Analysis
-
max time kernel
1s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
30-12-2023 13:55
General
-
Target
1ab68861cbb539af250899445e168233.xll
-
Size
1.2MB
-
MD5
1ab68861cbb539af250899445e168233
-
SHA1
e4299a99e197c034b76f9415acb599c810f4f659
-
SHA256
7b05d46b12945a754e07915535b5c977078818b088ce5de1a31ff40b3c2bef61
-
SHA512
3ce1f719220f13fafb5fc07d0c8def676fd717ecf3e068088b0e0bf35b686866b0e9adc4cd051fd2990f46df5b120e365e77b93b8f6ff5863297a3fcd6a6a518
-
SSDEEP
24576:DzbGHAzHKjX1rBY4ZyrE7K3yl8PeVooA/AB2LEgpUqY/CL+elRtA3k0yy3l4VzCa:DziHILpUhxel6k0yyW094
Malware Config
Extracted
oski
himarkh.xyz
Signatures
-
Oski
Oski is an infostealer targeting browser data, crypto wallets.
-
Program crash 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\1ab68861cbb539af250899445e168233.xll"1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\service.exe"C:\Users\Admin\AppData\Roaming\service.exe"2⤵
-
C:\Users\Admin\AppData\Roaming\service.exe"C:\Users\Admin\AppData\Roaming\service.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4024 -s 13004⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 4024 -ip 40241⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
43KB
MD58125477119a277dc58ee20ca3d870b60
SHA18293d16cb9186b706aff93aae4aa53423cb44908
SHA25646b27065f5436d0560c1e868dc6d071b832316581519ef5a45ac233105aed8e9
SHA512e57a56738f57fdd3613affdcd6e48253e05bb200f6d959cbe35f5ad89df8da0c49898c9389c4be9120c115c2114ccc2661ca6d4fe719544b69692b72a0446ccb
-
Filesize
47KB
MD5fc68eb85d3deabe1fa002037fd5a8377
SHA12f866151f4967830d52264d4cb64e2f82e517708
SHA256fb977d5278477cc3f8d14456e7bbf0f2bd4b95ccac417e6fb056c9407eecfd3c
SHA512f24d0f1350261f8b265fcfc01b6e99987fc56757af0f153928e67a9fb9ea26d3581ead2c8da85d2017de9b24aa608e29c654146e1e29474119ab6993443e645c
-
Filesize
12KB
MD536cadc2fa9f7938f74061fda9b126a9f
SHA15252934ac46fb3bc8fdb361880ade043070501bd
SHA256afc8ea53b3eeb62a44ce6d2b4593931d009ec00769410e76478cc88eab59d1f4
SHA512b7668575cea53280a3d553b18e1ac7670eeafab9f2d48db5d86496722e2b1d5d48a3ac3b1e56a8d7198abd771f2d95fef4449792c214dffc2097e62273e7db1f
-
Filesize
6KB
MD552cc467873c97802fa8f69451aefdefb
SHA1b07990e53b8b7168a2cfeb50b41a833058ba7f55
SHA2565eb2eb29f7cdd9c35ccdf540f6d7a8c1d0198046f5dc12905e5ea02f2b11cbce
SHA51231062d08805e527f14e27a9ad6768df9ec445367800eb479777e3c38469d25630b3953ae16532e38b45965be4472ababce3d2802b68bd0a9a127e390314ad205
-
Filesize
9KB
MD56325b7526eef46e8ff26c2e57ba83bff
SHA1a07e4bdd3e02a50b81e0b6695c7b3d32c2aed9e4
SHA2564fca2536dcfee43b3b836ed772c80b2e69249f0aaefd36c4dbfc163b0e0326e1
SHA5122fd2c4fd1b3847584552eec82d2e73368009c33c49d35044a5b22dff8038d5498841b6762d5c1a3d5ad502b27b808746c68fab2a161060f1a85c11ed87e92f2e
-
Filesize
19KB
MD53eedb42e9b33781c3b8aaacbe6db883c
SHA1ca8045378c8469c0b10605f96a0edd38495ef722
SHA2561e30fab074424736cf1370f92b02acc815bb8b0a2fd13aa2a65b4fcbf1829054
SHA5121623f8d2a2e49afac59021f68e97aeb477e86ebc7ed7df276d1c7ac8e29cd5bbaf357d42a22fa82368c5679f1c3b061c390f31964142b4deec80a2bf5a79a23a
-
Filesize
23KB
MD5ed6290341d71279126826af4b1d28c38
SHA10a7ea22fd136ed0535c86d7c84149515a6f9724c
SHA256bc66d2def584922c5c92470e521c458f54cd75306084dea815d859c015d7e0c4
SHA5122d508e7d1c4e543d049a82078dac5937edfe38b17d1998ca73fd44ce730bc1eb2a197414280f63a6b8fc46f26330005c674d2c953300282fb6ed1529e80b0362
-
Filesize
736KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
1.2MB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
112KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
232KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
624KB
-
Filesize
7.7MB
-
Filesize
88KB
-
Filesize
224KB
-
Filesize
720KB
-
Filesize
5.6MB
-
Filesize
7.7MB
-
Filesize
40KB
-
Filesize
64KB
-
Filesize
648KB
-
Filesize
584KB
-
Filesize
64KB
-
Filesize
224KB
-
Filesize
224KB
-
Filesize
224KB
-
Filesize
224KB
-
Filesize
224KB