Analysis
- max time kernel
94s - max time network
122s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
22/12/2023, 07:49
General
- Target 7ad581d76c337e128d9cfd945e93b4f7.ps1
- Size 656KB
- Sample231222-jnypgacegm
- SHA256 5fac5223ded981c62838cd0e50bf4d53f4bb46286662be235fb59424f040e00c
Malware Config
Extracted
-
oski
-
/103.114.107.28/l404/
Signatures
- Oski
Oski is an infostealer targeting browser data, crypto wallets.
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\7ad581d76c337e128d9cfd945e93b4f7.ps11⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe#cmd2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3744 -s 11003⤵
- Program crash
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe#cmd2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3744 -ip 37441⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_ngqo2zu4.mnb.ps1
memory/3288-54-0x00000271DABC0000-0x00000271DABC1000-memory.dmp
memory/3288-29-0x00000271F3020000-0x00000271F3040000-memory.dmp
memory/3288-9-0x00000271F5230000-0x00000271F5252000-memory.dmp
memory/3288-12-0x00000271F3040000-0x00000271F3050000-memory.dmp
memory/3288-13-0x00000271F3020000-0x00000271F3046000-memory.dmp
memory/3288-19-0x00000271F3020000-0x00000271F3040000-memory.dmp
memory/3288-33-0x00000271F3020000-0x00000271F3040000-memory.dmp
memory/3288-43-0x00000271F3020000-0x00000271F3040000-memory.dmp
memory/3288-53-0x00000271F3020000-0x00000271F3040000-memory.dmp
memory/3288-15-0x00000271F3020000-0x00000271F3040000-memory.dmp
memory/3288-47-0x00000271F3020000-0x00000271F3040000-memory.dmp
memory/3288-14-0x00000271F3020000-0x00000271F3040000-memory.dmp
memory/3288-61-0x00007FFBE3900000-0x00007FFBE43C1000-memory.dmp
memory/3288-56-0x00000271F3040000-0x00000271F3050000-memory.dmp
memory/3288-17-0x00000271F3020000-0x00000271F3040000-memory.dmp
memory/3288-10-0x00007FFBE3900000-0x00007FFBE43C1000-memory.dmp
memory/3288-11-0x00000271F3040000-0x00000271F3050000-memory.dmp
memory/3288-49-0x00000271F3020000-0x00000271F3040000-memory.dmp
memory/3288-21-0x00000271F3020000-0x00000271F3040000-memory.dmp
memory/3288-45-0x00000271F3020000-0x00000271F3040000-memory.dmp
memory/3288-41-0x00000271F3020000-0x00000271F3040000-memory.dmp
memory/3288-39-0x00000271F3020000-0x00000271F3040000-memory.dmp
memory/3288-37-0x00000271F3020000-0x00000271F3040000-memory.dmp
memory/3288-35-0x00000271F3020000-0x00000271F3040000-memory.dmp
memory/3288-31-0x00000271F3020000-0x00000271F3040000-memory.dmp
memory/3288-51-0x00000271F3020000-0x00000271F3040000-memory.dmp
memory/3288-27-0x00000271F3020000-0x00000271F3040000-memory.dmp
memory/3288-25-0x00000271F3020000-0x00000271F3040000-memory.dmp
memory/3288-23-0x00000271F3020000-0x00000271F3040000-memory.dmp
memory/3744-60-0x0000000000400000-0x0000000000438000-memory.dmp
memory/3744-55-0x0000000000400000-0x0000000000438000-memory.dmp
memory/3744-62-0x0000000000400000-0x0000000000438000-memory.dmp
memory/3744-57-0x0000000000400000-0x0000000000438000-memory.dmp
memory/3744-65-0x0000000000400000-0x0000000000438000-memory.dmp