Analysis
-
max time kernel
75s -
max time network
168s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
25-12-2023 22:32
General
-
Target
406171ecbe8c3d96852acef91ec2e6db.exe
-
Size
571KB
-
MD5
406171ecbe8c3d96852acef91ec2e6db
-
SHA1
5fb7a4fc46659b510fbcbb51d9e08bdf08490b62
-
SHA256
8e07cf5e12ed70918b410fdb95fdf6905c191df169df5fdf994daac99c8bd359
-
SHA512
d0c472148ded74e627d33f1f1124b9275ba8ab9d2cb1443a88ebfecce57755b7e88d39e77819bbba75dad6cf905ba85e5372ca9341790f56e121263ababf10a3
-
SSDEEP
12288:B5tM+E02iNv4sxxrMAbU3Sg9r28R1g9lHQI0uS:vbE01usjMMuSg96WIjV
Malware Config
Extracted
oski
fair.le-pearl.com
Signatures
-
Oski
Oski is an infostealer targeting browser data, crypto wallets.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes
-
C:\Users\Admin\AppData\Local\Temp\406171ecbe8c3d96852acef91ec2e6db.exe"C:\Users\Admin\AppData\Local\Temp\406171ecbe8c3d96852acef91ec2e6db.exe"1⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\YmTlkQcO" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB65B.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\406171ecbe8c3d96852acef91ec2e6db.exe"{path}"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\406171ecbe8c3d96852acef91ec2e6db.exe"{path}"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4292 -s 13283⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4292 -ip 42921⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
496B
MD51842eed13fddc700a50adada08a0f84d
SHA15e7b6997ffaf89afdb803de2e9231cd8886621ae
SHA25647ac9eef48022403111f9cef6871af594079acdd88da83e7d2b2a92fa47f7368
SHA5120d0086367e60782f81324abc5a79ae4c19aaa96aeb7aead23d4ca2dde0af5cc7cf3cc9b6e391b95405ed97a136fcd99af3f868a6027b89b5fcc47cff52272b1d
-
Filesize
1KB
MD58f1a230760a5f30e5eafd3cfeed001c3
SHA1312b5dca9a4bda5c87db7dd4a4a7db9b8537e442
SHA2565e41c0941ffbd96d8efb19d36a7b1ab2128f658455294adce2a3079980cf3a34
SHA512712fdbf54ac242ba79040a1ab8a294cff209709720fd5b4d1300972a2a6d720b774a7d977183d77b474043606ce442b8d5db48a6ea46f6a059a923441ff66250
-
Filesize
488KB
-
Filesize
224KB
-
Filesize
64KB
-
Filesize
40KB
-
Filesize
624KB
-
Filesize
32KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
600KB
-
Filesize
584KB
-
Filesize
5.6MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
224KB
-
Filesize
224KB
-
Filesize
224KB
-
Filesize
224KB
-
Filesize
224KB