Analysis
-
max time kernel
0s -
max time network
107s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
22-12-2023 00:15
Static task
static1
Behavioral task
behavioral1
Sample
330ef71ad71267a0eb80fcc149121052.ps1
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
330ef71ad71267a0eb80fcc149121052.ps1
Resource
win10v2004-20231215-en
General
-
Target
330ef71ad71267a0eb80fcc149121052.ps1
-
Size
421KB
-
MD5
330ef71ad71267a0eb80fcc149121052
-
SHA1
d6c7ba0885c72f7503d84467b0c537c97bd9d53b
-
SHA256
70bfeefcd0c266f10aab2e4bd30a5e1e89509db7e6b929531018dc0b3876103f
-
SHA512
b5b08104d14b86ac49ef2af40baee5e7a9ccb74939bbf977d6ec3fcbf124accc26c63c436346b93865085d1c84a4a51fa6476b7cbe916b9f271a791a3c2219ce
-
SSDEEP
12288:+Zjw0RJ9u5ILYDxD3fxYehza/tw64sL68:q3H
Malware Config
Extracted
oski
/103.114.107.28/l4040/
Signatures
-
Oski
Oski is an infostealer targeting browser data, crypto wallets.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2024 set thread context of 5076 2024 powershell.exe 33 -
Program crash 1 IoCs
pid pid_target Process procid_target 4484 5076 WerFault.exe 33 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2024 powershell.exe 2024 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2024 powershell.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2024 wrote to memory of 5076 2024 powershell.exe 33 PID 2024 wrote to memory of 5076 2024 powershell.exe 33 PID 2024 wrote to memory of 5076 2024 powershell.exe 33 PID 2024 wrote to memory of 5076 2024 powershell.exe 33 PID 2024 wrote to memory of 5076 2024 powershell.exe 33 PID 2024 wrote to memory of 5076 2024 powershell.exe 33 PID 2024 wrote to memory of 5076 2024 powershell.exe 33 PID 2024 wrote to memory of 5076 2024 powershell.exe 33 PID 2024 wrote to memory of 5076 2024 powershell.exe 33
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\330ef71ad71267a0eb80fcc149121052.ps11⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"{path}"2⤵PID:5076
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5076 -s 11083⤵
- Program crash
PID:4484
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5076 -ip 50761⤵PID:3944
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82