Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
21-12-2023 20:41
Static task
static1
Behavioral task
behavioral1
Sample
0446466ac12756312798acc282f43f42.ps1
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
0446466ac12756312798acc282f43f42.ps1
Resource
win10v2004-20231215-en
General
-
Target
0446466ac12756312798acc282f43f42.ps1
-
Size
421KB
-
MD5
0446466ac12756312798acc282f43f42
-
SHA1
3fd7350b0fb7a5f6954133aef52225d7d43b3089
-
SHA256
bd9cbcbfd7a897facee368f30d798f2b6cf4bb4aaf1b3301de96e691a6a5ce18
-
SHA512
5af139c0d939faab146582a2e539011133f21f5514ec46e9065e1ab04820dd33541eaa90fe2c0b7e1dea8a3aeea0a90a20562dad5598249979e513ede0af333e
-
SSDEEP
12288:+Zjw0RJ9u5ILYDxD3fxYehza/tw64cL68:q3H
Malware Config
Extracted
oski
/103.114.107.28/l2828/
Signatures
-
Oski
Oski is an infostealer targeting browser data, crypto wallets.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
powershell.exedescription pid process target process PID 2408 set thread context of 2092 2408 powershell.exe MSBuild.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process 2644 2092 WerFault.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 2408 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 2408 powershell.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
powershell.exeMSBuild.exedescription pid process target process PID 2408 wrote to memory of 2092 2408 powershell.exe MSBuild.exe PID 2408 wrote to memory of 2092 2408 powershell.exe MSBuild.exe PID 2408 wrote to memory of 2092 2408 powershell.exe MSBuild.exe PID 2408 wrote to memory of 2092 2408 powershell.exe MSBuild.exe PID 2408 wrote to memory of 2092 2408 powershell.exe MSBuild.exe PID 2408 wrote to memory of 2092 2408 powershell.exe MSBuild.exe PID 2408 wrote to memory of 2092 2408 powershell.exe MSBuild.exe PID 2408 wrote to memory of 2092 2408 powershell.exe MSBuild.exe PID 2408 wrote to memory of 2092 2408 powershell.exe MSBuild.exe PID 2408 wrote to memory of 2092 2408 powershell.exe MSBuild.exe PID 2092 wrote to memory of 2644 2092 MSBuild.exe WerFault.exe PID 2092 wrote to memory of 2644 2092 MSBuild.exe WerFault.exe PID 2092 wrote to memory of 2644 2092 MSBuild.exe WerFault.exe PID 2092 wrote to memory of 2644 2092 MSBuild.exe WerFault.exe
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\0446466ac12756312798acc282f43f42.ps11⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"{path}"2⤵
- Suspicious use of WriteProcessMemory
PID:2092
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2092 -s 5041⤵
- Program crash
PID:2644