Analysis
-
max time kernel
112s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2023 19:46
Behavioral task
behavioral1
Sample
887e6a417f06bb6dc94f034935073101.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
887e6a417f06bb6dc94f034935073101.exe
Resource
win10v2004-20231215-en
General
-
Target
887e6a417f06bb6dc94f034935073101.exe
-
Size
440KB
-
MD5
887e6a417f06bb6dc94f034935073101
-
SHA1
832bd170fb82f13787f5cb0760da83510259c5ff
-
SHA256
096274fd9d732efd99db63e588c529184b5e7c27215eb09e6bab705ddfdc7d01
-
SHA512
e876077cbf778733817c82f5ce144cea000f5677827dad0c2509c35f5dd10cb082243e4f6c31c808a67b45e0d9acca322210935bc8b76b8b9da4e33adc45ca1a
-
SSDEEP
12288:K2sFVy12lhO0J7l94ZeybVMvaFp94AIACSI737:zsFMolOZleCD9BIAE37
Malware Config
Extracted
oski
agencybro.tech
Signatures
-
Oski
Oski is an infostealer targeting browser data, crypto wallets.
-
Drops startup file 1 IoCs
Processes:
cmd.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral2/memory/3252-0-0x0000000000400000-0x000000000047D000-memory.dmp upx behavioral2/memory/3252-3-0x0000000000400000-0x000000000047D000-memory.dmp upx -
Suspicious use of SetThreadContext 1 IoCs
Processes:
887e6a417f06bb6dc94f034935073101.exedescription pid process target process PID 3252 set thread context of 4492 3252 887e6a417f06bb6dc94f034935073101.exe 887e6a417f06bb6dc94f034935073101.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4692 4492 WerFault.exe 887e6a417f06bb6dc94f034935073101.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
887e6a417f06bb6dc94f034935073101.exepid process 3252 887e6a417f06bb6dc94f034935073101.exe 3252 887e6a417f06bb6dc94f034935073101.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
887e6a417f06bb6dc94f034935073101.exepid process 3252 887e6a417f06bb6dc94f034935073101.exe 3252 887e6a417f06bb6dc94f034935073101.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
887e6a417f06bb6dc94f034935073101.exedescription pid process target process PID 3252 wrote to memory of 4168 3252 887e6a417f06bb6dc94f034935073101.exe cmd.exe PID 3252 wrote to memory of 4168 3252 887e6a417f06bb6dc94f034935073101.exe cmd.exe PID 3252 wrote to memory of 4168 3252 887e6a417f06bb6dc94f034935073101.exe cmd.exe PID 3252 wrote to memory of 4492 3252 887e6a417f06bb6dc94f034935073101.exe 887e6a417f06bb6dc94f034935073101.exe PID 3252 wrote to memory of 4492 3252 887e6a417f06bb6dc94f034935073101.exe 887e6a417f06bb6dc94f034935073101.exe PID 3252 wrote to memory of 4492 3252 887e6a417f06bb6dc94f034935073101.exe 887e6a417f06bb6dc94f034935073101.exe PID 3252 wrote to memory of 4492 3252 887e6a417f06bb6dc94f034935073101.exe 887e6a417f06bb6dc94f034935073101.exe PID 3252 wrote to memory of 4492 3252 887e6a417f06bb6dc94f034935073101.exe 887e6a417f06bb6dc94f034935073101.exe PID 3252 wrote to memory of 4492 3252 887e6a417f06bb6dc94f034935073101.exe 887e6a417f06bb6dc94f034935073101.exe PID 3252 wrote to memory of 4492 3252 887e6a417f06bb6dc94f034935073101.exe 887e6a417f06bb6dc94f034935073101.exe PID 3252 wrote to memory of 4492 3252 887e6a417f06bb6dc94f034935073101.exe 887e6a417f06bb6dc94f034935073101.exe PID 3252 wrote to memory of 4492 3252 887e6a417f06bb6dc94f034935073101.exe 887e6a417f06bb6dc94f034935073101.exe PID 3252 wrote to memory of 4492 3252 887e6a417f06bb6dc94f034935073101.exe 887e6a417f06bb6dc94f034935073101.exe PID 3252 wrote to memory of 4492 3252 887e6a417f06bb6dc94f034935073101.exe 887e6a417f06bb6dc94f034935073101.exe PID 3252 wrote to memory of 4492 3252 887e6a417f06bb6dc94f034935073101.exe 887e6a417f06bb6dc94f034935073101.exe PID 3252 wrote to memory of 4492 3252 887e6a417f06bb6dc94f034935073101.exe 887e6a417f06bb6dc94f034935073101.exe PID 3252 wrote to memory of 4492 3252 887e6a417f06bb6dc94f034935073101.exe 887e6a417f06bb6dc94f034935073101.exe PID 3252 wrote to memory of 4492 3252 887e6a417f06bb6dc94f034935073101.exe 887e6a417f06bb6dc94f034935073101.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\887e6a417f06bb6dc94f034935073101.exe"C:\Users\Admin\AppData\Local\Temp\887e6a417f06bb6dc94f034935073101.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "C:\Users\Admin\AppData\Local\Temp\887e6a417f06bb6dc94f034935073101.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"2⤵
- Drops startup file
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\887e6a417f06bb6dc94f034935073101.exeC:\Users\Admin\AppData\Local\Temp\887e6a417f06bb6dc94f034935073101.exe2⤵PID:4492
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4492 -s 13083⤵
- Program crash
PID:4692
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4492 -ip 44921⤵PID:2748