Analysis
-
max time kernel
140s -
max time network
141s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
03-05-2021 13:05
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exe
Resource
win10v20210410
General
-
Target
SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exe
-
Size
788KB
-
MD5
0f1616761218cc9712dcd268f4bb2d3f
-
SHA1
06a45e360bacea4a0e4ccb833986cb78bd40709a
-
SHA256
064ac9ba6695cc56f687e0a0a6bc06c30f4c8f5276e52630e7aa27b02ce8feab
-
SHA512
b40345c4cd4c20090eff7fed15d50187185b17f888dd4c8e211ff38ecd61cd572c9d2b1294031c967c37e8eeb93e80f17ca50aece5c63eb00c25ae5e25d243ec
Malware Config
Extracted
oski
5azc.xyz
Signatures
-
Oski
Oski is an infostealer targeting browser data, crypto wallets.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exedescription pid process target process PID 4020 set thread context of 2696 4020 SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exe SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 1 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 3904 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exepid process 4020 SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exe 4020 SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exe 4020 SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exe 4020 SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exe 4020 SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exe 4020 SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exetaskkill.exedescription pid process Token: SeDebugPrivilege 4020 SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exe Token: SeDebugPrivilege 3904 taskkill.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exeSecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.execmd.exedescription pid process target process PID 4020 wrote to memory of 2652 4020 SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exe SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exe PID 4020 wrote to memory of 2652 4020 SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exe SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exe PID 4020 wrote to memory of 2652 4020 SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exe SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exe PID 4020 wrote to memory of 2696 4020 SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exe SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exe PID 4020 wrote to memory of 2696 4020 SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exe SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exe PID 4020 wrote to memory of 2696 4020 SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exe SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exe PID 4020 wrote to memory of 2696 4020 SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exe SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exe PID 4020 wrote to memory of 2696 4020 SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exe SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exe PID 4020 wrote to memory of 2696 4020 SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exe SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exe PID 4020 wrote to memory of 2696 4020 SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exe SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exe PID 4020 wrote to memory of 2696 4020 SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exe SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exe PID 4020 wrote to memory of 2696 4020 SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exe SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exe PID 2696 wrote to memory of 2116 2696 SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exe cmd.exe PID 2696 wrote to memory of 2116 2696 SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exe cmd.exe PID 2696 wrote to memory of 2116 2696 SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exe cmd.exe PID 2116 wrote to memory of 3904 2116 cmd.exe taskkill.exe PID 2116 wrote to memory of 3904 2116 cmd.exe taskkill.exe PID 2116 wrote to memory of 3904 2116 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exeC:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exeC:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.46209179.14691.15796.exe2⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /pid 2696 & erase C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.46209179.146' & RD /S /Q C:\\ProgramData\\264608598077131\\* & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /pid 26964⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2116-125-0x0000000000000000-mapping.dmp
-
memory/2696-122-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2696-123-0x000000000040717B-mapping.dmp
-
memory/2696-124-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/3904-126-0x0000000000000000-mapping.dmp
-
memory/4020-114-0x0000000000270000-0x0000000000271000-memory.dmpFilesize
4KB
-
memory/4020-116-0x0000000005180000-0x0000000005181000-memory.dmpFilesize
4KB
-
memory/4020-117-0x0000000004C80000-0x0000000004C81000-memory.dmpFilesize
4KB
-
memory/4020-118-0x0000000004C60000-0x0000000004C61000-memory.dmpFilesize
4KB
-
memory/4020-119-0x0000000004C70000-0x0000000004C71000-memory.dmpFilesize
4KB
-
memory/4020-120-0x00000000074A0000-0x0000000007525000-memory.dmpFilesize
532KB
-
memory/4020-121-0x0000000007530000-0x000000000754D000-memory.dmpFilesize
116KB