Analysis
-
max time kernel
119s -
max time network
125s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
01-02-2022 07:06
Static task
static1
Behavioral task
behavioral1
Sample
4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exe
Resource
win10v2004-en-20220112
General
-
Target
4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exe
-
Size
871KB
-
MD5
7380ccfe1c66527f163845b5532cf5db
-
SHA1
916cbf2b90d81317b4a8310a7b2ef0a8156faa7e
-
SHA256
4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1
-
SHA512
e9a94983c83cd419089caf87955f0767f97729c8ae713d98f4a343bb1caa6a963904753093da96b4574b96d706f8ec9c4f86ae4bd981135f34a9fa16a36f5eea
Malware Config
Extracted
oski
www.emailonlinechase.com
Signatures
-
Oski
Oski is an infostealer targeting browser data, crypto wallets.
-
ReZer0 packer 1 IoCs
Detects ReZer0, a packer with multiple versions used in various campaigns.
Processes:
resource yara_rule behavioral1/memory/1636-57-0x00000000006F0000-0x000000000072C000-memory.dmp rezer0 -
Processes:
resource yara_rule behavioral1/memory/1636-54-0x0000000000080000-0x0000000000148000-memory.dmp vmprotect -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exedescription pid process target process PID 1636 set thread context of 852 1636 4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exe 4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1808 852 WerFault.exe 4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exeWerFault.exepid process 1636 4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exe 1808 WerFault.exe 1808 WerFault.exe 1808 WerFault.exe 1808 WerFault.exe 1808 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exeWerFault.exedescription pid process Token: SeDebugPrivilege 1636 4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exe Token: SeDebugPrivilege 1808 WerFault.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exe4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exedescription pid process target process PID 1636 wrote to memory of 1076 1636 4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exe 4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exe PID 1636 wrote to memory of 1076 1636 4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exe 4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exe PID 1636 wrote to memory of 1076 1636 4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exe 4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exe PID 1636 wrote to memory of 1076 1636 4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exe 4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exe PID 1636 wrote to memory of 852 1636 4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exe 4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exe PID 1636 wrote to memory of 852 1636 4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exe 4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exe PID 1636 wrote to memory of 852 1636 4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exe 4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exe PID 1636 wrote to memory of 852 1636 4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exe 4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exe PID 1636 wrote to memory of 852 1636 4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exe 4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exe PID 1636 wrote to memory of 852 1636 4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exe 4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exe PID 1636 wrote to memory of 852 1636 4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exe 4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exe PID 1636 wrote to memory of 852 1636 4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exe 4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exe PID 1636 wrote to memory of 852 1636 4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exe 4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exe PID 1636 wrote to memory of 852 1636 4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exe 4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exe PID 852 wrote to memory of 1808 852 4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exe WerFault.exe PID 852 wrote to memory of 1808 852 4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exe WerFault.exe PID 852 wrote to memory of 1808 852 4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exe WerFault.exe PID 852 wrote to memory of 1808 852 4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exe"C:\Users\Admin\AppData\Local\Temp\4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exe"{path}"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 852 -s 8603⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/852-58-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/852-59-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/852-61-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/852-60-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/852-62-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/852-63-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/852-65-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/1636-54-0x0000000000080000-0x0000000000148000-memory.dmpFilesize
800KB
-
memory/1636-55-0x0000000075021000-0x0000000075023000-memory.dmpFilesize
8KB
-
memory/1636-56-0x0000000004EF0000-0x0000000004EF1000-memory.dmpFilesize
4KB
-
memory/1636-57-0x00000000006F0000-0x000000000072C000-memory.dmpFilesize
240KB
-
memory/1808-67-0x0000000000510000-0x0000000000511000-memory.dmpFilesize
4KB