Analysis
-
max time kernel
119s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
11-01-2024 08:28
Static task
static1
Behavioral task
behavioral1
Sample
530792b4cfa0029b904ae5130fe1d265.ps1
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
530792b4cfa0029b904ae5130fe1d265.ps1
Resource
win10v2004-20231215-en
General
-
Target
530792b4cfa0029b904ae5130fe1d265.ps1
-
Size
421KB
-
MD5
530792b4cfa0029b904ae5130fe1d265
-
SHA1
37a8e553cf5c1d21b8894ed520293ad1e35dadfb
-
SHA256
341efe957c47c866377854003f2bc59907ea2cebb98728121cc68f3b94e2c835
-
SHA512
0f7c53e9636a49de7c7dcdfe18af627e91e0d7579cb0c748f858e21bf74c31a7eaf75e2cf73770793ce5df8952977b0b81293e0ff80ede5e8a8247f1833c89f7
-
SSDEEP
12288:+Zjw0RJ9u5ILYDxD3fxYehza/tw64gL68:q3f
Malware Config
Extracted
oski
103.114.107.28/l15/
Signatures
-
Oski
Oski is an infostealer targeting browser data, crypto wallets.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
powershell.exedescription pid process target process PID 1352 set thread context of 2808 1352 powershell.exe MSBuild.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2736 2808 WerFault.exe MSBuild.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 1352 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 1352 powershell.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
powershell.exeMSBuild.exedescription pid process target process PID 1352 wrote to memory of 2808 1352 powershell.exe MSBuild.exe PID 1352 wrote to memory of 2808 1352 powershell.exe MSBuild.exe PID 1352 wrote to memory of 2808 1352 powershell.exe MSBuild.exe PID 1352 wrote to memory of 2808 1352 powershell.exe MSBuild.exe PID 1352 wrote to memory of 2808 1352 powershell.exe MSBuild.exe PID 1352 wrote to memory of 2808 1352 powershell.exe MSBuild.exe PID 1352 wrote to memory of 2808 1352 powershell.exe MSBuild.exe PID 1352 wrote to memory of 2808 1352 powershell.exe MSBuild.exe PID 1352 wrote to memory of 2808 1352 powershell.exe MSBuild.exe PID 1352 wrote to memory of 2808 1352 powershell.exe MSBuild.exe PID 2808 wrote to memory of 2736 2808 MSBuild.exe WerFault.exe PID 2808 wrote to memory of 2736 2808 MSBuild.exe WerFault.exe PID 2808 wrote to memory of 2736 2808 MSBuild.exe WerFault.exe PID 2808 wrote to memory of 2736 2808 MSBuild.exe WerFault.exe
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\530792b4cfa0029b904ae5130fe1d265.ps11⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"{path}"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 1123⤵
- Program crash
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1352-12-0x00000000029A0000-0x00000000029AA000-memory.dmpFilesize
40KB
-
memory/1352-7-0x00000000029B0000-0x0000000002A30000-memory.dmpFilesize
512KB
-
memory/1352-4-0x000000001B100000-0x000000001B3E2000-memory.dmpFilesize
2.9MB
-
memory/1352-8-0x00000000029B0000-0x0000000002A30000-memory.dmpFilesize
512KB
-
memory/1352-9-0x00000000029B0000-0x0000000002A30000-memory.dmpFilesize
512KB
-
memory/1352-6-0x0000000002460000-0x0000000002468000-memory.dmpFilesize
32KB
-
memory/1352-10-0x000007FEF5440000-0x000007FEF5DDD000-memory.dmpFilesize
9.6MB
-
memory/1352-11-0x00000000029B0000-0x0000000002A30000-memory.dmpFilesize
512KB
-
memory/1352-23-0x000007FEF5440000-0x000007FEF5DDD000-memory.dmpFilesize
9.6MB
-
memory/1352-5-0x000007FEF5440000-0x000007FEF5DDD000-memory.dmpFilesize
9.6MB
-
memory/2808-20-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2808-18-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2808-16-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2808-15-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2808-14-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2808-13-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2808-22-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2808-19-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB