Analysis

  • max time kernel
    140s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220310-en
  • submitted
    29-03-2022 18:19

General

  • Target

    74c0613165375c4ecc81a4398a0971f4e497e3f1f7f1f0987100af4565991b40.exe

  • Size

    718KB

  • MD5

    75a5844d899fa2a98c3c68a9b159d2b2

  • SHA1

    dd3768dd750ee5b26d522b591d1c8f34814a1141

  • SHA256

    74c0613165375c4ecc81a4398a0971f4e497e3f1f7f1f0987100af4565991b40

  • SHA512

    b6e0886f1b52047e000571902248b41a8209fa410ef8b4675d182904a755bd96268b59d842be25886406ead50f3497e8905a323c3cd469356ce548d7b3de3ade

Score
10/10

Malware Config

Extracted

Family

oski

C2

80.89.230.198

Signatures

  • Oski

    Oski is an infostealer targeting browser data, crypto wallets.

  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\74c0613165375c4ecc81a4398a0971f4e497e3f1f7f1f0987100af4565991b40.exe
    "C:\Users\Admin\AppData\Local\Temp\74c0613165375c4ecc81a4398a0971f4e497e3f1f7f1f0987100af4565991b40.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3668
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      2⤵
        PID:3980
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3980 -s 188
          3⤵
          • Program crash
          PID:1804
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3980 -ip 3980
      1⤵
        PID:408

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/3668-134-0x00000000005B0000-0x000000000066A000-memory.dmp

        Filesize

        744KB

      • memory/3668-135-0x0000000005630000-0x0000000005BD4000-memory.dmp

        Filesize

        5.6MB

      • memory/3668-136-0x0000000005080000-0x0000000005112000-memory.dmp

        Filesize

        584KB

      • memory/3668-137-0x0000000005020000-0x000000000502A000-memory.dmp

        Filesize

        40KB

      • memory/3980-139-0x0000000000400000-0x0000000000438000-memory.dmp

        Filesize

        224KB

      • memory/3980-140-0x0000000000400000-0x0000000000438000-memory.dmp

        Filesize

        224KB

      • memory/3980-141-0x0000000000400000-0x0000000000438000-memory.dmp

        Filesize

        224KB