Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
22-12-2023 00:15
Static task
static1
Behavioral task
behavioral1
Sample
330ef71ad71267a0eb80fcc149121052.ps1
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
330ef71ad71267a0eb80fcc149121052.ps1
Resource
win10v2004-20231215-en
General
-
Target
330ef71ad71267a0eb80fcc149121052.ps1
-
Size
421KB
-
MD5
330ef71ad71267a0eb80fcc149121052
-
SHA1
d6c7ba0885c72f7503d84467b0c537c97bd9d53b
-
SHA256
70bfeefcd0c266f10aab2e4bd30a5e1e89509db7e6b929531018dc0b3876103f
-
SHA512
b5b08104d14b86ac49ef2af40baee5e7a9ccb74939bbf977d6ec3fcbf124accc26c63c436346b93865085d1c84a4a51fa6476b7cbe916b9f271a791a3c2219ce
-
SSDEEP
12288:+Zjw0RJ9u5ILYDxD3fxYehza/tw64sL68:q3H
Malware Config
Extracted
oski
/103.114.107.28/l4040/
Signatures
-
Oski
Oski is an infostealer targeting browser data, crypto wallets.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
powershell.exedescription pid process target process PID 2404 set thread context of 2756 2404 powershell.exe MSBuild.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process 2796 2756 WerFault.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 2404 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 2404 powershell.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
powershell.exeMSBuild.exedescription pid process target process PID 2404 wrote to memory of 2756 2404 powershell.exe MSBuild.exe PID 2404 wrote to memory of 2756 2404 powershell.exe MSBuild.exe PID 2404 wrote to memory of 2756 2404 powershell.exe MSBuild.exe PID 2404 wrote to memory of 2756 2404 powershell.exe MSBuild.exe PID 2404 wrote to memory of 2756 2404 powershell.exe MSBuild.exe PID 2404 wrote to memory of 2756 2404 powershell.exe MSBuild.exe PID 2404 wrote to memory of 2756 2404 powershell.exe MSBuild.exe PID 2404 wrote to memory of 2756 2404 powershell.exe MSBuild.exe PID 2404 wrote to memory of 2756 2404 powershell.exe MSBuild.exe PID 2404 wrote to memory of 2756 2404 powershell.exe MSBuild.exe PID 2756 wrote to memory of 2796 2756 MSBuild.exe WerFault.exe PID 2756 wrote to memory of 2796 2756 MSBuild.exe WerFault.exe PID 2756 wrote to memory of 2796 2756 MSBuild.exe WerFault.exe PID 2756 wrote to memory of 2796 2756 MSBuild.exe WerFault.exe
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\330ef71ad71267a0eb80fcc149121052.ps11⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"{path}"2⤵
- Suspicious use of WriteProcessMemory
PID:2756
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2756 -s 4921⤵
- Program crash
PID:2796