Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
22-12-2023 14:45
General
-
Target
ca3bb3fc686f6bb324c449a91bb495fb.ps1
-
Size
421KB
-
MD5
ca3bb3fc686f6bb324c449a91bb495fb
-
SHA1
29440914fe715c5ebdbd9a0dc66318f29ca46b47
-
SHA256
e170f6e534f68f5afcfe10c3bb456ddd307e7986a34c314c359ee48a8068725e
-
SHA512
ae57360f9a99944f72f250c1d5d2cdb41c65c0e3ce69db36c336b00cdd1a230f0e5f4bb810daeee875d201812ea89e70c9bdd371b1a647fd97e9711f41110f62
-
SSDEEP
12288:+Zjw0RJ9u5ILYDxD3fxYehza/tw64tL68:q3O
Score
10/10
Malware Config
Extracted
Family
oski
C2
/103.114.107.28/l404/
Signatures
-
Oski
Oski is an infostealer targeting browser data, crypto wallets.
-
Suspicious use of SetThreadContext 1 IoCs
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\ca3bb3fc686f6bb324c449a91bb495fb.ps11⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"{path}"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1632 -s 11123⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 1632 -ip 16321⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
136KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
40KB
-
Filesize
224KB
-
Filesize
224KB
-
Filesize
224KB
-
Filesize
224KB
-
Filesize
224KB