Analysis
-
max time kernel
78s -
max time network
81s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29-09-2022 10:31
Static task
static1
Behavioral task
behavioral1
Sample
18e2b4fb63b38a0d2441bfa6f2afa3c6494e4f85479505f7d228447720ac0485.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
18e2b4fb63b38a0d2441bfa6f2afa3c6494e4f85479505f7d228447720ac0485.exe
Resource
win10v2004-20220812-en
General
-
Target
18e2b4fb63b38a0d2441bfa6f2afa3c6494e4f85479505f7d228447720ac0485.exe
-
Size
308KB
-
MD5
be5881faee054826d32c90d47fed53ce
-
SHA1
25c63bcb8353bd35a4fd28826a5dd959d73379b6
-
SHA256
18e2b4fb63b38a0d2441bfa6f2afa3c6494e4f85479505f7d228447720ac0485
-
SHA512
b7d15268a15eec00b1069c391d18406de850334e13653ecd87eb936001d1c02aa10e9f597bd181408f1f232ca212354b01defa5496ce9bfd89a8c9b0c3d881ce
-
SSDEEP
6144:Bu8bleVTTURmXOu5OX/oX0e2AmSTCIr53qnsAvtgcmXDqWiQJ:M8STTUR6OuCgX0UmS9i16J
Malware Config
Extracted
oski
collegesboard.org
Signatures
-
Oski
Oski is an infostealer targeting browser data, crypto wallets.
-
Executes dropped EXE 2 IoCs
Processes:
Hrwfvhc.exeCzkorfvflbb.exepid process 2004 Hrwfvhc.exe 1952 Czkorfvflbb.exe -
Loads dropped DLL 3 IoCs
Processes:
WerFault.exepid process 1144 WerFault.exe 1144 WerFault.exe 1144 WerFault.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1144 1952 WerFault.exe Czkorfvflbb.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Hrwfvhc.exedescription pid process Token: SeDebugPrivilege 2004 Hrwfvhc.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
18e2b4fb63b38a0d2441bfa6f2afa3c6494e4f85479505f7d228447720ac0485.exeCzkorfvflbb.exedescription pid process target process PID 900 wrote to memory of 2004 900 18e2b4fb63b38a0d2441bfa6f2afa3c6494e4f85479505f7d228447720ac0485.exe Hrwfvhc.exe PID 900 wrote to memory of 2004 900 18e2b4fb63b38a0d2441bfa6f2afa3c6494e4f85479505f7d228447720ac0485.exe Hrwfvhc.exe PID 900 wrote to memory of 2004 900 18e2b4fb63b38a0d2441bfa6f2afa3c6494e4f85479505f7d228447720ac0485.exe Hrwfvhc.exe PID 900 wrote to memory of 2004 900 18e2b4fb63b38a0d2441bfa6f2afa3c6494e4f85479505f7d228447720ac0485.exe Hrwfvhc.exe PID 900 wrote to memory of 1952 900 18e2b4fb63b38a0d2441bfa6f2afa3c6494e4f85479505f7d228447720ac0485.exe Czkorfvflbb.exe PID 900 wrote to memory of 1952 900 18e2b4fb63b38a0d2441bfa6f2afa3c6494e4f85479505f7d228447720ac0485.exe Czkorfvflbb.exe PID 900 wrote to memory of 1952 900 18e2b4fb63b38a0d2441bfa6f2afa3c6494e4f85479505f7d228447720ac0485.exe Czkorfvflbb.exe PID 900 wrote to memory of 1952 900 18e2b4fb63b38a0d2441bfa6f2afa3c6494e4f85479505f7d228447720ac0485.exe Czkorfvflbb.exe PID 1952 wrote to memory of 1144 1952 Czkorfvflbb.exe WerFault.exe PID 1952 wrote to memory of 1144 1952 Czkorfvflbb.exe WerFault.exe PID 1952 wrote to memory of 1144 1952 Czkorfvflbb.exe WerFault.exe PID 1952 wrote to memory of 1144 1952 Czkorfvflbb.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\18e2b4fb63b38a0d2441bfa6f2afa3c6494e4f85479505f7d228447720ac0485.exe"C:\Users\Admin\AppData\Local\Temp\18e2b4fb63b38a0d2441bfa6f2afa3c6494e4f85479505f7d228447720ac0485.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Hrwfvhc.exe"C:\Users\Admin\AppData\Local\Temp\Hrwfvhc.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Czkorfvflbb.exe"C:\Users\Admin\AppData\Local\Temp\Czkorfvflbb.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1952 -s 7723⤵
- Loads dropped DLL
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Czkorfvflbb.exeFilesize
200KB
MD507ac7806a3f2bc0fc993d736ecb3572b
SHA149b54d7ece61cf9198dfc306a641f0d002b56acb
SHA256165a20cece5bd869502d23ed2c9fdf5cb2e83451cca502b110f61371da70134d
SHA5120bb78905d87356841e97e68be1d7c731f5cc4d15fa162017f9c520fceca327c589f8f31b9002c4869179af8626a03e89ef9b667a1a6d5e8f42eef2db98e1e123
-
C:\Users\Admin\AppData\Local\Temp\Hrwfvhc.exeFilesize
1.4MB
MD5a73d5a695cac720fdd6b1679c013efed
SHA19f9d210afc38d3d4967edf194811109393b4b3fe
SHA256b8696cb287e5b8ca935cd69e266b17feae0f2b0f265608bedf9cdacfd025f7bf
SHA512767ab55f6a21d9eb24f0708dae635cea85df511edbb530e9657155f7ec4791889879596622e5f1842665d4bf25f9d2a6f1090918fba16f29137acf41e93059bc
-
C:\Users\Admin\AppData\Local\Temp\Hrwfvhc.exeFilesize
1.4MB
MD5a73d5a695cac720fdd6b1679c013efed
SHA19f9d210afc38d3d4967edf194811109393b4b3fe
SHA256b8696cb287e5b8ca935cd69e266b17feae0f2b0f265608bedf9cdacfd025f7bf
SHA512767ab55f6a21d9eb24f0708dae635cea85df511edbb530e9657155f7ec4791889879596622e5f1842665d4bf25f9d2a6f1090918fba16f29137acf41e93059bc
-
\Users\Admin\AppData\Local\Temp\Czkorfvflbb.exeFilesize
200KB
MD507ac7806a3f2bc0fc993d736ecb3572b
SHA149b54d7ece61cf9198dfc306a641f0d002b56acb
SHA256165a20cece5bd869502d23ed2c9fdf5cb2e83451cca502b110f61371da70134d
SHA5120bb78905d87356841e97e68be1d7c731f5cc4d15fa162017f9c520fceca327c589f8f31b9002c4869179af8626a03e89ef9b667a1a6d5e8f42eef2db98e1e123
-
\Users\Admin\AppData\Local\Temp\Czkorfvflbb.exeFilesize
200KB
MD507ac7806a3f2bc0fc993d736ecb3572b
SHA149b54d7ece61cf9198dfc306a641f0d002b56acb
SHA256165a20cece5bd869502d23ed2c9fdf5cb2e83451cca502b110f61371da70134d
SHA5120bb78905d87356841e97e68be1d7c731f5cc4d15fa162017f9c520fceca327c589f8f31b9002c4869179af8626a03e89ef9b667a1a6d5e8f42eef2db98e1e123
-
\Users\Admin\AppData\Local\Temp\Czkorfvflbb.exeFilesize
200KB
MD507ac7806a3f2bc0fc993d736ecb3572b
SHA149b54d7ece61cf9198dfc306a641f0d002b56acb
SHA256165a20cece5bd869502d23ed2c9fdf5cb2e83451cca502b110f61371da70134d
SHA5120bb78905d87356841e97e68be1d7c731f5cc4d15fa162017f9c520fceca327c589f8f31b9002c4869179af8626a03e89ef9b667a1a6d5e8f42eef2db98e1e123
-
memory/900-55-0x000007FEFBD81000-0x000007FEFBD83000-memory.dmpFilesize
8KB
-
memory/900-54-0x0000000000F90000-0x0000000000FE4000-memory.dmpFilesize
336KB
-
memory/1144-65-0x0000000000000000-mapping.dmp
-
memory/1952-58-0x0000000000000000-mapping.dmp
-
memory/1952-61-0x0000000076121000-0x0000000076123000-memory.dmpFilesize
8KB
-
memory/2004-56-0x0000000000000000-mapping.dmp
-
memory/2004-62-0x0000000000AD0000-0x0000000000C3A000-memory.dmpFilesize
1.4MB
-
memory/2004-64-0x0000000004B45000-0x0000000004B56000-memory.dmpFilesize
68KB
-
memory/2004-69-0x0000000004B45000-0x0000000004B56000-memory.dmpFilesize
68KB