Analysis
-
max time kernel
98s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
25-06-2022 02:25
Static task
static1
Behavioral task
behavioral1
Sample
49255a7e201aebbd0dfd7e9384ada9d184f2fcdacbb054a897be53833b8a2f47.exe
Resource
win7-20220414-en
General
-
Target
49255a7e201aebbd0dfd7e9384ada9d184f2fcdacbb054a897be53833b8a2f47.exe
-
Size
2.1MB
-
MD5
983654c42c7dbcfe606794d50dd06ace
-
SHA1
da0da07d82a7faee3d2d5b045b0eeb9b7d7aa855
-
SHA256
49255a7e201aebbd0dfd7e9384ada9d184f2fcdacbb054a897be53833b8a2f47
-
SHA512
b397ba21a2bbb927aebcff171e8445a6a1002d401860d6817ea11bd6e4521742293607799ba6a7394d974542eeb43769e969fc64b1ec7b84600ac48d7e504e97
Malware Config
Extracted
oski
sailent.xyz
Signatures
-
Oski
Oski is an infostealer targeting browser data, crypto wallets.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
49255a7e201aebbd0dfd7e9384ada9d184f2fcdacbb054a897be53833b8a2f47.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 49255a7e201aebbd0dfd7e9384ada9d184f2fcdacbb054a897be53833b8a2f47.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
49255a7e201aebbd0dfd7e9384ada9d184f2fcdacbb054a897be53833b8a2f47.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 49255a7e201aebbd0dfd7e9384ada9d184f2fcdacbb054a897be53833b8a2f47.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 49255a7e201aebbd0dfd7e9384ada9d184f2fcdacbb054a897be53833b8a2f47.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral2/memory/2488-130-0x00000000002F0000-0x000000000081D000-memory.dmp themida behavioral2/memory/2488-131-0x00000000002F0000-0x000000000081D000-memory.dmp themida behavioral2/memory/2488-132-0x00000000002F0000-0x000000000081D000-memory.dmp themida behavioral2/memory/2488-133-0x00000000002F0000-0x000000000081D000-memory.dmp themida behavioral2/memory/2488-134-0x00000000002F0000-0x000000000081D000-memory.dmp themida behavioral2/memory/2488-136-0x00000000002F0000-0x000000000081D000-memory.dmp themida behavioral2/memory/2488-137-0x00000000002F0000-0x000000000081D000-memory.dmp themida behavioral2/memory/2488-138-0x00000000002F0000-0x000000000081D000-memory.dmp themida behavioral2/memory/2488-139-0x00000000002F0000-0x000000000081D000-memory.dmp themida behavioral2/memory/2488-140-0x00000000002F0000-0x000000000081D000-memory.dmp themida behavioral2/memory/2488-141-0x00000000002F0000-0x000000000081D000-memory.dmp themida behavioral2/memory/2488-142-0x00000000002F0000-0x000000000081D000-memory.dmp themida behavioral2/memory/2488-143-0x00000000002F0000-0x000000000081D000-memory.dmp themida behavioral2/memory/2488-144-0x00000000002F0000-0x000000000081D000-memory.dmp themida -
Processes:
49255a7e201aebbd0dfd7e9384ada9d184f2fcdacbb054a897be53833b8a2f47.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 49255a7e201aebbd0dfd7e9384ada9d184f2fcdacbb054a897be53833b8a2f47.exe -
Drops file in System32 directory 2 IoCs
Processes:
svchost.exedescription ioc process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{CE057EC7-164F-4CF3-971E-8CB126A2E77F}.catalogItem svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{8764170A-055E-4824-97F8-A05D18371169}.catalogItem svchost.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
49255a7e201aebbd0dfd7e9384ada9d184f2fcdacbb054a897be53833b8a2f47.exepid process 2488 49255a7e201aebbd0dfd7e9384ada9d184f2fcdacbb054a897be53833b8a2f47.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4808 2488 WerFault.exe 49255a7e201aebbd0dfd7e9384ada9d184f2fcdacbb054a897be53833b8a2f47.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
svchost.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
svchost.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\49255a7e201aebbd0dfd7e9384ada9d184f2fcdacbb054a897be53833b8a2f47.exe"C:\Users\Admin\AppData\Local\Temp\49255a7e201aebbd0dfd7e9384ada9d184f2fcdacbb054a897be53833b8a2f47.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2488 -s 13482⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2488 -ip 24881⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2488-130-0x00000000002F0000-0x000000000081D000-memory.dmpFilesize
5.2MB
-
memory/2488-131-0x00000000002F0000-0x000000000081D000-memory.dmpFilesize
5.2MB
-
memory/2488-132-0x00000000002F0000-0x000000000081D000-memory.dmpFilesize
5.2MB
-
memory/2488-133-0x00000000002F0000-0x000000000081D000-memory.dmpFilesize
5.2MB
-
memory/2488-135-0x0000000077570000-0x0000000077713000-memory.dmpFilesize
1.6MB
-
memory/2488-134-0x00000000002F0000-0x000000000081D000-memory.dmpFilesize
5.2MB
-
memory/2488-136-0x00000000002F0000-0x000000000081D000-memory.dmpFilesize
5.2MB
-
memory/2488-137-0x00000000002F0000-0x000000000081D000-memory.dmpFilesize
5.2MB
-
memory/2488-138-0x00000000002F0000-0x000000000081D000-memory.dmpFilesize
5.2MB
-
memory/2488-139-0x00000000002F0000-0x000000000081D000-memory.dmpFilesize
5.2MB
-
memory/2488-140-0x00000000002F0000-0x000000000081D000-memory.dmpFilesize
5.2MB
-
memory/2488-141-0x00000000002F0000-0x000000000081D000-memory.dmpFilesize
5.2MB
-
memory/2488-142-0x00000000002F0000-0x000000000081D000-memory.dmpFilesize
5.2MB
-
memory/2488-143-0x00000000002F0000-0x000000000081D000-memory.dmpFilesize
5.2MB
-
memory/2488-144-0x00000000002F0000-0x000000000081D000-memory.dmpFilesize
5.2MB
-
memory/2488-145-0x0000000077570000-0x0000000077713000-memory.dmpFilesize
1.6MB