Analysis
-
max time kernel
145s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
19-07-2022 15:52
Static task
static1
Behavioral task
behavioral1
Sample
4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe
Resource
win10v2004-20220414-en
General
-
Target
4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe
-
Size
388KB
-
MD5
0e3b92ef55843eb0d93da30658bac843
-
SHA1
857182cc43c7aebd753dbf770ae5c2fa8c8e3500
-
SHA256
4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6
-
SHA512
adb128804806daa4a63daf477c2fb275af60b63c0a0cdb25f6c85f0565ee26d55b2595638d433a96ea483121893aa86c1a0cdadfa244ac4dad5137349049f241
Malware Config
Extracted
oski
postalresolve.com
Signatures
-
Oski
Oski is an infostealer targeting browser data, crypto wallets.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exedescription pid process target process PID 1432 set thread context of 1756 1432 4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe 4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exe4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exepid process 1060 powershell.exe 1432 4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exe4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exedescription pid process Token: SeDebugPrivilege 1060 powershell.exe Token: SeDebugPrivilege 1432 4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exedescription pid process target process PID 1432 wrote to memory of 1060 1432 4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe powershell.exe PID 1432 wrote to memory of 1060 1432 4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe powershell.exe PID 1432 wrote to memory of 1060 1432 4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe powershell.exe PID 1432 wrote to memory of 1060 1432 4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe powershell.exe PID 1432 wrote to memory of 1756 1432 4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe 4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe PID 1432 wrote to memory of 1756 1432 4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe 4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe PID 1432 wrote to memory of 1756 1432 4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe 4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe PID 1432 wrote to memory of 1756 1432 4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe 4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe PID 1432 wrote to memory of 1756 1432 4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe 4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe PID 1432 wrote to memory of 1756 1432 4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe 4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe PID 1432 wrote to memory of 1756 1432 4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe 4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe PID 1432 wrote to memory of 1756 1432 4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe 4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe PID 1432 wrote to memory of 1756 1432 4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe 4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe PID 1432 wrote to memory of 1756 1432 4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe 4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe"C:\Users\Admin\AppData\Local\Temp\4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwAzAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exeC:\Users\Admin\AppData\Local\Temp\4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1060-59-0x0000000000000000-mapping.dmp
-
memory/1060-63-0x0000000070990000-0x0000000070F3B000-memory.dmpFilesize
5.7MB
-
memory/1060-62-0x0000000070990000-0x0000000070F3B000-memory.dmpFilesize
5.7MB
-
memory/1060-61-0x0000000070990000-0x0000000070F3B000-memory.dmpFilesize
5.7MB
-
memory/1432-58-0x00000000009E0000-0x0000000000A2C000-memory.dmpFilesize
304KB
-
memory/1432-54-0x0000000000810000-0x0000000000876000-memory.dmpFilesize
408KB
-
memory/1432-57-0x0000000000750000-0x0000000000794000-memory.dmpFilesize
272KB
-
memory/1432-56-0x0000000076031000-0x0000000076033000-memory.dmpFilesize
8KB
-
memory/1432-55-0x0000000000880000-0x00000000008E4000-memory.dmpFilesize
400KB
-
memory/1756-64-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1756-67-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1756-65-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1756-69-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1756-71-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1756-73-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1756-74-0x000000000040717B-mapping.dmp
-
memory/1756-76-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1756-78-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB