Analysis
-
max time kernel
132s -
max time network
130s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
03-05-2021 12:23
Static task
static1
Behavioral task
behavioral1
Sample
purchase order acknowledgement.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
purchase order acknowledgement.exe
Resource
win10v20210408
General
-
Target
purchase order acknowledgement.exe
-
Size
828KB
-
MD5
2756cff6b7da163940d5157bf9df7ece
-
SHA1
6665087ac729b5c9dc9dc9e920513b07794fbce6
-
SHA256
a9e2cff74c2afe7a6d87d7cb25bc41f044f8b492541729fb1503408b7ede6fa2
-
SHA512
3bc6544a70797079b85f06489fb213ad820612e1d25f069384a09b5e8e63107f30ef9fbe5da70c10e2d91767f746425a002552fd2d41b11095982241537914a3
Malware Config
Extracted
oski
31.210.21.181
Signatures
-
Oski
Oski is an infostealer targeting browser data, crypto wallets.
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
700107764460.exepid process 1332 700107764460.exe -
Loads dropped DLL 3 IoCs
Processes:
purchase order acknowledgement.exepid process 528 purchase order acknowledgement.exe 528 purchase order acknowledgement.exe 528 purchase order acknowledgement.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
purchase order acknowledgement.exedescription pid process target process PID 604 set thread context of 528 604 purchase order acknowledgement.exe purchase order acknowledgement.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 1 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
purchase order acknowledgement.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString purchase order acknowledgement.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 708 taskkill.exe -
NTFS ADS 1 IoCs
Processes:
purchase order acknowledgement.exedescription ioc process File created C:\ProgramData\700107764460.exe:Zone.Identifier purchase order acknowledgement.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 708 taskkill.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
purchase order acknowledgement.exepurchase order acknowledgement.execmd.exedescription pid process target process PID 604 wrote to memory of 528 604 purchase order acknowledgement.exe purchase order acknowledgement.exe PID 604 wrote to memory of 528 604 purchase order acknowledgement.exe purchase order acknowledgement.exe PID 604 wrote to memory of 528 604 purchase order acknowledgement.exe purchase order acknowledgement.exe PID 604 wrote to memory of 528 604 purchase order acknowledgement.exe purchase order acknowledgement.exe PID 604 wrote to memory of 528 604 purchase order acknowledgement.exe purchase order acknowledgement.exe PID 604 wrote to memory of 528 604 purchase order acknowledgement.exe purchase order acknowledgement.exe PID 604 wrote to memory of 528 604 purchase order acknowledgement.exe purchase order acknowledgement.exe PID 604 wrote to memory of 528 604 purchase order acknowledgement.exe purchase order acknowledgement.exe PID 604 wrote to memory of 528 604 purchase order acknowledgement.exe purchase order acknowledgement.exe PID 528 wrote to memory of 1332 528 purchase order acknowledgement.exe 700107764460.exe PID 528 wrote to memory of 1332 528 purchase order acknowledgement.exe 700107764460.exe PID 528 wrote to memory of 1332 528 purchase order acknowledgement.exe 700107764460.exe PID 528 wrote to memory of 3884 528 purchase order acknowledgement.exe cmd.exe PID 528 wrote to memory of 3884 528 purchase order acknowledgement.exe cmd.exe PID 528 wrote to memory of 3884 528 purchase order acknowledgement.exe cmd.exe PID 3884 wrote to memory of 708 3884 cmd.exe taskkill.exe PID 3884 wrote to memory of 708 3884 cmd.exe taskkill.exe PID 3884 wrote to memory of 708 3884 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\purchase order acknowledgement.exe"C:\Users\Admin\AppData\Local\Temp\purchase order acknowledgement.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\purchase order acknowledgement.exe"C:\Users\Admin\AppData\Local\Temp\purchase order acknowledgement.exe"2⤵
- Loads dropped DLL
- Checks processor information in registry
- NTFS ADS
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\700107764460.exe"C:\ProgramData\700107764460.exe"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /pid 528 & erase C:\Users\Admin\AppData\Local\Temp\purchase order acknowledgement.exe & RD /S /Q C:\\ProgramData\\633562659973907\\* & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /pid 5284⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\700107764460.exeMD5
0d50c8e7c3f044099056bfb318f108c6
SHA1538871e91c9cac38af31bd09fe456843d841f586
SHA25691f6fc2ae99e090dad56e53c7bf258dd4f43df79ac02a11f2620c31f045fc87f
SHA5125364611735fe235a94a0339eae7511472eeab0b892e9e1a17da46f23802f82c4c2b225bed37953226a1b8b84d6711f16eee15f28254d5a4d68bc26e378b7c7ad
-
C:\ProgramData\700107764460.exeMD5
0d50c8e7c3f044099056bfb318f108c6
SHA1538871e91c9cac38af31bd09fe456843d841f586
SHA25691f6fc2ae99e090dad56e53c7bf258dd4f43df79ac02a11f2620c31f045fc87f
SHA5125364611735fe235a94a0339eae7511472eeab0b892e9e1a17da46f23802f82c4c2b225bed37953226a1b8b84d6711f16eee15f28254d5a4d68bc26e378b7c7ad
-
\ProgramData\mozglue.dllMD5
8f73c08a9660691143661bf7332c3c27
SHA137fa65dd737c50fda710fdbde89e51374d0c204a
SHA2563fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd
SHA5120042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89
-
\ProgramData\nss3.dllMD5
bfac4e3c5908856ba17d41edcd455a51
SHA18eec7e888767aa9e4cca8ff246eb2aacb9170428
SHA256e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78
SHA5122565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66
-
\ProgramData\sqlite3.dllMD5
e477a96c8f2b18d6b5c27bde49c990bf
SHA1e980c9bf41330d1e5bd04556db4646a0210f7409
SHA25616574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660
SHA512335a86268e7c0e568b1c30981ec644e6cd332e66f96d2551b58a82515316693c1859d87b4f4b7310cf1ac386cee671580fdd999c3bcb23acf2c2282c01c8798c
-
memory/528-125-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/528-126-0x000000000040717B-mapping.dmp
-
memory/528-127-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/604-119-0x0000000005080000-0x0000000005081000-memory.dmpFilesize
4KB
-
memory/604-118-0x00000000051E0000-0x00000000051E1000-memory.dmpFilesize
4KB
-
memory/604-114-0x0000000000660000-0x0000000000661000-memory.dmpFilesize
4KB
-
memory/604-123-0x0000000000FE0000-0x000000000105A000-memory.dmpFilesize
488KB
-
memory/604-122-0x0000000005520000-0x000000000552E000-memory.dmpFilesize
56KB
-
memory/604-120-0x0000000005340000-0x0000000005341000-memory.dmpFilesize
4KB
-
memory/604-121-0x00000000051E0000-0x00000000056DE000-memory.dmpFilesize
5.0MB
-
memory/604-124-0x00000000011A0000-0x00000000011DB000-memory.dmpFilesize
236KB
-
memory/604-116-0x0000000005140000-0x0000000005141000-memory.dmpFilesize
4KB
-
memory/604-117-0x00000000056E0000-0x00000000056E1000-memory.dmpFilesize
4KB
-
memory/708-143-0x0000000000000000-mapping.dmp
-
memory/1332-131-0x0000000000000000-mapping.dmp
-
memory/1332-134-0x0000000000150000-0x0000000000151000-memory.dmpFilesize
4KB
-
memory/1332-144-0x0000000004B60000-0x000000000505E000-memory.dmpFilesize
5.0MB
-
memory/3884-142-0x0000000000000000-mapping.dmp