Analysis
-
max time kernel
16s -
max time network
112s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
22-07-2021 07:45
Static task
static1
Behavioral task
behavioral1
Sample
c0fa9b79d5ff08641d2490f2942b205120e157e790bfb7540aaed7a0e69a1d49.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
c0fa9b79d5ff08641d2490f2942b205120e157e790bfb7540aaed7a0e69a1d49.exe
Resource
win10v20210408
General
-
Target
c0fa9b79d5ff08641d2490f2942b205120e157e790bfb7540aaed7a0e69a1d49.exe
-
Size
200KB
-
MD5
9c75d0a696028660f0f7333c2d3f5d8a
-
SHA1
3a3f86412b3d48bf9bf4f73fac3fc0d6c2a49293
-
SHA256
c0fa9b79d5ff08641d2490f2942b205120e157e790bfb7540aaed7a0e69a1d49
-
SHA512
58b1494fb5455e761ca99fdc80c6b648f23d1183355c0742ceb134bd0ac77a37385e736014319a1f801644ea741fab1ba9babb7b4323660f55870263c33bb000
Malware Config
Signatures
-
Oski
Oski is an infostealer targeting browser data, crypto wallets.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1240 532 WerFault.exe c0fa9b79d5ff08641d2490f2942b205120e157e790bfb7540aaed7a0e69a1d49.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
WerFault.exepid process 1240 WerFault.exe 1240 WerFault.exe 1240 WerFault.exe 1240 WerFault.exe 1240 WerFault.exe 1240 WerFault.exe 1240 WerFault.exe 1240 WerFault.exe 1240 WerFault.exe 1240 WerFault.exe 1240 WerFault.exe 1240 WerFault.exe 1240 WerFault.exe 1240 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WerFault.exedescription pid process Token: SeRestorePrivilege 1240 WerFault.exe Token: SeBackupPrivilege 1240 WerFault.exe Token: SeDebugPrivilege 1240 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c0fa9b79d5ff08641d2490f2942b205120e157e790bfb7540aaed7a0e69a1d49.exe"C:\Users\Admin\AppData\Local\Temp\c0fa9b79d5ff08641d2490f2942b205120e157e790bfb7540aaed7a0e69a1d49.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 532 -s 11762⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken