608384aa275db4a8ee1cb4103c0233d41bdceb9175f1a7bbea746915784d1abd

Analysis

max time kernel
261s
max time network
297s
platform
windows10-1703_x64
resource
win10-20231215-en
resource tags

arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system
submitted
15-01-2024 04:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

608384aa275db4a8ee1cb4103c0233d41bdceb9175f1a7bbea746915784d1abd.exe
Size

324KB
MD5

cd3fe09d482fd1f94e40cc827f435f2b
SHA1

e4a896967bca28f203221972674d4b0d3c214a00
SHA256

608384aa275db4a8ee1cb4103c0233d41bdceb9175f1a7bbea746915784d1abd
SHA512

18cfd48356726af4d81b9909a0beb5cb17698ca8a08dea22c06aa67707e9518d4b39261add14315abd0cb255232760cfdcaa0288e33db04e66e7ca869edc09bb
SSDEEP

6144:eKlzr1sYCzek2ciDaP9Xk6Ln1W8W/9InBSkZZmLdGcAdgdY6RKpjS:eGhQ2ciDq9ZL1W8q9InBRqELdolRKpj

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2728	oobeldr.exe
2708	oobeldr.exe
2976	oobeldr.exe
2684	oobeldr.exe
2568	oobeldr.exe
700	oobeldr.exe
4092	oobeldr.exe
3460	oobeldr.exe
4336	oobeldr.exe
4532	oobeldr.exe
4904	oobeldr.exe

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 4704 set thread context of 4940	4704	608384aa275db4a8ee1cb4103c0233d41bdceb9175f1a7bbea746915784d1abd.exe	73
PID 2728 set thread context of 2708	2728	oobeldr.exe	77
PID 2976 set thread context of 2568	2976	oobeldr.exe	82
PID 700 set thread context of 4092	700	oobeldr.exe	84
PID 3460 set thread context of 4336	3460	oobeldr.exe	86
PID 4532 set thread context of 4904	4532	oobeldr.exe	88

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4548	schtasks.exe
4632	schtasks.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 4704 wrote to memory of 4940	4704	608384aa275db4a8ee1cb4103c0233d41bdceb9175f1a7bbea746915784d1abd.exe	73
PID 4704 wrote to memory of 4940	4704	608384aa275db4a8ee1cb4103c0233d41bdceb9175f1a7bbea746915784d1abd.exe	73
PID 4704 wrote to memory of 4940	4704	608384aa275db4a8ee1cb4103c0233d41bdceb9175f1a7bbea746915784d1abd.exe	73
PID 4704 wrote to memory of 4940	4704	608384aa275db4a8ee1cb4103c0233d41bdceb9175f1a7bbea746915784d1abd.exe	73
PID 4704 wrote to memory of 4940	4704	608384aa275db4a8ee1cb4103c0233d41bdceb9175f1a7bbea746915784d1abd.exe	73
PID 4704 wrote to memory of 4940	4704	608384aa275db4a8ee1cb4103c0233d41bdceb9175f1a7bbea746915784d1abd.exe	73
PID 4704 wrote to memory of 4940	4704	608384aa275db4a8ee1cb4103c0233d41bdceb9175f1a7bbea746915784d1abd.exe	73
PID 4704 wrote to memory of 4940	4704	608384aa275db4a8ee1cb4103c0233d41bdceb9175f1a7bbea746915784d1abd.exe	73
PID 4704 wrote to memory of 4940	4704	608384aa275db4a8ee1cb4103c0233d41bdceb9175f1a7bbea746915784d1abd.exe	73
PID 4940 wrote to memory of 4548	4940	608384aa275db4a8ee1cb4103c0233d41bdceb9175f1a7bbea746915784d1abd.exe	74
PID 4940 wrote to memory of 4548	4940	608384aa275db4a8ee1cb4103c0233d41bdceb9175f1a7bbea746915784d1abd.exe	74
PID 4940 wrote to memory of 4548	4940	608384aa275db4a8ee1cb4103c0233d41bdceb9175f1a7bbea746915784d1abd.exe	74
PID 2728 wrote to memory of 2708	2728	oobeldr.exe	77
PID 2728 wrote to memory of 2708	2728	oobeldr.exe	77
PID 2728 wrote to memory of 2708	2728	oobeldr.exe	77
PID 2728 wrote to memory of 2708	2728	oobeldr.exe	77
PID 2728 wrote to memory of 2708	2728	oobeldr.exe	77
PID 2728 wrote to memory of 2708	2728	oobeldr.exe	77
PID 2728 wrote to memory of 2708	2728	oobeldr.exe	77
PID 2728 wrote to memory of 2708	2728	oobeldr.exe	77
PID 2728 wrote to memory of 2708	2728	oobeldr.exe	77
PID 2708 wrote to memory of 4632	2708	oobeldr.exe	78
PID 2708 wrote to memory of 4632	2708	oobeldr.exe	78
PID 2708 wrote to memory of 4632	2708	oobeldr.exe	78
PID 2976 wrote to memory of 2684	2976	oobeldr.exe	81
PID 2976 wrote to memory of 2684	2976	oobeldr.exe	81
PID 2976 wrote to memory of 2684	2976	oobeldr.exe	81
PID 2976 wrote to memory of 2568	2976	oobeldr.exe	82
PID 2976 wrote to memory of 2568	2976	oobeldr.exe	82
PID 2976 wrote to memory of 2568	2976	oobeldr.exe	82
PID 2976 wrote to memory of 2568	2976	oobeldr.exe	82
PID 2976 wrote to memory of 2568	2976	oobeldr.exe	82
PID 2976 wrote to memory of 2568	2976	oobeldr.exe	82
PID 2976 wrote to memory of 2568	2976	oobeldr.exe	82
PID 2976 wrote to memory of 2568	2976	oobeldr.exe	82
PID 2976 wrote to memory of 2568	2976	oobeldr.exe	82
PID 700 wrote to memory of 4092	700	oobeldr.exe	84
PID 700 wrote to memory of 4092	700	oobeldr.exe	84
PID 700 wrote to memory of 4092	700	oobeldr.exe	84
PID 700 wrote to memory of 4092	700	oobeldr.exe	84
PID 700 wrote to memory of 4092	700	oobeldr.exe	84
PID 700 wrote to memory of 4092	700	oobeldr.exe	84
PID 700 wrote to memory of 4092	700	oobeldr.exe	84
PID 700 wrote to memory of 4092	700	oobeldr.exe	84
PID 700 wrote to memory of 4092	700	oobeldr.exe	84
PID 3460 wrote to memory of 4336	3460	oobeldr.exe	86
PID 3460 wrote to memory of 4336	3460	oobeldr.exe	86
PID 3460 wrote to memory of 4336	3460	oobeldr.exe	86
PID 3460 wrote to memory of 4336	3460	oobeldr.exe	86
PID 3460 wrote to memory of 4336	3460	oobeldr.exe	86
PID 3460 wrote to memory of 4336	3460	oobeldr.exe	86
PID 3460 wrote to memory of 4336	3460	oobeldr.exe	86
PID 3460 wrote to memory of 4336	3460	oobeldr.exe	86
PID 3460 wrote to memory of 4336	3460	oobeldr.exe	86
PID 4532 wrote to memory of 4904	4532	oobeldr.exe	88
PID 4532 wrote to memory of 4904	4532	oobeldr.exe	88
PID 4532 wrote to memory of 4904	4532	oobeldr.exe	88
PID 4532 wrote to memory of 4904	4532	oobeldr.exe	88
PID 4532 wrote to memory of 4904	4532	oobeldr.exe	88
PID 4532 wrote to memory of 4904	4532	oobeldr.exe	88
PID 4532 wrote to memory of 4904	4532	oobeldr.exe	88
PID 4532 wrote to memory of 4904	4532	oobeldr.exe	88
PID 4532 wrote to memory of 4904	4532	oobeldr.exe	88

C:\Users\Admin\AppData\Local\Temp\608384aa275db4a8ee1cb4103c0233d41bdceb9175f1a7bbea746915784d1abd.exe
"C:\Users\Admin\AppData\Local\Temp\608384aa275db4a8ee1cb4103c0233d41bdceb9175f1a7bbea746915784d1abd.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4704
- C:\Users\Admin\AppData\Local\Temp\608384aa275db4a8ee1cb4103c0233d41bdceb9175f1a7bbea746915784d1abd.exe
  C:\Users\Admin\AppData\Local\Temp\608384aa275db4a8ee1cb4103c0233d41bdceb9175f1a7bbea746915784d1abd.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4940
- - C:\Windows\SysWOW64\schtasks.exe
    /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
    3⤵
    - Creates scheduled task(s)
    PID:4548

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2708
- - C:\Windows\SysWOW64\schtasks.exe
    /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
    3⤵
    - Creates scheduled task(s)
    PID:4632

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
  2⤵
  - Executes dropped EXE
  PID:2568

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:700
- C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
  2⤵
  - Executes dropped EXE
  PID:4092

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3460
- C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
  2⤵
  - Executes dropped EXE
  PID:4336

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4532
- C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
  2⤵
  - Executes dropped EXE
  PID:4904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\oobeldr.exe.log

Filesize
789B

MD5
db5ef8d7c51bad129d9097bf953e4913

SHA1
8439db960aa2d431bf5ec3c37af775b45eb07e06

SHA256
1248e67f10b47b397af3c8cbe342bad4be75c68b8e10f4ec6341195cc3138bd9

SHA512
04572485790b25e1751347e43b47174051cd153dd75fd55ee5590d25a2579f344cd96cf86cf45bdb7759e3e6d0f734d0ff717148ca70f501b9869e964e036fee

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe

Filesize
324KB

MD5
cd3fe09d482fd1f94e40cc827f435f2b

SHA1
e4a896967bca28f203221972674d4b0d3c214a00

SHA256
608384aa275db4a8ee1cb4103c0233d41bdceb9175f1a7bbea746915784d1abd

SHA512
18cfd48356726af4d81b9909a0beb5cb17698ca8a08dea22c06aa67707e9518d4b39261add14315abd0cb255232760cfdcaa0288e33db04e66e7ca869edc09bb

Download Submit
memory/700-43-0x00000000735A0000-0x0000000073C8E000-memory.dmp

Filesize
6.9MB

Download
memory/700-38-0x00000000057D0000-0x00000000057E0000-memory.dmp

Filesize
64KB

Download
memory/700-37-0x00000000735A0000-0x0000000073C8E000-memory.dmp

Filesize
6.9MB

Download
memory/2728-25-0x0000000073500000-0x0000000073BEE000-memory.dmp

Filesize
6.9MB

Download
memory/2728-19-0x0000000004FF0000-0x0000000005000000-memory.dmp

Filesize
64KB

Download
memory/2728-18-0x0000000073500000-0x0000000073BEE000-memory.dmp

Filesize
6.9MB

Download
memory/2976-35-0x00000000735A0000-0x0000000073C8E000-memory.dmp

Filesize
6.9MB

Download
memory/2976-28-0x00000000735A0000-0x0000000073C8E000-memory.dmp

Filesize
6.9MB

Download
memory/2976-29-0x00000000019C0000-0x00000000019D0000-memory.dmp

Filesize
64KB

Download
memory/3460-51-0x00000000735A0000-0x0000000073C8E000-memory.dmp

Filesize
6.9MB

Download
memory/3460-46-0x0000000004F30000-0x0000000004F40000-memory.dmp

Filesize
64KB

Download
memory/3460-45-0x00000000735A0000-0x0000000073C8E000-memory.dmp

Filesize
6.9MB

Download
memory/4532-59-0x00000000735A0000-0x0000000073C8E000-memory.dmp

Filesize
6.9MB

Download
memory/4532-54-0x0000000004B50000-0x0000000004B60000-memory.dmp

Filesize
64KB

Download
memory/4532-53-0x00000000735A0000-0x0000000073C8E000-memory.dmp

Filesize
6.9MB

Download
memory/4704-7-0x00000000073F0000-0x0000000007466000-memory.dmp

Filesize
472KB

Download
memory/4704-5-0x00000000070B0000-0x00000000070B6000-memory.dmp

Filesize
24KB

Download
memory/4704-4-0x0000000007150000-0x00000000071E2000-memory.dmp

Filesize
584KB

Download
memory/4704-1-0x0000000073500000-0x0000000073BEE000-memory.dmp

Filesize
6.9MB

Download
memory/4704-3-0x00000000075B0000-0x0000000007AAE000-memory.dmp

Filesize
5.0MB

Download
memory/4704-2-0x0000000006FE0000-0x00000000070AC000-memory.dmp

Filesize
816KB

Download
memory/4704-0-0x00000000002E0000-0x0000000000336000-memory.dmp

Filesize
344KB

Download
memory/4704-6-0x0000000004B50000-0x0000000004B60000-memory.dmp

Filesize
64KB

Download
memory/4704-8-0x0000000007100000-0x000000000711E000-memory.dmp

Filesize
120KB

Download
memory/4704-15-0x0000000073500000-0x0000000073BEE000-memory.dmp

Filesize
6.9MB

Download
memory/4940-12-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/4940-9-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/4940-13-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads