Overview

overview

10

Static

static

1

1EDE253254...56.exe

windows7_x64

10

1EDE253254...56.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    19-06-2022 11:47

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1EDE253254B0E22FE2178DB8CF7EE8249083C98178156.exe

  • Size

    323KB

  • MD5

    d16246db1c3abce64bcb4ed32fd151fd

  • SHA1

    7ba1ce14c3e2061bbb03022ca62a847b7aff3d4c

  • SHA256

    1ede253254b0e22fe2178db8cf7ee8249083c98178156e8500c8a87e588158f9

  • SHA512

    8a5d16b6dd3314a7923bac538c878122ec81f376d6deeaa5a06eb9f8bfa7b04a44c6b62cc8b221ccb890cc521e9f9596e4ec818da8ddb3e4baf0bf814caca5f4

Score
10/10
oskiinfostealerspywarestealersuricata

Malware Config

Extracted

Family

oski

C2

castroseguranca.com.br

Signatures

  • Oski

    Oski is an infostealer targeting browser data, crypto wallets.

    infostealeroski
  • suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern

    suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern

    suricata
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1EDE253254B0E22FE2178DB8CF7EE8249083C98178156.exe
    "C:\Users\Admin\AppData\Local\Temp\1EDE253254B0E22FE2178DB8CF7EE8249083C98178156.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:2384
    • C:\Users\Admin\AppData\Local\Temp\1EDE253254B0E22FE2178DB8CF7EE8249083C98178156.exe
      "C:\Users\Admin\AppData\Local\Temp\1EDE253254B0E22FE2178DB8CF7EE8249083C98178156.exe"
      2⤵
        PID:4020
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4020 -s 1560
          3⤵
          • Program crash
          PID:1960
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4020 -ip 4020
      1⤵
        PID:2560

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\nsd6BA1.tmp\System.dll
        Filesize

        11KB

        MD5

        fccff8cb7a1067e23fd2e2b63971a8e1

        SHA1

        30e2a9e137c1223a78a0f7b0bf96a1c361976d91

        SHA256

        6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e

        SHA512

        f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\nsd6BA1.tmp\System.dll
        Filesize

        11KB

        MD5

        fccff8cb7a1067e23fd2e2b63971a8e1

        SHA1

        30e2a9e137c1223a78a0f7b0bf96a1c361976d91

        SHA256

        6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e

        SHA512

        f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c

        Download Submit

      • memory/4020-133-0x0000000000400000-0x0000000000438000-memory.dmp

        Filesize

        224KB

        Download

      • memory/4020-134-0x0000000000400000-0x0000000000438000-memory.dmp

        Filesize

        224KB

        Download