Analysis
-
max time kernel
91s -
max time network
94s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
03-05-2021 13:05
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exe
Resource
win10v20210410
General
-
Target
SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exe
-
Size
788KB
-
MD5
0f1616761218cc9712dcd268f4bb2d3f
-
SHA1
06a45e360bacea4a0e4ccb833986cb78bd40709a
-
SHA256
064ac9ba6695cc56f687e0a0a6bc06c30f4c8f5276e52630e7aa27b02ce8feab
-
SHA512
b40345c4cd4c20090eff7fed15d50187185b17f888dd4c8e211ff38ecd61cd572c9d2b1294031c967c37e8eeb93e80f17ca50aece5c63eb00c25ae5e25d243ec
Malware Config
Extracted
oski
5azc.xyz
Signatures
-
Oski
Oski is an infostealer targeting browser data, crypto wallets.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exedescription pid process target process PID 1840 set thread context of 1628 1840 SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exe SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 1 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 1556 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exepid process 1840 SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exe 1840 SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exetaskkill.exedescription pid process Token: SeDebugPrivilege 1840 SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exe Token: SeDebugPrivilege 1556 taskkill.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exeSecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.execmd.exedescription pid process target process PID 1840 wrote to memory of 1628 1840 SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exe SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exe PID 1840 wrote to memory of 1628 1840 SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exe SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exe PID 1840 wrote to memory of 1628 1840 SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exe SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exe PID 1840 wrote to memory of 1628 1840 SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exe SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exe PID 1840 wrote to memory of 1628 1840 SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exe SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exe PID 1840 wrote to memory of 1628 1840 SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exe SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exe PID 1840 wrote to memory of 1628 1840 SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exe SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exe PID 1840 wrote to memory of 1628 1840 SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exe SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exe PID 1840 wrote to memory of 1628 1840 SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exe SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exe PID 1840 wrote to memory of 1628 1840 SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exe SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exe PID 1628 wrote to memory of 1584 1628 SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exe cmd.exe PID 1628 wrote to memory of 1584 1628 SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exe cmd.exe PID 1628 wrote to memory of 1584 1628 SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exe cmd.exe PID 1628 wrote to memory of 1584 1628 SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exe cmd.exe PID 1584 wrote to memory of 1556 1584 cmd.exe taskkill.exe PID 1584 wrote to memory of 1556 1584 cmd.exe taskkill.exe PID 1584 wrote to memory of 1556 1584 cmd.exe taskkill.exe PID 1584 wrote to memory of 1556 1584 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exeC:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exe2⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /pid 1628 & erase C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.46209179.146' & RD /S /Q C:\\ProgramData\\527582739264497\\* & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /pid 16284⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1556-70-0x0000000000000000-mapping.dmp
-
memory/1584-69-0x0000000000000000-mapping.dmp
-
memory/1628-66-0x000000000040717B-mapping.dmp
-
memory/1628-65-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1628-67-0x00000000757C1000-0x00000000757C3000-memory.dmpFilesize
8KB
-
memory/1628-68-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1840-60-0x0000000001350000-0x0000000001351000-memory.dmpFilesize
4KB
-
memory/1840-62-0x0000000000A90000-0x0000000000A91000-memory.dmpFilesize
4KB
-
memory/1840-63-0x00000000011A0000-0x0000000001225000-memory.dmpFilesize
532KB
-
memory/1840-64-0x0000000000770000-0x000000000078D000-memory.dmpFilesize
116KB