Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
22-12-2023 14:29
Static task
static1
Behavioral task
behavioral1
Sample
c3e00cc05db28caecab4318f65f9a7c2.ps1
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
c3e00cc05db28caecab4318f65f9a7c2.ps1
Resource
win10v2004-20231215-en
General
-
Target
c3e00cc05db28caecab4318f65f9a7c2.ps1
-
Size
421KB
-
MD5
c3e00cc05db28caecab4318f65f9a7c2
-
SHA1
fd468321e743de0aab68ae03bdc214b3442d5195
-
SHA256
3975ff5fd7f0c5e82b1f932ce5c5fd1d66627dac6043701fe26cbf36035f91bb
-
SHA512
67ffd50620c1d33ad3dc450095fd6a5606251efec9661b180ad97e21b789df3130dbe3b5589e5b061ff0c03cb52bc2e225364c6f80d8d1272ebdd597313da10a
-
SSDEEP
12288:+Zjw0RJ9u5ILYDxD3fxYehza/tw64NL68:q36
Malware Config
Extracted
oski
/103.114.107.28/l36/
Signatures
-
Oski
Oski is an infostealer targeting browser data, crypto wallets.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
powershell.exedescription pid process target process PID 2360 set thread context of 2168 2360 powershell.exe MSBuild.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2904 2168 WerFault.exe MSBuild.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 2360 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 2360 powershell.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
powershell.exeMSBuild.exedescription pid process target process PID 2360 wrote to memory of 2168 2360 powershell.exe MSBuild.exe PID 2360 wrote to memory of 2168 2360 powershell.exe MSBuild.exe PID 2360 wrote to memory of 2168 2360 powershell.exe MSBuild.exe PID 2360 wrote to memory of 2168 2360 powershell.exe MSBuild.exe PID 2360 wrote to memory of 2168 2360 powershell.exe MSBuild.exe PID 2360 wrote to memory of 2168 2360 powershell.exe MSBuild.exe PID 2360 wrote to memory of 2168 2360 powershell.exe MSBuild.exe PID 2360 wrote to memory of 2168 2360 powershell.exe MSBuild.exe PID 2360 wrote to memory of 2168 2360 powershell.exe MSBuild.exe PID 2360 wrote to memory of 2168 2360 powershell.exe MSBuild.exe PID 2168 wrote to memory of 2904 2168 MSBuild.exe WerFault.exe PID 2168 wrote to memory of 2904 2168 MSBuild.exe WerFault.exe PID 2168 wrote to memory of 2904 2168 MSBuild.exe WerFault.exe PID 2168 wrote to memory of 2904 2168 MSBuild.exe WerFault.exe
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\c3e00cc05db28caecab4318f65f9a7c2.ps11⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"{path}"2⤵
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2168 -s 5043⤵
- Program crash
PID:2904