Analysis
-
max time kernel
122s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
01-01-2024 09:07
Static task
static1
Behavioral task
behavioral1
Sample
3c7485ba08cb4cb5c9af2fd0e670efee.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
3c7485ba08cb4cb5c9af2fd0e670efee.exe
Resource
win10v2004-20231222-en
General
-
Target
3c7485ba08cb4cb5c9af2fd0e670efee.exe
-
Size
1.1MB
-
MD5
3c7485ba08cb4cb5c9af2fd0e670efee
-
SHA1
bb0a4d2f63e42b269f9d7b9b894fb731093cda9e
-
SHA256
e5c692ae3dc9c88bd07613f088686835c2e4ea2755c6abbdc01bac7bce5b924a
-
SHA512
8a8095eb685cbbf0cbed9c4cc11bd4b86d56c60922a6625dc86546f37dfe0c356a4066832e2e60083342c1a1e3749d6ca2f09c894779f055fac9e9c8c03b43c0
-
SSDEEP
12288:Hg5BQaiYOSaDV5bvh2days0tGLKe+ML+QrX/6GXVUJsSgWiE9Y:A5BQaT2DLNl90tGn+hQr/nsn9Y
Malware Config
Extracted
oski
2tril.com
Signatures
-
Oski
Oski is an infostealer targeting browser data, crypto wallets.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
3c7485ba08cb4cb5c9af2fd0e670efee.exedescription pid process target process PID 2708 set thread context of 1440 2708 3c7485ba08cb4cb5c9af2fd0e670efee.exe 3c7485ba08cb4cb5c9af2fd0e670efee.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 856 1440 WerFault.exe 3c7485ba08cb4cb5c9af2fd0e670efee.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
3c7485ba08cb4cb5c9af2fd0e670efee.exe3c7485ba08cb4cb5c9af2fd0e670efee.exedescription pid process target process PID 2708 wrote to memory of 1440 2708 3c7485ba08cb4cb5c9af2fd0e670efee.exe 3c7485ba08cb4cb5c9af2fd0e670efee.exe PID 2708 wrote to memory of 1440 2708 3c7485ba08cb4cb5c9af2fd0e670efee.exe 3c7485ba08cb4cb5c9af2fd0e670efee.exe PID 2708 wrote to memory of 1440 2708 3c7485ba08cb4cb5c9af2fd0e670efee.exe 3c7485ba08cb4cb5c9af2fd0e670efee.exe PID 2708 wrote to memory of 1440 2708 3c7485ba08cb4cb5c9af2fd0e670efee.exe 3c7485ba08cb4cb5c9af2fd0e670efee.exe PID 2708 wrote to memory of 1440 2708 3c7485ba08cb4cb5c9af2fd0e670efee.exe 3c7485ba08cb4cb5c9af2fd0e670efee.exe PID 2708 wrote to memory of 1440 2708 3c7485ba08cb4cb5c9af2fd0e670efee.exe 3c7485ba08cb4cb5c9af2fd0e670efee.exe PID 2708 wrote to memory of 1440 2708 3c7485ba08cb4cb5c9af2fd0e670efee.exe 3c7485ba08cb4cb5c9af2fd0e670efee.exe PID 2708 wrote to memory of 1440 2708 3c7485ba08cb4cb5c9af2fd0e670efee.exe 3c7485ba08cb4cb5c9af2fd0e670efee.exe PID 2708 wrote to memory of 1440 2708 3c7485ba08cb4cb5c9af2fd0e670efee.exe 3c7485ba08cb4cb5c9af2fd0e670efee.exe PID 2708 wrote to memory of 1440 2708 3c7485ba08cb4cb5c9af2fd0e670efee.exe 3c7485ba08cb4cb5c9af2fd0e670efee.exe PID 1440 wrote to memory of 856 1440 3c7485ba08cb4cb5c9af2fd0e670efee.exe WerFault.exe PID 1440 wrote to memory of 856 1440 3c7485ba08cb4cb5c9af2fd0e670efee.exe WerFault.exe PID 1440 wrote to memory of 856 1440 3c7485ba08cb4cb5c9af2fd0e670efee.exe WerFault.exe PID 1440 wrote to memory of 856 1440 3c7485ba08cb4cb5c9af2fd0e670efee.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3c7485ba08cb4cb5c9af2fd0e670efee.exe"C:\Users\Admin\AppData\Local\Temp\3c7485ba08cb4cb5c9af2fd0e670efee.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3c7485ba08cb4cb5c9af2fd0e670efee.exe"C:\Users\Admin\AppData\Local\Temp\3c7485ba08cb4cb5c9af2fd0e670efee.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1440 -s 2563⤵
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\msvcp140.dllFilesize
150B
MD58b181bb6767bc5795dcf17341a387e5b
SHA1b5e2a9fb1f8a4aad3c7127c769af4c780b47bef4
SHA25632cbc376cd769a26d108ae31678f975b863b7066e110c59d9a212c7281bd8c81
SHA5122550b61ffa1ef8dd2613704798e3a717321c8e3569849dcbfb3049f441b8bccf9287b7139f3cef3371c1bb0476da31523e5e83b6a81af3ebc4d91142e06c76c6
-
memory/1440-17-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1440-15-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1440-12-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1440-13-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1440-10-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1440-19-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1440-20-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1440-8-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1440-14-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2708-6-0x00000000055A0000-0x0000000005640000-memory.dmpFilesize
640KB
-
memory/2708-4-0x0000000074B90000-0x000000007527E000-memory.dmpFilesize
6.9MB
-
memory/2708-0-0x0000000074B90000-0x000000007527E000-memory.dmpFilesize
6.9MB
-
memory/2708-3-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/2708-1-0x00000000009C0000-0x0000000000ADA000-memory.dmpFilesize
1.1MB
-
memory/2708-21-0x0000000074B90000-0x000000007527E000-memory.dmpFilesize
6.9MB
-
memory/2708-7-0x0000000005740000-0x00000000057B6000-memory.dmpFilesize
472KB
-
memory/2708-2-0x0000000004E80000-0x0000000004EC0000-memory.dmpFilesize
256KB
-
memory/2708-5-0x0000000004E80000-0x0000000004EC0000-memory.dmpFilesize
256KB