Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
22-12-2023 04:52
Static task
static1
Behavioral task
behavioral1
Sample
691bcebe74dfe8204bb6eb1ca4f37f6b.ps1
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
691bcebe74dfe8204bb6eb1ca4f37f6b.ps1
Resource
win10v2004-20231222-en
General
-
Target
691bcebe74dfe8204bb6eb1ca4f37f6b.ps1
-
Size
421KB
-
MD5
691bcebe74dfe8204bb6eb1ca4f37f6b
-
SHA1
de511e989219a1d93d778c448d28e2c585acc113
-
SHA256
572c0ed2674a63ce3e58d42a019cdaca9cce57398636a07432da48f4920421c7
-
SHA512
8b4d64c8c725cb8b464eb1ea85a4321ab1d3732f9b21eb7c4b6d2111b0643358b24d03777d806f858f8ccefab7e4693f29e74e64099792357abbc3a6f8263375
-
SSDEEP
12288:+Zjw0RJ9u5ILYDxD3fxYehza/tw64oL68:q3r
Malware Config
Extracted
oski
/103.114.107.28/l33/
Signatures
-
Oski
Oski is an infostealer targeting browser data, crypto wallets.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
powershell.exedescription pid process target process PID 2220 set thread context of 2600 2220 powershell.exe MSBuild.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process 2772 2600 WerFault.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 2220 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 2220 powershell.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
powershell.exeMSBuild.exedescription pid process target process PID 2220 wrote to memory of 2600 2220 powershell.exe MSBuild.exe PID 2220 wrote to memory of 2600 2220 powershell.exe MSBuild.exe PID 2220 wrote to memory of 2600 2220 powershell.exe MSBuild.exe PID 2220 wrote to memory of 2600 2220 powershell.exe MSBuild.exe PID 2220 wrote to memory of 2600 2220 powershell.exe MSBuild.exe PID 2220 wrote to memory of 2600 2220 powershell.exe MSBuild.exe PID 2220 wrote to memory of 2600 2220 powershell.exe MSBuild.exe PID 2220 wrote to memory of 2600 2220 powershell.exe MSBuild.exe PID 2220 wrote to memory of 2600 2220 powershell.exe MSBuild.exe PID 2220 wrote to memory of 2600 2220 powershell.exe MSBuild.exe PID 2600 wrote to memory of 2772 2600 MSBuild.exe WerFault.exe PID 2600 wrote to memory of 2772 2600 MSBuild.exe WerFault.exe PID 2600 wrote to memory of 2772 2600 MSBuild.exe WerFault.exe PID 2600 wrote to memory of 2772 2600 MSBuild.exe WerFault.exe
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\691bcebe74dfe8204bb6eb1ca4f37f6b.ps11⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"{path}"2⤵
- Suspicious use of WriteProcessMemory
PID:2600
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2600 -s 5041⤵
- Program crash
PID:2772