⤵
  - Executes dropped EXE
  PID:2052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\oobeldr.exe.log

Filesize
789B

MD5
db5ef8d7c51bad129d9097bf953e4913

SHA1
8439db960aa2d431bf5ec3c37af775b45eb07e06

SHA256
1248e67f10b47b397af3c8cbe342bad4be75c68b8e10f4ec6341195cc3138bd9

SHA512
04572485790b25e1751347e43b47174051cd153dd75fd55ee5590d25a2579f344cd96cf86cf45bdb7759e3e6d0f734d0ff717148ca70f501b9869e964e036fee

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe

Filesize
323KB

MD5
5c6f854f8379603767c3ce0ae4acea02

SHA1
38efae630aae8bdc6d5252909c238c1ea399e24d

SHA256
95d7fa71208b656e9822114a36d43380761d6bde85cb1599c46f75e39b5a7f97

SHA512
db89c04b7427d741d51cd647ee5a051699209df4e3f0086e9f4eec310bbb22e472ab5a0a01245e0c4c154468b9b9e645539537559428ad9e7f374dede566e610

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe

Filesize
323KB

MD5
5c6f854f8379603767c3ce0ae4acea02

SHA1
38efae630aae8bdc6d5252909c238c1ea399e24d

SHA256
95d7fa71208b656e9822114a36d43380761d6bde85cb1599c46f75e39b5a7f97

SHA512
db89c04b7427d741d51cd647ee5a051699209df4e3f0086e9f4eec310bbb22e472ab5a0a01245e0c4c154468b9b9e645539537559428ad9e7f374dede566e610

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe

Filesize
323KB

MD5
5c6f854f8379603767c3ce0ae4acea02

SHA1
38efae630aae8bdc6d5252909c238c1ea399e24d

SHA256
95d7fa71208b656e9822114a36d43380761d6bde85cb1599c46f75e39b5a7f97

SHA512
db89c04b7427d741d51cd647ee5a051699209df4e3f0086e9f4eec310bbb22e472ab5a0a01245e0c4c154468b9b9e645539537559428ad9e7f374dede566e610

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe

Filesize
323KB

MD5
5c6f854f8379603767c3ce0ae4acea02

SHA1
38efae630aae8bdc6d5252909c238c1ea399e24d

SHA256
95d7fa71208b656e9822114a36d43380761d6bde85cb1599c46f75e39b5a7f97

SHA512
db89c04b7427d741d51cd647ee5a051699209df4e3f0086e9f4eec310bbb22e472ab5a0a01245e0c4c154468b9b9e645539537559428ad9e7f374dede566e610

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe

Filesize
323KB

MD5
5c6f854f8379603767c3ce0ae4acea02

SHA1
38efae630aae8bdc6d5252909c238c1ea399e24d

SHA256
95d7fa71208b656e9822114a36d43380761d6bde85cb1599c46f75e39b5a7f97

SHA512
db89c04b7427d741d51cd647ee5a051699209df4e3f0086e9f4eec310bbb22e472ab5a0a01245e0c4c154468b9b9e645539537559428ad9e7f374dede566e610

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe

Filesize
323KB

MD5
5c6f854f8379603767c3ce0ae4acea02

SHA1
38efae630aae8bdc6d5252909c238c1ea399e24d

SHA256
95d7fa71208b656e9822114a36d43380761d6bde85cb1599c46f75e39b5a7f97

SHA512
db89c04b7427d741d51cd647ee5a051699209df4e3f0086e9f4eec310bbb22e472ab5a0a01245e0c4c154468b9b9e645539537559428ad9e7f374dede566e610

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe

Filesize
323KB

MD5
5c6f854f8379603767c3ce0ae4acea02

SHA1
38efae630aae8bdc6d5252909c238c1ea399e24d

SHA256
95d7fa71208b656e9822114a36d43380761d6bde85cb1599c46f75e39b5a7f97

SHA512
db89c04b7427d741d51cd647ee5a051699209df4e3f0086e9f4eec310bbb22e472ab5a0a01245e0c4c154468b9b9e645539537559428ad9e7f374dede566e610

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe

Filesize
323KB

MD5
5c6f854f8379603767c3ce0ae4acea02

SHA1
38efae630aae8bdc6d5252909c238c1ea399e24d

SHA256
95d7fa71208b656e9822114a36d43380761d6bde85cb1599c46f75e39b5a7f97

SHA512
db89c04b7427d741d51cd647ee5a051699209df4e3f0086e9f4eec310bbb22e472ab5a0a01245e0c4c154468b9b9e645539537559428ad9e7f374dede566e610

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe

Filesize
323KB

MD5
5c6f854f8379603767c3ce0ae4acea02

SHA1
38efae630aae8bdc6d5252909c238c1ea399e24d

SHA256
95d7fa71208b656e9822114a36d43380761d6bde85cb1599c46f75e39b5a7f97

SHA512
db89c04b7427d741d51cd647ee5a051699209df4e3f0086e9f4eec310bbb22e472ab5a0a01245e0c4c154468b9b9e645539537559428ad9e7f374dede566e610

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe

Filesize
323KB

MD5
5c6f854f8379603767c3ce0ae4acea02

SHA1
38efae630aae8bdc6d5252909c238c1ea399e24d

SHA256
95d7fa71208b656e9822114a36d43380761d6bde85cb1599c46f75e39b5a7f97

SHA512
db89c04b7427d741d51cd647ee5a051699209df4e3f0086e9f4eec310bbb22e472ab5a0a01245e0c4c154468b9b9e645539537559428ad9e7f374dede566e610

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe

Filesize
323KB

MD5
5c6f854f8379603767c3ce0ae4acea02

SHA1
38efae630aae8bdc6d5252909c238c1ea399e24d

SHA256
95d7fa71208b656e9822114a36d43380761d6bde85cb1599c46f75e39b5a7f97

SHA512
db89c04b7427d741d51cd647ee5a051699209df4e3f0086e9f4eec310bbb22e472ab5a0a01245e0c4c154468b9b9e645539537559428ad9e7f374dede566e610

Download Submit
memory/2064-12-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2064-14-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2064-9-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3720-28-0x0000000073420000-0x0000000073B0E000-memory.dmp

Filesize
6.9MB

Download
memory/3720-34-0x0000000073420000-0x0000000073B0E000-memory.dmp

Filesize
6.9MB

Download
memory/3720-29-0x0000000005380000-0x0000000005390000-memory.dmp

Filesize
64KB

Download
memory/4312-42-0x0000000073420000-0x0000000073B0E000-memory.dmp

Filesize
6.9MB

Download
memory/4312-37-0x0000000000BB0000-0x0000000000BC0000-memory.dmp

Filesize
64KB

Download
memory/4312-36-0x0000000073420000-0x0000000073B0E000-memory.dmp

Filesize
6.9MB

Download
memory/4352-0-0x00000000002B0000-0x0000000000306000-memory.dmp

Filesize
344KB

Download
memory/4352-8-0x00000000070E0000-0x00000000070FE000-memory.dmp

Filesize
120KB

Download
memory/4352-3-0x00000000075C0000-0x0000000007ABE000-memory.dmp

Filesize
5.0MB

Download
memory/4352-5-0x0000000002740000-0x0000000002746000-memory.dmp

Filesize
24KB

Download
memory/4352-2-0x0000000006FF0000-0x00000000070BC000-memory.dmp

Filesize
816KB

Download
memory/4352-6-0x0000000004D90000-0x0000000004DA0000-memory.dmp

Filesize
64KB

Download
memory/4352-1-0x0000000073380000-0x0000000073A6E000-memory.dmp

Filesize
6.9MB

Download
memory/4352-15-0x0000000073380000-0x0000000073A6E000-memory.dmp

Filesize
6.9MB

Download
memory/4352-4-0x0000000007160000-0x00000000071F2000-memory.dmp

Filesize
584KB

Download
memory/4352-7-0x0000000007400000-0x0000000007476000-memory.dmp

Filesize
472KB

Download
memory/4444-58-0x0000000073420000-0x0000000073B0E000-memory.dmp

Filesize
6.9MB

Download
memory/4444-53-0x0000000005000000-0x0000000005010000-memory.dmp

Filesize
64KB

Download
memory/4444-52-0x0000000073420000-0x0000000073B0E000-memory.dmp

Filesize
6.9MB

Download
memory/4520-18-0x0000000073380000-0x0000000073A6E000-memory.dmp

Filesize
6.9MB

Download
memory/4520-19-0x0000000004BA0000-0x0000000004BB0000-memory.dmp

Filesize
64KB

Download
memory/4520-25-0x0000000073380000-0x0000000073A6E000-memory.dmp

Filesize
6.9MB

Download
memory/4924-50-0x0000000073420000-0x0000000073B0E000-memory.dmp

Filesize
6.9MB

Download
memory/4924-45-0x00000000049F0000-0x0000000004A00000-memory.dmp

Filesize
64KB

Download
memory/4924-44-0x0000000073420000-0x0000000073B0E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads