Analysis
-
max time kernel
117s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
22-12-2023 14:49
Static task
static1
Behavioral task
behavioral1
Sample
cc4bdd8e7f88763262c4634434b1dd77.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
cc4bdd8e7f88763262c4634434b1dd77.exe
Resource
win10v2004-20231215-en
General
-
Target
cc4bdd8e7f88763262c4634434b1dd77.exe
-
Size
1.1MB
-
MD5
cc4bdd8e7f88763262c4634434b1dd77
-
SHA1
f79dafab3b401354ee39c1e212cbd2f7b578971a
-
SHA256
a2ae38d4b467bc8ab66ae53b28bd01365e9240b83f7f5e952d42c2aee0eae3ca
-
SHA512
dbf2a96ad199051dd7466c164024dca35b08b09d6a5384a1f5aea0ca6f3474f1e1dd9a8d329676bfd4e4271494c2de0a276c59e1f677ce4696c34292bc2e8b36
-
SSDEEP
24576:4MXD6D+Xq6Hy1Tl99QQdt7eq7XrN7xoeizky+Vr8x:zXD6D+6Z1Tri4r7o9aVox
Malware Config
Extracted
oski
176.113.82.180
Signatures
-
Oski
Oski is an infostealer targeting browser data, crypto wallets.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
cc4bdd8e7f88763262c4634434b1dd77.exedescription pid process target process PID 2992 set thread context of 3040 2992 cc4bdd8e7f88763262c4634434b1dd77.exe cc4bdd8e7f88763262c4634434b1dd77.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2608 3040 WerFault.exe cc4bdd8e7f88763262c4634434b1dd77.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
cc4bdd8e7f88763262c4634434b1dd77.exepid process 2992 cc4bdd8e7f88763262c4634434b1dd77.exe 2992 cc4bdd8e7f88763262c4634434b1dd77.exe 2992 cc4bdd8e7f88763262c4634434b1dd77.exe 2992 cc4bdd8e7f88763262c4634434b1dd77.exe 2992 cc4bdd8e7f88763262c4634434b1dd77.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
cc4bdd8e7f88763262c4634434b1dd77.exedescription pid process Token: SeDebugPrivilege 2992 cc4bdd8e7f88763262c4634434b1dd77.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
cc4bdd8e7f88763262c4634434b1dd77.execc4bdd8e7f88763262c4634434b1dd77.exedescription pid process target process PID 2992 wrote to memory of 2908 2992 cc4bdd8e7f88763262c4634434b1dd77.exe cc4bdd8e7f88763262c4634434b1dd77.exe PID 2992 wrote to memory of 2908 2992 cc4bdd8e7f88763262c4634434b1dd77.exe cc4bdd8e7f88763262c4634434b1dd77.exe PID 2992 wrote to memory of 2908 2992 cc4bdd8e7f88763262c4634434b1dd77.exe cc4bdd8e7f88763262c4634434b1dd77.exe PID 2992 wrote to memory of 2908 2992 cc4bdd8e7f88763262c4634434b1dd77.exe cc4bdd8e7f88763262c4634434b1dd77.exe PID 2992 wrote to memory of 2664 2992 cc4bdd8e7f88763262c4634434b1dd77.exe cc4bdd8e7f88763262c4634434b1dd77.exe PID 2992 wrote to memory of 2664 2992 cc4bdd8e7f88763262c4634434b1dd77.exe cc4bdd8e7f88763262c4634434b1dd77.exe PID 2992 wrote to memory of 2664 2992 cc4bdd8e7f88763262c4634434b1dd77.exe cc4bdd8e7f88763262c4634434b1dd77.exe PID 2992 wrote to memory of 2664 2992 cc4bdd8e7f88763262c4634434b1dd77.exe cc4bdd8e7f88763262c4634434b1dd77.exe PID 2992 wrote to memory of 1508 2992 cc4bdd8e7f88763262c4634434b1dd77.exe cc4bdd8e7f88763262c4634434b1dd77.exe PID 2992 wrote to memory of 1508 2992 cc4bdd8e7f88763262c4634434b1dd77.exe cc4bdd8e7f88763262c4634434b1dd77.exe PID 2992 wrote to memory of 1508 2992 cc4bdd8e7f88763262c4634434b1dd77.exe cc4bdd8e7f88763262c4634434b1dd77.exe PID 2992 wrote to memory of 1508 2992 cc4bdd8e7f88763262c4634434b1dd77.exe cc4bdd8e7f88763262c4634434b1dd77.exe PID 2992 wrote to memory of 3040 2992 cc4bdd8e7f88763262c4634434b1dd77.exe cc4bdd8e7f88763262c4634434b1dd77.exe PID 2992 wrote to memory of 3040 2992 cc4bdd8e7f88763262c4634434b1dd77.exe cc4bdd8e7f88763262c4634434b1dd77.exe PID 2992 wrote to memory of 3040 2992 cc4bdd8e7f88763262c4634434b1dd77.exe cc4bdd8e7f88763262c4634434b1dd77.exe PID 2992 wrote to memory of 3040 2992 cc4bdd8e7f88763262c4634434b1dd77.exe cc4bdd8e7f88763262c4634434b1dd77.exe PID 2992 wrote to memory of 3040 2992 cc4bdd8e7f88763262c4634434b1dd77.exe cc4bdd8e7f88763262c4634434b1dd77.exe PID 2992 wrote to memory of 3040 2992 cc4bdd8e7f88763262c4634434b1dd77.exe cc4bdd8e7f88763262c4634434b1dd77.exe PID 2992 wrote to memory of 3040 2992 cc4bdd8e7f88763262c4634434b1dd77.exe cc4bdd8e7f88763262c4634434b1dd77.exe PID 2992 wrote to memory of 3040 2992 cc4bdd8e7f88763262c4634434b1dd77.exe cc4bdd8e7f88763262c4634434b1dd77.exe PID 2992 wrote to memory of 3040 2992 cc4bdd8e7f88763262c4634434b1dd77.exe cc4bdd8e7f88763262c4634434b1dd77.exe PID 2992 wrote to memory of 3040 2992 cc4bdd8e7f88763262c4634434b1dd77.exe cc4bdd8e7f88763262c4634434b1dd77.exe PID 3040 wrote to memory of 2608 3040 cc4bdd8e7f88763262c4634434b1dd77.exe WerFault.exe PID 3040 wrote to memory of 2608 3040 cc4bdd8e7f88763262c4634434b1dd77.exe WerFault.exe PID 3040 wrote to memory of 2608 3040 cc4bdd8e7f88763262c4634434b1dd77.exe WerFault.exe PID 3040 wrote to memory of 2608 3040 cc4bdd8e7f88763262c4634434b1dd77.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cc4bdd8e7f88763262c4634434b1dd77.exe"C:\Users\Admin\AppData\Local\Temp\cc4bdd8e7f88763262c4634434b1dd77.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\cc4bdd8e7f88763262c4634434b1dd77.exe"{path}"2⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\cc4bdd8e7f88763262c4634434b1dd77.exe"{path}"2⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\cc4bdd8e7f88763262c4634434b1dd77.exe"{path}"2⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\cc4bdd8e7f88763262c4634434b1dd77.exe"{path}"2⤵
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3040 -s 1123⤵
- Program crash
PID:2608