Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
22/12/2023, 05:03
General
- Target 6da1d6a255fe2098408c3c889a4e157e.ps1
- Size 656KB
- Sample231222-fpq48sada5
- SHA256 b049e62984463f3760413281748176a3aba8966e912702088ce33a52db0a4fd7
Malware Config
Extracted
-
oski
-
/103.114.107.28/l25/
Signatures
- Oski
Oski is an infostealer targeting browser data, crypto wallets.
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\6da1d6a255fe2098408c3c889a4e157e.ps11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe#cmd2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5100 -s 10643⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5100 -ip 51001⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_ntkef0c4.c0f.ps1
memory/2900-31-0x000001B7AA1B0000-0x000001B7AA1D0000-memory.dmp
memory/2900-45-0x000001B7AA1B0000-0x000001B7AA1D0000-memory.dmp
memory/2900-10-0x00007FFBE3900000-0x00007FFBE43C1000-memory.dmp
memory/2900-9-0x000001B7C4790000-0x000001B7C47B2000-memory.dmp
memory/2900-13-0x000001B7AA1B0000-0x000001B7AA1D6000-memory.dmp
memory/2900-33-0x000001B7AA1B0000-0x000001B7AA1D0000-memory.dmp
memory/2900-53-0x000001B7AA1B0000-0x000001B7AA1D0000-memory.dmp
memory/2900-14-0x000001B7AA1B0000-0x000001B7AA1D0000-memory.dmp
memory/2900-15-0x000001B7AA1B0000-0x000001B7AA1D0000-memory.dmp
memory/2900-61-0x00007FFBE3900000-0x00007FFBE43C1000-memory.dmp
memory/2900-43-0x000001B7AA1B0000-0x000001B7AA1D0000-memory.dmp
memory/2900-17-0x000001B7AA1B0000-0x000001B7AA1D0000-memory.dmp
memory/2900-56-0x000001B7AA180000-0x000001B7AA190000-memory.dmp
memory/2900-54-0x000001B7C49C0000-0x000001B7C49C1000-memory.dmp
memory/2900-51-0x000001B7AA1B0000-0x000001B7AA1D0000-memory.dmp
memory/2900-49-0x000001B7AA1B0000-0x000001B7AA1D0000-memory.dmp
memory/2900-11-0x000001B7AA180000-0x000001B7AA190000-memory.dmp
memory/2900-47-0x000001B7AA1B0000-0x000001B7AA1D0000-memory.dmp
memory/2900-19-0x000001B7AA1B0000-0x000001B7AA1D0000-memory.dmp
memory/2900-41-0x000001B7AA1B0000-0x000001B7AA1D0000-memory.dmp
memory/2900-39-0x000001B7AA1B0000-0x000001B7AA1D0000-memory.dmp
memory/2900-37-0x000001B7AA1B0000-0x000001B7AA1D0000-memory.dmp
memory/2900-35-0x000001B7AA1B0000-0x000001B7AA1D0000-memory.dmp
memory/2900-12-0x000001B7AA180000-0x000001B7AA190000-memory.dmp
memory/2900-29-0x000001B7AA1B0000-0x000001B7AA1D0000-memory.dmp
memory/2900-27-0x000001B7AA1B0000-0x000001B7AA1D0000-memory.dmp
memory/2900-25-0x000001B7AA1B0000-0x000001B7AA1D0000-memory.dmp
memory/2900-23-0x000001B7AA1B0000-0x000001B7AA1D0000-memory.dmp
memory/2900-21-0x000001B7AA1B0000-0x000001B7AA1D0000-memory.dmp
memory/5100-65-0x0000000000400000-0x0000000000438000-memory.dmp
memory/5100-60-0x0000000000400000-0x0000000000438000-memory.dmp
memory/5100-57-0x0000000000400000-0x0000000000438000-memory.dmp
memory/5100-62-0x0000000000400000-0x0000000000438000-memory.dmp
memory/5100-55-0x0000000000400000-0x0000000000438000-memory.dmp