Overview

overview

10

Static

static

1

1EDE253254...56.exe

windows7_x64

10

1EDE253254...56.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    44s
  • max time network
    48s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    19-06-2022 11:47

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1EDE253254B0E22FE2178DB8CF7EE8249083C98178156.exe

  • Size

    323KB

  • MD5

    d16246db1c3abce64bcb4ed32fd151fd

  • SHA1

    7ba1ce14c3e2061bbb03022ca62a847b7aff3d4c

  • SHA256

    1ede253254b0e22fe2178db8cf7ee8249083c98178156e8500c8a87e588158f9

  • SHA512

    8a5d16b6dd3314a7923bac538c878122ec81f376d6deeaa5a06eb9f8bfa7b04a44c6b62cc8b221ccb890cc521e9f9596e4ec818da8ddb3e4baf0bf814caca5f4

Score
10/10
oskiinfostealerspywarestealersuricata

Malware Config

Extracted

Family

oski

C2

castroseguranca.com.br

Signatures

  • Oski

    Oski is an infostealer targeting browser data, crypto wallets.

    infostealeroski
  • suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern

    suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern

    suricata
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1EDE253254B0E22FE2178DB8CF7EE8249083C98178156.exe
    "C:\Users\Admin\AppData\Local\Temp\1EDE253254B0E22FE2178DB8CF7EE8249083C98178156.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:1668
    • C:\Users\Admin\AppData\Local\Temp\1EDE253254B0E22FE2178DB8CF7EE8249083C98178156.exe
      "C:\Users\Admin\AppData\Local\Temp\1EDE253254B0E22FE2178DB8CF7EE8249083C98178156.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1488
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1488 -s 960
        3⤵
        • Program crash
        PID:1632

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\nsoEF42.tmp\System.dll
    Filesize

    11KB

    MD5

    fccff8cb7a1067e23fd2e2b63971a8e1

    SHA1

    30e2a9e137c1223a78a0f7b0bf96a1c361976d91

    SHA256

    6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e

    SHA512

    f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c

    Download Submit
  • \Users\Admin\AppData\Local\Temp\nsoEF42.tmp\System.dll
    Filesize

    11KB

    MD5

    fccff8cb7a1067e23fd2e2b63971a8e1

    SHA1

    30e2a9e137c1223a78a0f7b0bf96a1c361976d91

    SHA256

    6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e

    SHA512

    f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c

    Download Submit
  • memory/1488-57-0x000000000040717B-mapping.dmp
    Download
  • memory/1488-59-0x0000000000400000-0x0000000000438000-memory.dmp
    Filesize

    224KB

    Download
  • memory/1488-61-0x0000000000400000-0x0000000000438000-memory.dmp
    Filesize

    224KB

    Download
  • memory/1632-60-0x0000000000000000-mapping.dmp
    Download
  • memory/1668-54-0x00000000762C1000-0x00000000762C3000-memory.dmp
    Filesize

    8KB

    Download