Analysis
-
max time kernel
90s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
26-07-2022 18:36
Static task
static1
Behavioral task
behavioral1
Sample
938f4e648e57b9ad6d41ea3fe8707c0f249ba2baa24a5.exe
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
938f4e648e57b9ad6d41ea3fe8707c0f249ba2baa24a5.exe
Resource
win10v2004-20220721-en
General
-
Target
938f4e648e57b9ad6d41ea3fe8707c0f249ba2baa24a5.exe
-
Size
470KB
-
MD5
b0d0a4af8f13d80eafe1238bd3f684c8
-
SHA1
23f10ff96e9933590fb9c384c543d20ab695733f
-
SHA256
938f4e648e57b9ad6d41ea3fe8707c0f249ba2baa24a5af557b4f09d698b8145
-
SHA512
5c5297e21c1a37d72894cd232a0833c917d886fb2f8aae9015a41b986a8c4738d90372181cfad5d1bb2584e9b4fbfa2a719752f2973629e42cd562487cdbeffd
Malware Config
Extracted
oski
manguerassorna.com
Signatures
-
Oski
Oski is an infostealer targeting browser data, crypto wallets.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
938f4e648e57b9ad6d41ea3fe8707c0f249ba2baa24a5.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Control Panel\International\Geo\Nation 938f4e648e57b9ad6d41ea3fe8707c0f249ba2baa24a5.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
938f4e648e57b9ad6d41ea3fe8707c0f249ba2baa24a5.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wınrarçexe = "\"C:\\Users\\Admin\\AppData\\Roaming\\wınrarçexe.exe\"" 938f4e648e57b9ad6d41ea3fe8707c0f249ba2baa24a5.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
938f4e648e57b9ad6d41ea3fe8707c0f249ba2baa24a5.exedescription pid process target process PID 4104 set thread context of 5100 4104 938f4e648e57b9ad6d41ea3fe8707c0f249ba2baa24a5.exe InstallUtil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3464 5100 WerFault.exe InstallUtil.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exe938f4e648e57b9ad6d41ea3fe8707c0f249ba2baa24a5.exepid process 2168 powershell.exe 2168 powershell.exe 4104 938f4e648e57b9ad6d41ea3fe8707c0f249ba2baa24a5.exe 4104 938f4e648e57b9ad6d41ea3fe8707c0f249ba2baa24a5.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exe938f4e648e57b9ad6d41ea3fe8707c0f249ba2baa24a5.exedescription pid process Token: SeDebugPrivilege 2168 powershell.exe Token: SeDebugPrivilege 4104 938f4e648e57b9ad6d41ea3fe8707c0f249ba2baa24a5.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
938f4e648e57b9ad6d41ea3fe8707c0f249ba2baa24a5.exedescription pid process target process PID 4104 wrote to memory of 2168 4104 938f4e648e57b9ad6d41ea3fe8707c0f249ba2baa24a5.exe powershell.exe PID 4104 wrote to memory of 2168 4104 938f4e648e57b9ad6d41ea3fe8707c0f249ba2baa24a5.exe powershell.exe PID 4104 wrote to memory of 2168 4104 938f4e648e57b9ad6d41ea3fe8707c0f249ba2baa24a5.exe powershell.exe PID 4104 wrote to memory of 5100 4104 938f4e648e57b9ad6d41ea3fe8707c0f249ba2baa24a5.exe InstallUtil.exe PID 4104 wrote to memory of 5100 4104 938f4e648e57b9ad6d41ea3fe8707c0f249ba2baa24a5.exe InstallUtil.exe PID 4104 wrote to memory of 5100 4104 938f4e648e57b9ad6d41ea3fe8707c0f249ba2baa24a5.exe InstallUtil.exe PID 4104 wrote to memory of 5100 4104 938f4e648e57b9ad6d41ea3fe8707c0f249ba2baa24a5.exe InstallUtil.exe PID 4104 wrote to memory of 5100 4104 938f4e648e57b9ad6d41ea3fe8707c0f249ba2baa24a5.exe InstallUtil.exe PID 4104 wrote to memory of 5100 4104 938f4e648e57b9ad6d41ea3fe8707c0f249ba2baa24a5.exe InstallUtil.exe PID 4104 wrote to memory of 5100 4104 938f4e648e57b9ad6d41ea3fe8707c0f249ba2baa24a5.exe InstallUtil.exe PID 4104 wrote to memory of 5100 4104 938f4e648e57b9ad6d41ea3fe8707c0f249ba2baa24a5.exe InstallUtil.exe PID 4104 wrote to memory of 5100 4104 938f4e648e57b9ad6d41ea3fe8707c0f249ba2baa24a5.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\938f4e648e57b9ad6d41ea3fe8707c0f249ba2baa24a5.exe"C:\Users\Admin\AppData\Local\Temp\938f4e648e57b9ad6d41ea3fe8707c0f249ba2baa24a5.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5100 -s 12883⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 5100 -ip 51001⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2168-138-0x0000000007210000-0x000000000788A000-memory.dmpFilesize
6.5MB
-
memory/2168-134-0x0000000004D80000-0x00000000053A8000-memory.dmpFilesize
6.2MB
-
memory/2168-132-0x0000000000000000-mapping.dmp
-
memory/2168-133-0x0000000000E00000-0x0000000000E36000-memory.dmpFilesize
216KB
-
memory/2168-137-0x0000000005BA0000-0x0000000005BBE000-memory.dmpFilesize
120KB
-
memory/2168-135-0x0000000005480000-0x00000000054E6000-memory.dmpFilesize
408KB
-
memory/2168-139-0x0000000006090000-0x00000000060AA000-memory.dmpFilesize
104KB
-
memory/2168-136-0x0000000005560000-0x00000000055C6000-memory.dmpFilesize
408KB
-
memory/4104-130-0x0000000000C50000-0x0000000000CC8000-memory.dmpFilesize
480KB
-
memory/4104-131-0x0000000005760000-0x0000000005782000-memory.dmpFilesize
136KB
-
memory/5100-140-0x0000000000000000-mapping.dmp
-
memory/5100-141-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/5100-142-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/5100-143-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/5100-144-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/5100-145-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB