Analysis

  • max time kernel
    85s
  • max time network
    114s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    02/08/2021, 06:03

General

  • Target

    8663ed0caec9adcb980a4a7ea23e7984.exe

  • Size

    1.3MB

  • MD5

    8663ed0caec9adcb980a4a7ea23e7984

  • SHA1

    e6dcb19362e88b50ab1990e7032437072f104e98

  • SHA256

    bbe006688e5f74473a5e248bc83651cbb7e9efbe8410abb8d8b84b4a59ed7750

  • SHA512

    fd75e6bde035e103e84322411ca7b4107f1673d03170b940af3066f9f4eb58b063ec244302c8dccab87f5816e2b55a177dc1c1d7f498742fd8e0f24fb64317a9

Malware Config

Extracted

Family

oski

C2

fine.le-pearl.com

Signatures

  • Oski

    Oski is an infostealer targeting browser data, crypto wallets.

  • suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
  • suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 1 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Kills process with taskkill 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8663ed0caec9adcb980a4a7ea23e7984.exe
    "C:\Users\Admin\AppData\Local\Temp\8663ed0caec9adcb980a4a7ea23e7984.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2112
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\8663ed0caec9adcb980a4a7ea23e7984.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1768
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ImauUieIe.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2072
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ImauUieIe" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD121.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:2276
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ImauUieIe.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3968
    • C:\Users\Admin\AppData\Local\Temp\8663ed0caec9adcb980a4a7ea23e7984.exe
      "C:\Users\Admin\AppData\Local\Temp\8663ed0caec9adcb980a4a7ea23e7984.exe"
      2⤵
      • Checks processor information in registry
      • Suspicious use of WriteProcessMemory
      PID:2416
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c taskkill /pid 2416 & erase C:\Users\Admin\AppData\Local\Temp\8663ed0caec9adcb980a4a7ea23e7984.exe & RD /S /Q C:\\ProgramData\\150367815699766\\* & exit
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4076
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /pid 2416
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3424

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1768-129-0x0000000006EC0000-0x0000000006EC1000-memory.dmp

          Filesize

          4KB

        • memory/1768-205-0x000000007F730000-0x000000007F731000-memory.dmp

          Filesize

          4KB

        • memory/1768-152-0x0000000007012000-0x0000000007013000-memory.dmp

          Filesize

          4KB

        • memory/1768-247-0x0000000007013000-0x0000000007014000-memory.dmp

          Filesize

          4KB

        • memory/1768-146-0x0000000007010000-0x0000000007011000-memory.dmp

          Filesize

          4KB

        • memory/1768-132-0x0000000007650000-0x0000000007651000-memory.dmp

          Filesize

          4KB

        • memory/2072-153-0x0000000006EA0000-0x0000000006EA1000-memory.dmp

          Filesize

          4KB

        • memory/2072-139-0x0000000007210000-0x0000000007211000-memory.dmp

          Filesize

          4KB

        • memory/2072-201-0x000000007E920000-0x000000007E921000-memory.dmp

          Filesize

          4KB

        • memory/2072-188-0x0000000009160000-0x0000000009193000-memory.dmp

          Filesize

          204KB

        • memory/2072-168-0x0000000008390000-0x0000000008391000-memory.dmp

          Filesize

          4KB

        • memory/2072-164-0x0000000008640000-0x0000000008641000-memory.dmp

          Filesize

          4KB

        • memory/2072-244-0x0000000006EA3000-0x0000000006EA4000-memory.dmp

          Filesize

          4KB

        • memory/2072-141-0x00000000073B0000-0x00000000073B1000-memory.dmp

          Filesize

          4KB

        • memory/2072-144-0x0000000007420000-0x0000000007421000-memory.dmp

          Filesize

          4KB

        • memory/2072-162-0x0000000007B30000-0x0000000007B31000-memory.dmp

          Filesize

          4KB

        • memory/2072-226-0x00000000092B0000-0x00000000092B1000-memory.dmp

          Filesize

          4KB

        • memory/2072-148-0x0000000007D60000-0x0000000007D61000-memory.dmp

          Filesize

          4KB

        • memory/2072-210-0x0000000009140000-0x0000000009141000-memory.dmp

          Filesize

          4KB

        • memory/2072-155-0x0000000006EA2000-0x0000000006EA3000-memory.dmp

          Filesize

          4KB

        • memory/2112-120-0x0000000005820000-0x0000000005821000-memory.dmp

          Filesize

          4KB

        • memory/2112-117-0x0000000005430000-0x0000000005431000-memory.dmp

          Filesize

          4KB

        • memory/2112-118-0x0000000005580000-0x0000000005A7E000-memory.dmp

          Filesize

          5.0MB

        • memory/2112-119-0x0000000005410000-0x0000000005411000-memory.dmp

          Filesize

          4KB

        • memory/2112-114-0x0000000000AB0000-0x0000000000AB1000-memory.dmp

          Filesize

          4KB

        • memory/2112-121-0x0000000002ED0000-0x0000000002EDD000-memory.dmp

          Filesize

          52KB

        • memory/2112-122-0x00000000081D0000-0x000000000826A000-memory.dmp

          Filesize

          616KB

        • memory/2112-123-0x0000000008180000-0x00000000081B3000-memory.dmp

          Filesize

          204KB

        • memory/2112-116-0x0000000005A80000-0x0000000005A81000-memory.dmp

          Filesize

          4KB

        • memory/2416-156-0x0000000000400000-0x0000000000438000-memory.dmp

          Filesize

          224KB

        • memory/2416-137-0x0000000000400000-0x0000000000438000-memory.dmp

          Filesize

          224KB

        • memory/3968-209-0x000000007F3A0000-0x000000007F3A1000-memory.dmp

          Filesize

          4KB

        • memory/3968-157-0x0000000004990000-0x0000000004991000-memory.dmp

          Filesize

          4KB

        • memory/3968-246-0x0000000004993000-0x0000000004994000-memory.dmp

          Filesize

          4KB

        • memory/3968-150-0x0000000004992000-0x0000000004993000-memory.dmp

          Filesize

          4KB