Analysis
- max time kernel
1s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
22/12/2023, 02:53
General
- Target 56d68b21e189451019367c59f00ee597.ps1
- Size 656KB
- Sample231222-ddbt3abde8
- SHA256 19b3d1605a53c09fa8a8fc3675c928cb5403bdef1e3bd0b3c4d69f56a06e436d
Malware Config
Extracted
-
oski
-
103.114.107.28/l17/
Signatures
- Oski
Oski is an infostealer targeting browser data, crypto wallets.
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\56d68b21e189451019367c59f00ee597.ps11⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe#cmd2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe#cmd2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4348 -s 12123⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4348 -ip 43481⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_b2fe4uoa.x5c.ps1
memory/4348-59-0x0000000000400000-0x0000000000438000-memory.dmp
memory/4348-67-0x0000000000400000-0x0000000000438000-memory.dmp
memory/4348-64-0x0000000000400000-0x0000000000438000-memory.dmp
memory/4348-55-0x0000000000400000-0x0000000000438000-memory.dmp
memory/4348-61-0x0000000000400000-0x0000000000438000-memory.dmp
memory/4348-62-0x0000000000400000-0x0000000000438000-memory.dmp
memory/4424-43-0x000001DE46F10000-0x000001DE46F30000-memory.dmp
memory/4424-35-0x000001DE46F10000-0x000001DE46F30000-memory.dmp
memory/4424-13-0x000001DE46F10000-0x000001DE46F36000-memory.dmp
memory/4424-60-0x00007FFB54700000-0x00007FFB551C1000-memory.dmp
memory/4424-58-0x000001DE46A70000-0x000001DE46A80000-memory.dmp
memory/4424-10-0x00007FFB54700000-0x00007FFB551C1000-memory.dmp
memory/4424-54-0x000001DE46A60000-0x000001DE46A61000-memory.dmp
memory/4424-53-0x000001DE46F10000-0x000001DE46F30000-memory.dmp
memory/4424-51-0x000001DE46F10000-0x000001DE46F30000-memory.dmp
memory/4424-49-0x000001DE46F10000-0x000001DE46F30000-memory.dmp
memory/4424-47-0x000001DE46F10000-0x000001DE46F30000-memory.dmp
memory/4424-0-0x000001DE46A20000-0x000001DE46A42000-memory.dmp
memory/4424-41-0x000001DE46F10000-0x000001DE46F30000-memory.dmp
memory/4424-39-0x000001DE46F10000-0x000001DE46F30000-memory.dmp
memory/4424-37-0x000001DE46F10000-0x000001DE46F30000-memory.dmp
memory/4424-45-0x000001DE46F10000-0x000001DE46F30000-memory.dmp
memory/4424-33-0x000001DE46F10000-0x000001DE46F30000-memory.dmp
memory/4424-31-0x000001DE46F10000-0x000001DE46F30000-memory.dmp
memory/4424-29-0x000001DE46F10000-0x000001DE46F30000-memory.dmp
memory/4424-27-0x000001DE46F10000-0x000001DE46F30000-memory.dmp
memory/4424-25-0x000001DE46F10000-0x000001DE46F30000-memory.dmp
memory/4424-23-0x000001DE46F10000-0x000001DE46F30000-memory.dmp
memory/4424-21-0x000001DE46F10000-0x000001DE46F30000-memory.dmp
memory/4424-19-0x000001DE46F10000-0x000001DE46F30000-memory.dmp
memory/4424-17-0x000001DE46F10000-0x000001DE46F30000-memory.dmp
memory/4424-15-0x000001DE46F10000-0x000001DE46F30000-memory.dmp
memory/4424-14-0x000001DE46F10000-0x000001DE46F30000-memory.dmp
memory/4424-63-0x000001DE46A70000-0x000001DE46A80000-memory.dmp
memory/4424-11-0x000001DE46A70000-0x000001DE46A80000-memory.dmp
memory/4424-12-0x000001DE46A70000-0x000001DE46A80000-memory.dmp