Analysis
-
max time kernel
36s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29-09-2022 20:32
Static task
static1
Behavioral task
behavioral1
Sample
Purchase Order.pdf.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Purchase Order.pdf.exe
Resource
win10v2004-20220901-en
General
-
Target
Purchase Order.pdf.exe
-
Size
273KB
-
MD5
f90a77f7962de4074d4dc02d82b765be
-
SHA1
e8a9ec0c4032818fa92cd148a770fa6192535ce5
-
SHA256
b0f6371db252edc20aeaee0ed2ff64c2514515d7d0f823d508b756269ccabfbd
-
SHA512
a36a482019f06813e5642c33db15fd6f0ef9954c5c97e427a442cffd38b8ead68931314c677940ca78232c2d2710c95413ccb2b41f234d120ffdbcad162182f9
-
SSDEEP
6144:MVP0JqJ1peuOkG6Msr49xOfyGU3LLEE/X9jdR+j1sfw6kVtgfnZ:e0JqJeKDMs4T3kMXjg1sjYgfnZ
Malware Config
Extracted
oski
�&C
virzx.xyz
Signatures
-
Oski
Oski is an infostealer targeting browser data, crypto wallets.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Purchase Order.pdf.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\windows.dll = "C:\\Users\\Admin\\AppData\\Local\\Temp\\file.exe" Purchase Order.pdf.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
Purchase Order.pdf.exePurchase Order.pdf.exedescription pid process target process PID 1720 set thread context of 1580 1720 Purchase Order.pdf.exe Purchase Order.pdf.exe PID 1580 set thread context of 1716 1580 Purchase Order.pdf.exe Purchase Order.pdf.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1544 1716 WerFault.exe Purchase Order.pdf.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
Purchase Order.pdf.exePurchase Order.pdf.exePurchase Order.pdf.exedescription pid process target process PID 1720 wrote to memory of 1580 1720 Purchase Order.pdf.exe Purchase Order.pdf.exe PID 1720 wrote to memory of 1580 1720 Purchase Order.pdf.exe Purchase Order.pdf.exe PID 1720 wrote to memory of 1580 1720 Purchase Order.pdf.exe Purchase Order.pdf.exe PID 1720 wrote to memory of 1580 1720 Purchase Order.pdf.exe Purchase Order.pdf.exe PID 1720 wrote to memory of 1580 1720 Purchase Order.pdf.exe Purchase Order.pdf.exe PID 1720 wrote to memory of 1580 1720 Purchase Order.pdf.exe Purchase Order.pdf.exe PID 1720 wrote to memory of 1580 1720 Purchase Order.pdf.exe Purchase Order.pdf.exe PID 1720 wrote to memory of 1580 1720 Purchase Order.pdf.exe Purchase Order.pdf.exe PID 1720 wrote to memory of 1580 1720 Purchase Order.pdf.exe Purchase Order.pdf.exe PID 1720 wrote to memory of 1580 1720 Purchase Order.pdf.exe Purchase Order.pdf.exe PID 1720 wrote to memory of 1580 1720 Purchase Order.pdf.exe Purchase Order.pdf.exe PID 1580 wrote to memory of 1716 1580 Purchase Order.pdf.exe Purchase Order.pdf.exe PID 1580 wrote to memory of 1716 1580 Purchase Order.pdf.exe Purchase Order.pdf.exe PID 1580 wrote to memory of 1716 1580 Purchase Order.pdf.exe Purchase Order.pdf.exe PID 1580 wrote to memory of 1716 1580 Purchase Order.pdf.exe Purchase Order.pdf.exe PID 1580 wrote to memory of 1716 1580 Purchase Order.pdf.exe Purchase Order.pdf.exe PID 1580 wrote to memory of 1716 1580 Purchase Order.pdf.exe Purchase Order.pdf.exe PID 1580 wrote to memory of 1716 1580 Purchase Order.pdf.exe Purchase Order.pdf.exe PID 1580 wrote to memory of 1716 1580 Purchase Order.pdf.exe Purchase Order.pdf.exe PID 1580 wrote to memory of 1716 1580 Purchase Order.pdf.exe Purchase Order.pdf.exe PID 1580 wrote to memory of 1716 1580 Purchase Order.pdf.exe Purchase Order.pdf.exe PID 1716 wrote to memory of 1544 1716 Purchase Order.pdf.exe WerFault.exe PID 1716 wrote to memory of 1544 1716 Purchase Order.pdf.exe WerFault.exe PID 1716 wrote to memory of 1544 1716 Purchase Order.pdf.exe WerFault.exe PID 1716 wrote to memory of 1544 1716 Purchase Order.pdf.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order.pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order.pdf.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order.pdf.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1716 -s 9044⤵
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1544-83-0x0000000000000000-mapping.dmp
-
memory/1580-78-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1580-55-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1580-57-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1580-58-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1580-59-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1580-60-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1580-62-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1580-63-0x0000000000401110-mapping.dmp
-
memory/1580-66-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1580-65-0x0000000075BD1000-0x0000000075BD3000-memory.dmpFilesize
8KB
-
memory/1580-54-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1716-68-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1716-72-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1716-76-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1716-67-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1716-77-0x000000000040717B-mapping.dmp
-
memory/1716-74-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1716-80-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1716-82-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1716-70-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1716-84-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB