Analysis
-
max time kernel
141s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
19-12-2023 19:46
Behavioral task
behavioral1
Sample
887e6a417f06bb6dc94f034935073101.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
887e6a417f06bb6dc94f034935073101.exe
Resource
win10v2004-20231215-en
General
-
Target
887e6a417f06bb6dc94f034935073101.exe
-
Size
440KB
-
MD5
887e6a417f06bb6dc94f034935073101
-
SHA1
832bd170fb82f13787f5cb0760da83510259c5ff
-
SHA256
096274fd9d732efd99db63e588c529184b5e7c27215eb09e6bab705ddfdc7d01
-
SHA512
e876077cbf778733817c82f5ce144cea000f5677827dad0c2509c35f5dd10cb082243e4f6c31c808a67b45e0d9acca322210935bc8b76b8b9da4e33adc45ca1a
-
SSDEEP
12288:K2sFVy12lhO0J7l94ZeybVMvaFp94AIACSI737:zsFMolOZleCD9BIAE37
Malware Config
Extracted
oski
agencybro.tech
Signatures
-
Oski
Oski is an infostealer targeting browser data, crypto wallets.
-
Drops startup file 1 IoCs
Processes:
cmd.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral1/memory/2348-0-0x0000000000400000-0x000000000047D000-memory.dmp upx behavioral1/memory/2348-30-0x0000000000400000-0x000000000047D000-memory.dmp upx -
Suspicious use of SetThreadContext 1 IoCs
Processes:
887e6a417f06bb6dc94f034935073101.exedescription pid process target process PID 2348 set thread context of 1088 2348 887e6a417f06bb6dc94f034935073101.exe 887e6a417f06bb6dc94f034935073101.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2476 1088 WerFault.exe 887e6a417f06bb6dc94f034935073101.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
887e6a417f06bb6dc94f034935073101.exepid process 2348 887e6a417f06bb6dc94f034935073101.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
887e6a417f06bb6dc94f034935073101.exepid process 2348 887e6a417f06bb6dc94f034935073101.exe 2348 887e6a417f06bb6dc94f034935073101.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
887e6a417f06bb6dc94f034935073101.exe887e6a417f06bb6dc94f034935073101.exedescription pid process target process PID 2348 wrote to memory of 860 2348 887e6a417f06bb6dc94f034935073101.exe cmd.exe PID 2348 wrote to memory of 860 2348 887e6a417f06bb6dc94f034935073101.exe cmd.exe PID 2348 wrote to memory of 860 2348 887e6a417f06bb6dc94f034935073101.exe cmd.exe PID 2348 wrote to memory of 860 2348 887e6a417f06bb6dc94f034935073101.exe cmd.exe PID 2348 wrote to memory of 1088 2348 887e6a417f06bb6dc94f034935073101.exe 887e6a417f06bb6dc94f034935073101.exe PID 2348 wrote to memory of 1088 2348 887e6a417f06bb6dc94f034935073101.exe 887e6a417f06bb6dc94f034935073101.exe PID 2348 wrote to memory of 1088 2348 887e6a417f06bb6dc94f034935073101.exe 887e6a417f06bb6dc94f034935073101.exe PID 2348 wrote to memory of 1088 2348 887e6a417f06bb6dc94f034935073101.exe 887e6a417f06bb6dc94f034935073101.exe PID 2348 wrote to memory of 1088 2348 887e6a417f06bb6dc94f034935073101.exe 887e6a417f06bb6dc94f034935073101.exe PID 2348 wrote to memory of 1088 2348 887e6a417f06bb6dc94f034935073101.exe 887e6a417f06bb6dc94f034935073101.exe PID 2348 wrote to memory of 1088 2348 887e6a417f06bb6dc94f034935073101.exe 887e6a417f06bb6dc94f034935073101.exe PID 2348 wrote to memory of 1088 2348 887e6a417f06bb6dc94f034935073101.exe 887e6a417f06bb6dc94f034935073101.exe PID 2348 wrote to memory of 1088 2348 887e6a417f06bb6dc94f034935073101.exe 887e6a417f06bb6dc94f034935073101.exe PID 2348 wrote to memory of 1088 2348 887e6a417f06bb6dc94f034935073101.exe 887e6a417f06bb6dc94f034935073101.exe PID 2348 wrote to memory of 1088 2348 887e6a417f06bb6dc94f034935073101.exe 887e6a417f06bb6dc94f034935073101.exe PID 2348 wrote to memory of 1088 2348 887e6a417f06bb6dc94f034935073101.exe 887e6a417f06bb6dc94f034935073101.exe PID 2348 wrote to memory of 1088 2348 887e6a417f06bb6dc94f034935073101.exe 887e6a417f06bb6dc94f034935073101.exe PID 2348 wrote to memory of 1088 2348 887e6a417f06bb6dc94f034935073101.exe 887e6a417f06bb6dc94f034935073101.exe PID 2348 wrote to memory of 1088 2348 887e6a417f06bb6dc94f034935073101.exe 887e6a417f06bb6dc94f034935073101.exe PID 2348 wrote to memory of 1088 2348 887e6a417f06bb6dc94f034935073101.exe 887e6a417f06bb6dc94f034935073101.exe PID 2348 wrote to memory of 1088 2348 887e6a417f06bb6dc94f034935073101.exe 887e6a417f06bb6dc94f034935073101.exe PID 1088 wrote to memory of 2476 1088 887e6a417f06bb6dc94f034935073101.exe WerFault.exe PID 1088 wrote to memory of 2476 1088 887e6a417f06bb6dc94f034935073101.exe WerFault.exe PID 1088 wrote to memory of 2476 1088 887e6a417f06bb6dc94f034935073101.exe WerFault.exe PID 1088 wrote to memory of 2476 1088 887e6a417f06bb6dc94f034935073101.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\887e6a417f06bb6dc94f034935073101.exe"C:\Users\Admin\AppData\Local\Temp\887e6a417f06bb6dc94f034935073101.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "C:\Users\Admin\AppData\Local\Temp\887e6a417f06bb6dc94f034935073101.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"2⤵
- Drops startup file
PID:860 -
C:\Users\Admin\AppData\Local\Temp\887e6a417f06bb6dc94f034935073101.exeC:\Users\Admin\AppData\Local\Temp\887e6a417f06bb6dc94f034935073101.exe2⤵
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 7683⤵
- Program crash
PID:2476