Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
22-12-2023 01:02
Static task
static1
Behavioral task
behavioral1
Sample
3f612a7d13131add2c7480a8f4afc2e2.ps1
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
3f612a7d13131add2c7480a8f4afc2e2.ps1
Resource
win10v2004-20231215-en
General
-
Target
3f612a7d13131add2c7480a8f4afc2e2.ps1
-
Size
421KB
-
MD5
3f612a7d13131add2c7480a8f4afc2e2
-
SHA1
002ef70c9716875d10ae15d571172ef55b9a9058
-
SHA256
9c91870abd6826a55a3091588a4dd1a06f76517ff5a59905a1247a169ba33581
-
SHA512
1abfbab969598f722e900aa19b9fd6f95b21cfb07110aa978a08dbcf0d639dea1b630e2673cb1e7abeda1c3db0f1f6f0ad60eefd2f513a064e1be1a682d19905
-
SSDEEP
12288:+Zjw0RJ9u5ILYDxD3fxYehza/tw64EL68:q3v
Malware Config
Extracted
oski
/103.114.107.28/l2121/
Signatures
-
Oski
Oski is an infostealer targeting browser data, crypto wallets.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
powershell.exedescription pid process target process PID 2304 set thread context of 2660 2304 powershell.exe MSBuild.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process 2744 2660 WerFault.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 2304 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 2304 powershell.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
powershell.exeMSBuild.exedescription pid process target process PID 2304 wrote to memory of 2660 2304 powershell.exe MSBuild.exe PID 2304 wrote to memory of 2660 2304 powershell.exe MSBuild.exe PID 2304 wrote to memory of 2660 2304 powershell.exe MSBuild.exe PID 2304 wrote to memory of 2660 2304 powershell.exe MSBuild.exe PID 2304 wrote to memory of 2660 2304 powershell.exe MSBuild.exe PID 2304 wrote to memory of 2660 2304 powershell.exe MSBuild.exe PID 2304 wrote to memory of 2660 2304 powershell.exe MSBuild.exe PID 2304 wrote to memory of 2660 2304 powershell.exe MSBuild.exe PID 2304 wrote to memory of 2660 2304 powershell.exe MSBuild.exe PID 2304 wrote to memory of 2660 2304 powershell.exe MSBuild.exe PID 2660 wrote to memory of 2744 2660 MSBuild.exe WerFault.exe PID 2660 wrote to memory of 2744 2660 MSBuild.exe WerFault.exe PID 2660 wrote to memory of 2744 2660 MSBuild.exe WerFault.exe PID 2660 wrote to memory of 2744 2660 MSBuild.exe WerFault.exe
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\3f612a7d13131add2c7480a8f4afc2e2.ps11⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"{path}"2⤵
- Suspicious use of WriteProcessMemory
PID:2660
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2660 -s 1121⤵
- Program crash
PID:2744