Analysis
-
max time kernel
144s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20220331-en -
submitted
04-04-2022 03:25
Static task
static1
Behavioral task
behavioral1
Sample
FLP_5012_306_171.exe
Resource
win7-20220331-en
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
FLP_5012_306_171.exe
Resource
win10v2004-20220331-en
0 signatures
0 seconds
General
-
Target
FLP_5012_306_171.exe
-
Size
379KB
-
MD5
a746c90dae245470777071a6c41dea07
-
SHA1
b9c256cb78dd83ff0ae5fe6755ff2e28096ff11d
-
SHA256
7376932014797e4b7f5a1c4776d865e1ba03cba69d9811f11a449c188157c918
-
SHA512
0e6717ade6830232c61650ad4e68334682b11aa0792bae093d62ba3f7ccb2a3371c84536a16f11c971160965df714f687a5b4d5aa52c8f8eb2dc01548e12b61a
Score
10/10
Malware Config
Extracted
Family
oski
C2
5azc.xyz
Signatures
-
Oski
Oski is an infostealer targeting browser data, crypto wallets.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4644 set thread context of 3640 4644 FLP_5012_306_171.exe 84 -
Program crash 1 IoCs
pid pid_target Process procid_target 1728 3640 WerFault.exe 84 -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4644 FLP_5012_306_171.exe 4644 FLP_5012_306_171.exe 4644 FLP_5012_306_171.exe 4644 FLP_5012_306_171.exe 4644 FLP_5012_306_171.exe 4644 FLP_5012_306_171.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4644 FLP_5012_306_171.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4644 wrote to memory of 748 4644 FLP_5012_306_171.exe 83 PID 4644 wrote to memory of 748 4644 FLP_5012_306_171.exe 83 PID 4644 wrote to memory of 748 4644 FLP_5012_306_171.exe 83 PID 4644 wrote to memory of 3640 4644 FLP_5012_306_171.exe 84 PID 4644 wrote to memory of 3640 4644 FLP_5012_306_171.exe 84 PID 4644 wrote to memory of 3640 4644 FLP_5012_306_171.exe 84 PID 4644 wrote to memory of 3640 4644 FLP_5012_306_171.exe 84 PID 4644 wrote to memory of 3640 4644 FLP_5012_306_171.exe 84 PID 4644 wrote to memory of 3640 4644 FLP_5012_306_171.exe 84 PID 4644 wrote to memory of 3640 4644 FLP_5012_306_171.exe 84 PID 4644 wrote to memory of 3640 4644 FLP_5012_306_171.exe 84 PID 4644 wrote to memory of 3640 4644 FLP_5012_306_171.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\FLP_5012_306_171.exe"C:\Users\Admin\AppData\Local\Temp\FLP_5012_306_171.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\FLP_5012_306_171.exeC:\Users\Admin\AppData\Local\Temp\FLP_5012_306_171.exe2⤵PID:748
-
-
C:\Users\Admin\AppData\Local\Temp\FLP_5012_306_171.exeC:\Users\Admin\AppData\Local\Temp\FLP_5012_306_171.exe2⤵PID:3640
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3640 -s 2363⤵
- Program crash
PID:1728
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3640 -ip 36401⤵PID:2032