Analysis
-
max time kernel
117s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
01-02-2022 07:06
Static task
static1
Behavioral task
behavioral1
Sample
4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exe
Resource
win10v2004-en-20220112
General
-
Target
4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exe
-
Size
871KB
-
MD5
7380ccfe1c66527f163845b5532cf5db
-
SHA1
916cbf2b90d81317b4a8310a7b2ef0a8156faa7e
-
SHA256
4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1
-
SHA512
e9a94983c83cd419089caf87955f0767f97729c8ae713d98f4a343bb1caa6a963904753093da96b4574b96d706f8ec9c4f86ae4bd981135f34a9fa16a36f5eea
Malware Config
Extracted
oski
www.emailonlinechase.com
Signatures
-
Oski
Oski is an infostealer targeting browser data, crypto wallets.
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
Processes:
WerFault.exedescription pid process target process PID 1648 created 2516 1648 WerFault.exe 4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exe -
Sets service image path in registry 2 TTPs
-
Processes:
resource yara_rule behavioral2/memory/2848-130-0x0000000000DE0000-0x0000000000EA8000-memory.dmp vmprotect -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exedescription pid process target process PID 2848 set thread context of 2516 2848 4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exe 4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1928 2516 WerFault.exe 4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WerFault.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
WerFault.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe -
Modifies data under HKEY_USERS 41 IoCs
Processes:
WaaSMedicAgent.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exeWerFault.exepid process 2848 4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exe 2848 4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exe 1928 WerFault.exe 1928 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exeWerFault.exedescription pid process Token: SeDebugPrivilege 2848 4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exe Token: SeRestorePrivilege 1928 WerFault.exe Token: SeBackupPrivilege 1928 WerFault.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exeWerFault.exedescription pid process target process PID 2848 wrote to memory of 2244 2848 4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exe 4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exe PID 2848 wrote to memory of 2244 2848 4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exe 4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exe PID 2848 wrote to memory of 2244 2848 4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exe 4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exe PID 2848 wrote to memory of 2516 2848 4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exe 4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exe PID 2848 wrote to memory of 2516 2848 4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exe 4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exe PID 2848 wrote to memory of 2516 2848 4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exe 4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exe PID 2848 wrote to memory of 2516 2848 4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exe 4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exe PID 2848 wrote to memory of 2516 2848 4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exe 4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exe PID 2848 wrote to memory of 2516 2848 4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exe 4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exe PID 2848 wrote to memory of 2516 2848 4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exe 4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exe PID 2848 wrote to memory of 2516 2848 4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exe 4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exe PID 2848 wrote to memory of 2516 2848 4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exe 4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exe PID 1648 wrote to memory of 2516 1648 WerFault.exe 4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exe PID 1648 wrote to memory of 2516 1648 WerFault.exe 4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exe"C:\Users\Admin\AppData\Local\Temp\4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\4ae1f055edea4c9667047ce00c62924d58278e47ca8262725a89ae5c77354eb1.exe"{path}"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2516 -s 12923⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2516 -ip 25161⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe d2ca11ee1f5c9e216301f664cc4ce6a7 OCc6KrGzrkeGdk/2fP5osg.0.1.0.0.01⤵
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2516-136-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/2516-137-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/2848-130-0x0000000000DE0000-0x0000000000EA8000-memory.dmpFilesize
800KB
-
memory/2848-131-0x0000000005DF0000-0x0000000006394000-memory.dmpFilesize
5.6MB
-
memory/2848-132-0x00000000058E0000-0x0000000005972000-memory.dmpFilesize
584KB
-
memory/2848-133-0x00000000057F0000-0x0000000005821000-memory.dmpFilesize
196KB
-
memory/2848-134-0x0000000005890000-0x000000000589A000-memory.dmpFilesize
40KB
-
memory/2848-135-0x0000000007980000-0x0000000007A1C000-memory.dmpFilesize
624KB