Analysis

  • max time kernel
    97s
  • max time network
    100s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-01-2023 09:03

General

  • Target

    photo_88093849384983430493483984390-094.exe

  • Size

    550KB

  • MD5

    b7af9364e54e733684f2b5ef4bdd550a

  • SHA1

    0b4a2b89d5373e6e13395753786154e90e803387

  • SHA256

    37e06231dbbfd682fed877eece815fc8f383f05396495468805d75c94a802e6e

  • SHA512

    15aafec28acb2862168ee073bd7dc7ea766463e677399f2d6da200f7db9a342c4e8db6f9237e12174fa4c99acf3d3279f686bb11e8a12adc53072492ef828c48

  • SSDEEP

    6144:7nx1IH1z1RRu8HAx08JgSRxEguHjseJ1Rb/:shvRu8g3dbEjHjselb/

Malware Config

Extracted

Family

oski

C2

spamcxcs.com

Signatures

  • Oski

    Oski is an infostealer targeting browser data, crypto wallets.

  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 1 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\photo_88093849384983430493483984390-094.exe
    "C:\Users\Admin\AppData\Local\Temp\photo_88093849384983430493483984390-094.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4984
    • C:\Users\Admin\AppData\Local\Temp\_gpj.Scr
      "C:\Users\Admin\AppData\Local\Temp\_gpj.Scr" /S
      2⤵
      • Executes dropped EXE
      • Checks computer location settings
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1468
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2324
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3472
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2376
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        3⤵
        • Checks computer location settings
        • Suspicious use of WriteProcessMemory
        PID:2940
        • C:\Users\Admin\AppData\LocalHCjYfqYEpl.exe
          "C:\Users\Admin\AppData\LocalHCjYfqYEpl.exe"
          4⤵
          • Executes dropped EXE
          • Checks computer location settings
          • Loads dropped DLL
          • Checks processor information in registry
          • Suspicious use of WriteProcessMemory
          PID:4980
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c taskkill /pid 4980 & erase C:\Users\Admin\AppData\LocalHCjYfqYEpl.exe & RD /S /Q C:\\ProgramData\\431400801594042\\* & exit
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:2196
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill /pid 4980
              6⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:520

Network

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

3
T1012

System Information Discovery

3
T1082

Collection

Data from Local System

2
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\mozglue.dll
    Filesize

    133KB

    MD5

    8f73c08a9660691143661bf7332c3c27

    SHA1

    37fa65dd737c50fda710fdbde89e51374d0c204a

    SHA256

    3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

    SHA512

    0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

  • C:\ProgramData\nss3.dll
    Filesize

    1.2MB

    MD5

    bfac4e3c5908856ba17d41edcd455a51

    SHA1

    8eec7e888767aa9e4cca8ff246eb2aacb9170428

    SHA256

    e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

    SHA512

    2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

  • C:\ProgramData\sqlite3.dll
    Filesize

    630KB

    MD5

    e477a96c8f2b18d6b5c27bde49c990bf

    SHA1

    e980c9bf41330d1e5bd04556db4646a0210f7409

    SHA256

    16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660

    SHA512

    335a86268e7c0e568b1c30981ec644e6cd332e66f96d2551b58a82515316693c1859d87b4f4b7310cf1ac386cee671580fdd999c3bcb23acf2c2282c01c8798c

  • C:\Users\Admin\AppData\LocalHCjYfqYEpl.exe
    Filesize

    200KB

    MD5

    1e16a944c7f1144d9027946dc6732405

    SHA1

    682308d4299bee2bcea003805c78da3ccb31612c

    SHA256

    64b157d9021d2489acf96a9db8b8fc9b117b17c1157d4b497dee7e81c3822c7d

    SHA512

    4588c0cb89d07f7a84654ac36d24f00dd2c7442c5f1c03869858e607085ff53347c9dadf9f55eec4e88ace83b440eb5a5f4b729b2d076bb58a84e5781c97c1dd

  • C:\Users\Admin\AppData\LocalHCjYfqYEpl.exe
    Filesize

    200KB

    MD5

    1e16a944c7f1144d9027946dc6732405

    SHA1

    682308d4299bee2bcea003805c78da3ccb31612c

    SHA256

    64b157d9021d2489acf96a9db8b8fc9b117b17c1157d4b497dee7e81c3822c7d

    SHA512

    4588c0cb89d07f7a84654ac36d24f00dd2c7442c5f1c03869858e607085ff53347c9dadf9f55eec4e88ace83b440eb5a5f4b729b2d076bb58a84e5781c97c1dd

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
    Filesize

    1KB

    MD5

    4280e36a29fa31c01e4d8b2ba726a0d8

    SHA1

    c485c2c9ce0a99747b18d899b71dfa9a64dabe32

    SHA256

    e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359

    SHA512

    494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
    Filesize

    53KB

    MD5

    06ad34f9739c5159b4d92d702545bd49

    SHA1

    9152a0d4f153f3f40f7e606be75f81b582ee0c17

    SHA256

    474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba

    SHA512

    c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
    Filesize

    16KB

    MD5

    0207473a62b02f40a2ce2bbfd154b591

    SHA1

    bac603c85a0d9a253f923d5445f9f5e77603b7c6

    SHA256

    2bf941ff672e8df1762cfe42f9057d6530c33499a42bad633abc31f447a1b96a

    SHA512

    bec118bb5e90e4f9144912262faa1476418f9e69aa0f04fcb1ca7e4b7b5b00ad55d9cb4bf0428badbb2fb080504329f6fe6554813970a66627bf0116a16ddef6

  • C:\Users\Admin\AppData\Local\Temp\_gpj.Scr
    Filesize

    350.0MB

    MD5

    d53d10043ba87eeed33d98d04e3d7520

    SHA1

    d18c487cca17fbe2b58530bedd7d5fa0665c4def

    SHA256

    1300c6ff5d21a761a13fec4954a2c86cc64ae07d510c9cf53af377a61597da9a

    SHA512

    359673bbe112456621eae9068ec6dabf346609eab68356bfa06a93192a31404bef3e0f86dd1296929d5d5e59bb8bb93dda4c19747697ed9b4dc6f0791f5dec3b

  • C:\Users\Admin\AppData\Local\Temp\_gpj.Scr
    Filesize

    350.0MB

    MD5

    d53d10043ba87eeed33d98d04e3d7520

    SHA1

    d18c487cca17fbe2b58530bedd7d5fa0665c4def

    SHA256

    1300c6ff5d21a761a13fec4954a2c86cc64ae07d510c9cf53af377a61597da9a

    SHA512

    359673bbe112456621eae9068ec6dabf346609eab68356bfa06a93192a31404bef3e0f86dd1296929d5d5e59bb8bb93dda4c19747697ed9b4dc6f0791f5dec3b

  • memory/520-170-0x0000000000000000-mapping.dmp
  • memory/1468-132-0x0000000000000000-mapping.dmp
  • memory/1468-139-0x00000000085D0000-0x00000000085F2000-memory.dmp
    Filesize

    136KB

  • memory/1468-138-0x00000000050F0000-0x00000000050FA000-memory.dmp
    Filesize

    40KB

  • memory/1468-137-0x0000000005100000-0x0000000005192000-memory.dmp
    Filesize

    584KB

  • memory/1468-136-0x00000000057B0000-0x0000000005D54000-memory.dmp
    Filesize

    5.6MB

  • memory/1468-135-0x0000000000730000-0x0000000000738000-memory.dmp
    Filesize

    32KB

  • memory/2196-169-0x0000000000000000-mapping.dmp
  • memory/2324-141-0x0000000004DD0000-0x0000000004E06000-memory.dmp
    Filesize

    216KB

  • memory/2324-143-0x0000000005530000-0x0000000005596000-memory.dmp
    Filesize

    408KB

  • memory/2324-140-0x0000000000000000-mapping.dmp
  • memory/2324-142-0x00000000055C0000-0x0000000005BE8000-memory.dmp
    Filesize

    6.2MB

  • memory/2324-144-0x0000000005BF0000-0x0000000005C56000-memory.dmp
    Filesize

    408KB

  • memory/2324-145-0x0000000006330000-0x000000000634E000-memory.dmp
    Filesize

    120KB

  • memory/2324-147-0x0000000006840000-0x000000000685A000-memory.dmp
    Filesize

    104KB

  • memory/2324-146-0x0000000007B70000-0x00000000081EA000-memory.dmp
    Filesize

    6.5MB

  • memory/2376-167-0x0000000007DF0000-0x0000000007E0A000-memory.dmp
    Filesize

    104KB

  • memory/2376-159-0x000000006F660000-0x000000006F6AC000-memory.dmp
    Filesize

    304KB

  • memory/2376-160-0x0000000006E40000-0x0000000006E5E000-memory.dmp
    Filesize

    120KB

  • memory/2376-161-0x0000000007C40000-0x0000000007C4A000-memory.dmp
    Filesize

    40KB

  • memory/2376-162-0x0000000007E30000-0x0000000007EC6000-memory.dmp
    Filesize

    600KB

  • memory/2376-163-0x00000000066D0000-0x00000000066DE000-memory.dmp
    Filesize

    56KB

  • memory/2376-149-0x0000000000000000-mapping.dmp
  • memory/2376-158-0x0000000006E70000-0x0000000006EA2000-memory.dmp
    Filesize

    200KB

  • memory/2376-168-0x0000000007DD0000-0x0000000007DD8000-memory.dmp
    Filesize

    32KB

  • memory/2940-152-0x0000000000000000-mapping.dmp
  • memory/2940-153-0x0000000000400000-0x0000000000466000-memory.dmp
    Filesize

    408KB

  • memory/3472-148-0x0000000000000000-mapping.dmp
  • memory/4980-154-0x0000000000000000-mapping.dmp