Analysis
-
max time kernel
57s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220331-en -
submitted
04-04-2022 03:25
Static task
static1
Behavioral task
behavioral1
Sample
FLP_5012_306_171.exe
Resource
win7-20220331-en
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
FLP_5012_306_171.exe
Resource
win10v2004-20220331-en
0 signatures
0 seconds
General
-
Target
FLP_5012_306_171.exe
-
Size
379KB
-
MD5
a746c90dae245470777071a6c41dea07
-
SHA1
b9c256cb78dd83ff0ae5fe6755ff2e28096ff11d
-
SHA256
7376932014797e4b7f5a1c4776d865e1ba03cba69d9811f11a449c188157c918
-
SHA512
0e6717ade6830232c61650ad4e68334682b11aa0792bae093d62ba3f7ccb2a3371c84536a16f11c971160965df714f687a5b4d5aa52c8f8eb2dc01548e12b61a
Score
10/10
Malware Config
Extracted
Family
oski
C2
5azc.xyz
Signatures
-
Oski
Oski is an infostealer targeting browser data, crypto wallets.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1220 set thread context of 1068 1220 FLP_5012_306_171.exe 30 -
Program crash 1 IoCs
pid pid_target Process procid_target 956 1068 WerFault.exe 30 -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 1220 FLP_5012_306_171.exe 1220 FLP_5012_306_171.exe 1220 FLP_5012_306_171.exe 1220 FLP_5012_306_171.exe 1220 FLP_5012_306_171.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1220 FLP_5012_306_171.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 1220 wrote to memory of 2020 1220 FLP_5012_306_171.exe 28 PID 1220 wrote to memory of 2020 1220 FLP_5012_306_171.exe 28 PID 1220 wrote to memory of 2020 1220 FLP_5012_306_171.exe 28 PID 1220 wrote to memory of 2020 1220 FLP_5012_306_171.exe 28 PID 1220 wrote to memory of 2036 1220 FLP_5012_306_171.exe 29 PID 1220 wrote to memory of 2036 1220 FLP_5012_306_171.exe 29 PID 1220 wrote to memory of 2036 1220 FLP_5012_306_171.exe 29 PID 1220 wrote to memory of 2036 1220 FLP_5012_306_171.exe 29 PID 1220 wrote to memory of 1068 1220 FLP_5012_306_171.exe 30 PID 1220 wrote to memory of 1068 1220 FLP_5012_306_171.exe 30 PID 1220 wrote to memory of 1068 1220 FLP_5012_306_171.exe 30 PID 1220 wrote to memory of 1068 1220 FLP_5012_306_171.exe 30 PID 1220 wrote to memory of 1068 1220 FLP_5012_306_171.exe 30 PID 1220 wrote to memory of 1068 1220 FLP_5012_306_171.exe 30 PID 1220 wrote to memory of 1068 1220 FLP_5012_306_171.exe 30 PID 1220 wrote to memory of 1068 1220 FLP_5012_306_171.exe 30 PID 1220 wrote to memory of 1068 1220 FLP_5012_306_171.exe 30 PID 1220 wrote to memory of 1068 1220 FLP_5012_306_171.exe 30 PID 1068 wrote to memory of 956 1068 FLP_5012_306_171.exe 31 PID 1068 wrote to memory of 956 1068 FLP_5012_306_171.exe 31 PID 1068 wrote to memory of 956 1068 FLP_5012_306_171.exe 31 PID 1068 wrote to memory of 956 1068 FLP_5012_306_171.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\FLP_5012_306_171.exe"C:\Users\Admin\AppData\Local\Temp\FLP_5012_306_171.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\FLP_5012_306_171.exeC:\Users\Admin\AppData\Local\Temp\FLP_5012_306_171.exe2⤵PID:2020
-
-
C:\Users\Admin\AppData\Local\Temp\FLP_5012_306_171.exeC:\Users\Admin\AppData\Local\Temp\FLP_5012_306_171.exe2⤵PID:2036
-
-
C:\Users\Admin\AppData\Local\Temp\FLP_5012_306_171.exeC:\Users\Admin\AppData\Local\Temp\FLP_5012_306_171.exe2⤵
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1068 -s 1123⤵
- Program crash
PID:956
-
-