Analysis
-
max time kernel
137s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
01-01-2024 09:07
Static task
static1
Behavioral task
behavioral1
Sample
3c7485ba08cb4cb5c9af2fd0e670efee.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
3c7485ba08cb4cb5c9af2fd0e670efee.exe
Resource
win10v2004-20231222-en
General
-
Target
3c7485ba08cb4cb5c9af2fd0e670efee.exe
-
Size
1.1MB
-
MD5
3c7485ba08cb4cb5c9af2fd0e670efee
-
SHA1
bb0a4d2f63e42b269f9d7b9b894fb731093cda9e
-
SHA256
e5c692ae3dc9c88bd07613f088686835c2e4ea2755c6abbdc01bac7bce5b924a
-
SHA512
8a8095eb685cbbf0cbed9c4cc11bd4b86d56c60922a6625dc86546f37dfe0c356a4066832e2e60083342c1a1e3749d6ca2f09c894779f055fac9e9c8c03b43c0
-
SSDEEP
12288:Hg5BQaiYOSaDV5bvh2days0tGLKe+ML+QrX/6GXVUJsSgWiE9Y:A5BQaT2DLNl90tGn+hQr/nsn9Y
Malware Config
Extracted
oski
2tril.com
Signatures
-
Oski
Oski is an infostealer targeting browser data, crypto wallets.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
3c7485ba08cb4cb5c9af2fd0e670efee.exedescription pid process target process PID 2632 set thread context of 4252 2632 3c7485ba08cb4cb5c9af2fd0e670efee.exe 3c7485ba08cb4cb5c9af2fd0e670efee.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4776 4252 WerFault.exe 3c7485ba08cb4cb5c9af2fd0e670efee.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
3c7485ba08cb4cb5c9af2fd0e670efee.exedescription pid process target process PID 2632 wrote to memory of 4252 2632 3c7485ba08cb4cb5c9af2fd0e670efee.exe 3c7485ba08cb4cb5c9af2fd0e670efee.exe PID 2632 wrote to memory of 4252 2632 3c7485ba08cb4cb5c9af2fd0e670efee.exe 3c7485ba08cb4cb5c9af2fd0e670efee.exe PID 2632 wrote to memory of 4252 2632 3c7485ba08cb4cb5c9af2fd0e670efee.exe 3c7485ba08cb4cb5c9af2fd0e670efee.exe PID 2632 wrote to memory of 4252 2632 3c7485ba08cb4cb5c9af2fd0e670efee.exe 3c7485ba08cb4cb5c9af2fd0e670efee.exe PID 2632 wrote to memory of 4252 2632 3c7485ba08cb4cb5c9af2fd0e670efee.exe 3c7485ba08cb4cb5c9af2fd0e670efee.exe PID 2632 wrote to memory of 4252 2632 3c7485ba08cb4cb5c9af2fd0e670efee.exe 3c7485ba08cb4cb5c9af2fd0e670efee.exe PID 2632 wrote to memory of 4252 2632 3c7485ba08cb4cb5c9af2fd0e670efee.exe 3c7485ba08cb4cb5c9af2fd0e670efee.exe PID 2632 wrote to memory of 4252 2632 3c7485ba08cb4cb5c9af2fd0e670efee.exe 3c7485ba08cb4cb5c9af2fd0e670efee.exe PID 2632 wrote to memory of 4252 2632 3c7485ba08cb4cb5c9af2fd0e670efee.exe 3c7485ba08cb4cb5c9af2fd0e670efee.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3c7485ba08cb4cb5c9af2fd0e670efee.exe"C:\Users\Admin\AppData\Local\Temp\3c7485ba08cb4cb5c9af2fd0e670efee.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3c7485ba08cb4cb5c9af2fd0e670efee.exe"C:\Users\Admin\AppData\Local\Temp\3c7485ba08cb4cb5c9af2fd0e670efee.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4252 -s 13283⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4252 -ip 42521⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2632-8-0x0000000074A40000-0x00000000751F0000-memory.dmpFilesize
7.7MB
-
memory/2632-3-0x0000000005350000-0x00000000053E2000-memory.dmpFilesize
584KB
-
memory/2632-9-0x00000000054D0000-0x00000000054E0000-memory.dmpFilesize
64KB
-
memory/2632-10-0x0000000006DE0000-0x0000000006E80000-memory.dmpFilesize
640KB
-
memory/2632-5-0x0000000005330000-0x000000000533A000-memory.dmpFilesize
40KB
-
memory/2632-0-0x0000000000810000-0x000000000092A000-memory.dmpFilesize
1.1MB
-
memory/2632-7-0x00000000066B0000-0x000000000674C000-memory.dmpFilesize
624KB
-
memory/2632-6-0x00000000054A0000-0x00000000054BC000-memory.dmpFilesize
112KB
-
memory/2632-1-0x0000000074A40000-0x00000000751F0000-memory.dmpFilesize
7.7MB
-
memory/2632-2-0x0000000005860000-0x0000000005E04000-memory.dmpFilesize
5.6MB
-
memory/2632-4-0x00000000054D0000-0x00000000054E0000-memory.dmpFilesize
64KB
-
memory/2632-11-0x00000000093D0000-0x0000000009446000-memory.dmpFilesize
472KB
-
memory/2632-16-0x0000000074A40000-0x00000000751F0000-memory.dmpFilesize
7.7MB
-
memory/4252-15-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/4252-17-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/4252-13-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/4252-12-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/4252-28-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB