Analysis

  • max time kernel
    45s
  • max time network
    45s
  • platform
    windows7_x64
  • resource
    win7-20220331-en
  • submitted
    04-04-2022 10:52

General

  • Target

    fatura comercial - Indaco EX20858 - OC00015.e.exe

  • Size

    842KB

  • MD5

    e9e7e3bdd64069d3b36e5362bbdcd155

  • SHA1

    8f96d2cd29ee2b7730245737547b7b67867bdd41

  • SHA256

    14a2149ffb9dc7a2bfa96e92ee4d7052222d5550431ffebc471b31859b397024

  • SHA512

    6449ad0e4adf50532336cf7ed7b7c9fa05d74548dc209097fcda50adf2351586ec77a17b4fac2a053599593552368dc8cf82756d300813b4dcc31814cca29174

Score
10/10

Malware Config

Extracted

Family

oski

C2

zubroxmack.cf

Signatures

  • Oski

    Oski is an infostealer targeting browser data, crypto wallets.

  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fatura comercial - Indaco EX20858 - OC00015.e.exe
    "C:\Users\Admin\AppData\Local\Temp\fatura comercial - Indaco EX20858 - OC00015.e.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1164
    • C:\Users\Admin\AppData\Local\Temp\fatura comercial - Indaco EX20858 - OC00015.e.exe
      "C:\Users\Admin\AppData\Local\Temp\fatura comercial - Indaco EX20858 - OC00015.e.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1532
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1532 -s 112
        3⤵
        • Program crash
        PID:1248

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1164-54-0x0000000000D20000-0x0000000000DF8000-memory.dmp

    Filesize

    864KB

  • memory/1164-55-0x0000000000610000-0x000000000061C000-memory.dmp

    Filesize

    48KB

  • memory/1164-56-0x00000000058B0000-0x000000000596A000-memory.dmp

    Filesize

    744KB

  • memory/1164-57-0x0000000004FA0000-0x000000000501A000-memory.dmp

    Filesize

    488KB

  • memory/1532-61-0x0000000000400000-0x0000000000438000-memory.dmp

    Filesize

    224KB

  • memory/1532-59-0x0000000000400000-0x0000000000438000-memory.dmp

    Filesize

    224KB

  • memory/1532-65-0x0000000000400000-0x0000000000438000-memory.dmp

    Filesize

    224KB

  • memory/1532-63-0x0000000000400000-0x0000000000438000-memory.dmp

    Filesize

    224KB

  • memory/1532-67-0x0000000000400000-0x0000000000438000-memory.dmp

    Filesize

    224KB

  • memory/1532-70-0x0000000000400000-0x0000000000438000-memory.dmp

    Filesize

    224KB

  • memory/1532-58-0x0000000000400000-0x0000000000438000-memory.dmp

    Filesize

    224KB