Analysis
-
max time kernel
9s -
max time network
41s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
03/08/2021, 21:06
Static task
static1
Behavioral task
behavioral1
Sample
345E98E236BE7FF4C4943C2FE64D4A5D.exe
Resource
win7v20210410
General
-
Target
345E98E236BE7FF4C4943C2FE64D4A5D.exe
-
Size
200KB
-
MD5
345e98e236be7ff4c4943c2fe64d4a5d
-
SHA1
62d6c63921c4d8346f0e4d9ebead6a89799fc62d
-
SHA256
69f41c2c444cd2147188d547c5edd6a4a8e2f238df52e1709dc7bb1066232ecc
-
SHA512
77cf59a04f3920d9d79dc7912a32d56f630753d8fac4c77efeb8f1b42ba914ba9e6980e11bf1b393760cd57e59e9cd2676ddb6db9fda6fe6c9d111b9adb0d68f
Malware Config
Signatures
-
Oski
Oski is an infostealer targeting browser data, crypto wallets.
-
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
-
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
-
Downloads MZ/PE file
-
Deletes itself 1 IoCs
pid Process 1964 cmd.exe -
Loads dropped DLL 5 IoCs
pid Process 1208 345E98E236BE7FF4C4943C2FE64D4A5D.exe 1208 345E98E236BE7FF4C4943C2FE64D4A5D.exe 1208 345E98E236BE7FF4C4943C2FE64D4A5D.exe 1208 345E98E236BE7FF4C4943C2FE64D4A5D.exe 1208 345E98E236BE7FF4C4943C2FE64D4A5D.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 1 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 345E98E236BE7FF4C4943C2FE64D4A5D.exe -
Kills process with taskkill 1 IoCs
pid Process 2008 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2008 taskkill.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1208 wrote to memory of 1964 1208 345E98E236BE7FF4C4943C2FE64D4A5D.exe 31 PID 1208 wrote to memory of 1964 1208 345E98E236BE7FF4C4943C2FE64D4A5D.exe 31 PID 1208 wrote to memory of 1964 1208 345E98E236BE7FF4C4943C2FE64D4A5D.exe 31 PID 1208 wrote to memory of 1964 1208 345E98E236BE7FF4C4943C2FE64D4A5D.exe 31 PID 1964 wrote to memory of 2008 1964 cmd.exe 33 PID 1964 wrote to memory of 2008 1964 cmd.exe 33 PID 1964 wrote to memory of 2008 1964 cmd.exe 33 PID 1964 wrote to memory of 2008 1964 cmd.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\345E98E236BE7FF4C4943C2FE64D4A5D.exe"C:\Users\Admin\AppData\Local\Temp\345E98E236BE7FF4C4943C2FE64D4A5D.exe"1⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /pid 1208 & erase C:\Users\Admin\AppData\Local\Temp\345E98E236BE7FF4C4943C2FE64D4A5D.exe & RD /S /Q C:\\ProgramData\\534974996079675\\* & exit2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Windows\SysWOW64\taskkill.exetaskkill /pid 12083⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2008
-
-