Analysis
-
max time kernel
115s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
01-01-2024 05:45
Static task
static1
Behavioral task
behavioral1
Sample
3c0aae14c733b8f3b5f15d3f066e343d.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
3c0aae14c733b8f3b5f15d3f066e343d.exe
Resource
win10v2004-20231222-en
General
-
Target
3c0aae14c733b8f3b5f15d3f066e343d.exe
-
Size
1.1MB
-
MD5
3c0aae14c733b8f3b5f15d3f066e343d
-
SHA1
a75840830a4a95f779809f4d52ad7328de9e4c6f
-
SHA256
fd16c60e634e807f6bbb7c3e6e12a4231b7b34851eb98d6da2f178b6125c536f
-
SHA512
d97683d0a10a9e4131e0212e0d030bac4237402704da24b20997ae48abbf71d04a3d703d1b2b8c79875d15f0c16ba8868888a08b26eaaac96454175a99fa3700
-
SSDEEP
12288:O/8XZuGwgtGb74uChgDCe83dHY3XJEkKBiy8CalBmNWab9UXvBJZQ63GvIZDgQ:O/g5g74nGDCJxWXSfBihmECSfBJ
Malware Config
Extracted
oski
kckark.xyz
Signatures
-
Oski
Oski is an infostealer targeting browser data, crypto wallets.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
3c0aae14c733b8f3b5f15d3f066e343d.exedescription pid process target process PID 1748 set thread context of 1100 1748 3c0aae14c733b8f3b5f15d3f066e343d.exe 3c0aae14c733b8f3b5f15d3f066e343d.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2112 1100 WerFault.exe 3c0aae14c733b8f3b5f15d3f066e343d.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
3c0aae14c733b8f3b5f15d3f066e343d.exedescription pid process target process PID 1748 wrote to memory of 1100 1748 3c0aae14c733b8f3b5f15d3f066e343d.exe 3c0aae14c733b8f3b5f15d3f066e343d.exe PID 1748 wrote to memory of 1100 1748 3c0aae14c733b8f3b5f15d3f066e343d.exe 3c0aae14c733b8f3b5f15d3f066e343d.exe PID 1748 wrote to memory of 1100 1748 3c0aae14c733b8f3b5f15d3f066e343d.exe 3c0aae14c733b8f3b5f15d3f066e343d.exe PID 1748 wrote to memory of 1100 1748 3c0aae14c733b8f3b5f15d3f066e343d.exe 3c0aae14c733b8f3b5f15d3f066e343d.exe PID 1748 wrote to memory of 1100 1748 3c0aae14c733b8f3b5f15d3f066e343d.exe 3c0aae14c733b8f3b5f15d3f066e343d.exe PID 1748 wrote to memory of 1100 1748 3c0aae14c733b8f3b5f15d3f066e343d.exe 3c0aae14c733b8f3b5f15d3f066e343d.exe PID 1748 wrote to memory of 1100 1748 3c0aae14c733b8f3b5f15d3f066e343d.exe 3c0aae14c733b8f3b5f15d3f066e343d.exe PID 1748 wrote to memory of 1100 1748 3c0aae14c733b8f3b5f15d3f066e343d.exe 3c0aae14c733b8f3b5f15d3f066e343d.exe PID 1748 wrote to memory of 1100 1748 3c0aae14c733b8f3b5f15d3f066e343d.exe 3c0aae14c733b8f3b5f15d3f066e343d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3c0aae14c733b8f3b5f15d3f066e343d.exe"C:\Users\Admin\AppData\Local\Temp\3c0aae14c733b8f3b5f15d3f066e343d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3c0aae14c733b8f3b5f15d3f066e343d.exe"C:\Users\Admin\AppData\Local\Temp\3c0aae14c733b8f3b5f15d3f066e343d.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1100 -s 13243⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1100 -ip 11001⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1100-17-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1100-21-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1100-13-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1100-14-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1100-16-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1748-8-0x0000000004E10000-0x0000000004E2E000-memory.dmpFilesize
120KB
-
memory/1748-12-0x000000000A560000-0x000000000A598000-memory.dmpFilesize
224KB
-
memory/1748-1-0x00000000746A0000-0x0000000074E50000-memory.dmpFilesize
7.7MB
-
memory/1748-0-0x0000000000900000-0x0000000000A18000-memory.dmpFilesize
1.1MB
-
memory/1748-9-0x00000000746A0000-0x0000000074E50000-memory.dmpFilesize
7.7MB
-
memory/1748-10-0x0000000005770000-0x0000000005780000-memory.dmpFilesize
64KB
-
memory/1748-11-0x00000000080E0000-0x0000000008180000-memory.dmpFilesize
640KB
-
memory/1748-5-0x0000000005770000-0x0000000005780000-memory.dmpFilesize
64KB
-
memory/1748-18-0x00000000746A0000-0x0000000074E50000-memory.dmpFilesize
7.7MB
-
memory/1748-6-0x00000000054A0000-0x00000000054AA000-memory.dmpFilesize
40KB
-
memory/1748-7-0x0000000005700000-0x0000000005756000-memory.dmpFilesize
344KB
-
memory/1748-4-0x0000000005570000-0x0000000005602000-memory.dmpFilesize
584KB
-
memory/1748-3-0x0000000005A80000-0x0000000006024000-memory.dmpFilesize
5.6MB
-
memory/1748-2-0x00000000053D0000-0x000000000546C000-memory.dmpFilesize
624KB