Static task
static1
Behavioral task
behavioral1
Sample
4636-136-0x0000000000400000-0x0000000000439000-memory.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
4636-136-0x0000000000400000-0x0000000000439000-memory.exe
Resource
win10v2004-20220414-en
General
-
Target
4636-136-0x0000000000400000-0x0000000000439000-memory.dmp
-
Size
228KB
-
MD5
2324218f3d201c74e1ad5996db27fb5c
-
SHA1
87378e21abb1e107a3fbbda89189cfb4fb63e290
-
SHA256
51a5adc2e556c1fcc60ed5b2d83438b183f7f7e042abf4341d65f4277aab6190
-
SHA512
d906b920ee711591c9b36528831295081e63cddb60ce3f2a5d6c498a8d7d8e4396ec7cc538c8b3660e8c4546b89aaa992d2c0b4018152408ab74542b0b1b04e6
-
SSDEEP
3072:1fUomEuYm98dlSq7gt5q7Dx+XgS6aCEwhOfUbCalNT2pbB3fIq1Xi6FLPbm3c:1fUauY68uSWCx+XA7mg2pNf1Ljq3c
Malware Config
Extracted
oski
lettingos.co.vu
Signatures
-
Oski family
Files
-
4636-136-0x0000000000400000-0x0000000000439000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 150KB - Virtual size: 150KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 32KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 960B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ