Analysis

  • max time kernel
    135s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    29-03-2022 18:53

General

  • Target

    9eda629d972e72de604e574465b035dece9b8b8d842c8bfa295f37aa16aa00fc.exe

  • Size

    459KB

  • MD5

    a44fb506c742cdff42f37356502c3298

  • SHA1

    674e8729f2598cd7e34d2d07b5ab2ff53b638c37

  • SHA256

    9eda629d972e72de604e574465b035dece9b8b8d842c8bfa295f37aa16aa00fc

  • SHA512

    8fa4c6d8e693189d494d5746954b9919c821989cd1f767b26737869f26e4c2cfab2c1771f01a752883c4201169b7efa070662d958d3c0e4958772d22b8f959e1

Score
10/10

Malware Config

Extracted

Family

oski

C2

4llion.com

Signatures

  • Oski

    Oski is an infostealer targeting browser data, crypto wallets.

  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9eda629d972e72de604e574465b035dece9b8b8d842c8bfa295f37aa16aa00fc.exe
    "C:\Users\Admin\AppData\Local\Temp\9eda629d972e72de604e574465b035dece9b8b8d842c8bfa295f37aa16aa00fc.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:624
    • C:\Users\Admin\AppData\Local\Temp\9eda629d972e72de604e574465b035dece9b8b8d842c8bfa295f37aa16aa00fc.exe
      "C:\Users\Admin\AppData\Local\Temp\9eda629d972e72de604e574465b035dece9b8b8d842c8bfa295f37aa16aa00fc.exe"
      2⤵
        PID:3492
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3492 -s 244
          3⤵
          • Program crash
          PID:1292
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3492 -ip 3492
      1⤵
        PID:2296

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/624-130-0x00000000006B0000-0x0000000000724000-memory.dmp

        Filesize

        464KB

      • memory/624-131-0x0000000005110000-0x0000000005176000-memory.dmp

        Filesize

        408KB

      • memory/3492-133-0x0000000000400000-0x0000000000438000-memory.dmp

        Filesize

        224KB

      • memory/3492-134-0x0000000000400000-0x0000000000438000-memory.dmp

        Filesize

        224KB

      • memory/3492-135-0x0000000000400000-0x0000000000438000-memory.dmp

        Filesize

        224KB