Analysis
-
max time kernel
45s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
28-12-2023 12:11
General
-
Target
ddde6fc0ce346b0ab7bb0c8c02a09d33.exe
-
Size
1.2MB
-
MD5
ddde6fc0ce346b0ab7bb0c8c02a09d33
-
SHA1
1067652f21fd05902288613746b5e2ea79bd07f9
-
SHA256
a375d88a6666e7101b4f582ea0239033e4716e883ecb301245011e9c58054a9c
-
SHA512
66a92b7f14371069d78876add097fb8f847755eff95edd846939566f0ce219b686f265c8a57dbe6e19e5f12145bfbfcccff09371413a758005d1aee7d8490c49
-
SSDEEP
12288:PYhxa6BTGO/NkJWZeZQCmdjVv6LZRsXdmSLem2Vg4miT9UJESs6IcWByCcRQUBqh:PYv5CmHAIOsBgo0q4wMPnpx2XP4iO1H
Malware Config
Extracted
oski
fine.le-pearl.com
Signatures
-
Oski
Oski is an infostealer targeting browser data, crypto wallets.
-
CustAttr .NET packer 1 IoCs
Detects CustAttr .NET packer in memory.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ddde6fc0ce346b0ab7bb0c8c02a09d33.exe"C:\Users\Admin\AppData\Local\Temp\ddde6fc0ce346b0ab7bb0c8c02a09d33.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\ddde6fc0ce346b0ab7bb0c8c02a09d33.exe"C:\Users\Admin\AppData\Local\Temp\ddde6fc0ce346b0ab7bb0c8c02a09d33.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2388 -s 13443⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\nllJKmehpTGztY.exe"2⤵
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nllJKmehpTGztY" /XML "C:\Users\Admin\AppData\Local\Temp\tmpFE65.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\nllJKmehpTGztY.exe"2⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ddde6fc0ce346b0ab7bb0c8c02a09d33.exe"2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2388 -ip 23881⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
224KB
-
Filesize
224KB
-
Filesize
224KB
-
Filesize
224KB
-
Filesize
224KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
304KB
-
Filesize
584KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
40KB
-
Filesize
7.7MB
-
Filesize
1.3MB
-
Filesize
5.6MB
-
Filesize
624KB
-
Filesize
72KB
-
Filesize
344KB
-
Filesize
520KB
-
Filesize
7.7MB
-
Filesize
232KB
-
Filesize
104KB
-
Filesize
64KB
-
Filesize
120KB
-
Filesize
3.3MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
32KB
-
Filesize
56KB
-
Filesize
200KB
-
Filesize
304KB
-
Filesize
120KB
-
Filesize
68KB
-
Filesize
652KB
-
Filesize
64KB
-
Filesize
600KB
-
Filesize
64KB
-
Filesize
216KB
-
Filesize
6.5MB
-
Filesize
40KB
-
Filesize
408KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
136KB
-
Filesize
408KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
304KB
-
Filesize
80KB
-
Filesize
6.2MB
-
Filesize
104KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
304KB