Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
15-01-2024 10:16
Static task
static1
Behavioral task
behavioral1
Sample
5cd29d239d3f04b7e1cb461fb2163a54.xll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
5cd29d239d3f04b7e1cb461fb2163a54.xll
Resource
win10v2004-20231222-en
General
-
Target
5cd29d239d3f04b7e1cb461fb2163a54.xll
-
Size
882KB
-
MD5
5cd29d239d3f04b7e1cb461fb2163a54
-
SHA1
19e0178a22a65e575ffa116b0bb4968159ace31f
-
SHA256
b658ce4e95ffaa7288d69749ff05fa0073b68281bda83fbfb846ec77e9412ff1
-
SHA512
761f33d326d1788f5fb148bff5ad3abafe2bccb308988fe3d617b34a0ac83127fa35c7591c7a11c109b95a9514253e84583a6075e0cc96455ff75ca2cbaaef6d
-
SSDEEP
12288:Pn/zDvGHAykHSzLW/4+8bzbBSreMddhgFK/UqWgaHv2prIsma4KAzya13Ui/vWng:3zbGHAzHAjX1QcLgaHv6bmaXkGi/vW
Malware Config
Extracted
Extracted
oski
nedu1994.xyz
Signatures
-
Oski
Oski is an infostealer targeting browser data, crypto wallets.
-
Executes dropped EXE 2 IoCs
Processes:
service.exeservice.exepid process 2928 service.exe 2520 service.exe -
Loads dropped DLL 2 IoCs
Processes:
EXCEL.EXEpid process 1532 EXCEL.EXE 1532 EXCEL.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
service.exedescription pid process target process PID 2928 set thread context of 2520 2928 service.exe service.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4000 2520 WerFault.exe service.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1532 EXCEL.EXE -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
service.exepid process 2928 service.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
EXCEL.EXEpid process 1532 EXCEL.EXE 1532 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 11 IoCs
Processes:
EXCEL.EXEpid process 1532 EXCEL.EXE 1532 EXCEL.EXE 1532 EXCEL.EXE 1532 EXCEL.EXE 1532 EXCEL.EXE 1532 EXCEL.EXE 1532 EXCEL.EXE 1532 EXCEL.EXE 1532 EXCEL.EXE 1532 EXCEL.EXE 1532 EXCEL.EXE -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
EXCEL.EXEservice.exedescription pid process target process PID 1532 wrote to memory of 2928 1532 EXCEL.EXE service.exe PID 1532 wrote to memory of 2928 1532 EXCEL.EXE service.exe PID 1532 wrote to memory of 2928 1532 EXCEL.EXE service.exe PID 2928 wrote to memory of 2520 2928 service.exe service.exe PID 2928 wrote to memory of 2520 2928 service.exe service.exe PID 2928 wrote to memory of 2520 2928 service.exe service.exe PID 2928 wrote to memory of 2520 2928 service.exe service.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\5cd29d239d3f04b7e1cb461fb2163a54.xll"1⤵
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\service.exe"C:\Users\Admin\AppData\Roaming\service.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\service.exe"C:\Users\Admin\AppData\Roaming\service.exe"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2520 -s 13124⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2520 -ip 25201⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\5cd29d239d3f04b7e1cb461fb2163a54.xllFilesize
95KB
MD52cf5944fd026fffe7b8dc8047f8fa08b
SHA170423f5f1c32d489a774cdddaa57d6bda7490129
SHA256b0a374b7583de2bab5bf96b77b9d625d6b9b8e9f59c4b9e371d22c2cbef920cf
SHA512f5d6afd8f57cc2b8a97484dc6b347d6dbfc780905baaff40d0607a6f4e1976067912dce09dd4f252a299be3792d49b120f7f4807c67ddf843a07cbf9a53d4cec
-
C:\Users\Admin\AppData\Local\Temp\5cd29d239d3f04b7e1cb461fb2163a54.xllFilesize
71KB
MD52fc92357a5f39fec032d3f9aa582f2cc
SHA16ae55f07f54fc4f9b0bd3a7e923d231dd13dcbfd
SHA256685b8fc916fc01e5e473df6150589881f61b6b7d4f9b89e3255629b861a1ef01
SHA512764ae803d53897380d1c55bdae9ab6f8677553580a8c9cf88c979daa24b20327cdc4f4cc0edf2a913f3617d7b4962334f16df5cb8aab9757a5ba0019ba3a1b34
-
C:\Users\Admin\AppData\Local\Temp\sample.xlsxFilesize
12KB
MD536cadc2fa9f7938f74061fda9b126a9f
SHA15252934ac46fb3bc8fdb361880ade043070501bd
SHA256afc8ea53b3eeb62a44ce6d2b4593931d009ec00769410e76478cc88eab59d1f4
SHA512b7668575cea53280a3d553b18e1ac7670eeafab9f2d48db5d86496722e2b1d5d48a3ac3b1e56a8d7198abd771f2d95fef4449792c214dffc2097e62273e7db1f
-
C:\Users\Admin\AppData\Roaming\service.exeFilesize
37KB
MD5bee3e66196b7e4e14e1235270b4f090a
SHA11a579744f37d6bd89db455141e67e54a1bb648b8
SHA256f721b4d78c6f05346e9d48bc67f5e935cb6f24b8b7972995d558d1f8160c5fc9
SHA512eb2b211a7e2f87910faec07bc8d404f9d350f922858d10b6f4eb6a5d235bd8933741871af8647135ab3ccf73b122ef29b791238274e2007ddf5af2669a315e5c
-
C:\Users\Admin\AppData\Roaming\service.exeFilesize
33KB
MD591b8dcb2d7e12d9a1ee98f167c204273
SHA100f423e760620ed4a25b1edf861675cb995da699
SHA256922d62dac8ae653d9b610fe7ceef0c2a63b0c124ae37257c19dbe307def85871
SHA512bd9dd633e1dab1c2985156aa0d4734baa324fc36734e93850157d1674f47c15bd44ccfb3c11269b6629b2ad541c40aaacc7f7dc87d1b1e18cd814c5a3909e62e
-
C:\Users\Admin\AppData\Roaming\service.exeFilesize
18KB
MD5ca0427571c5fe7748857ae6c4a9568ac
SHA1db284f5377bf294b5ffee22ef0eb98c691377982
SHA256f570170f7f947ada8ca5311d8a178d2a374e725b65ea696d0c90bca3a9d8c341
SHA51279648de1ad17af39ade8a5e93546c6d92c9c6e9bc3a6c34e1ac1186549f93e9b2af1e810ba6d6cfb09354417c8b3c0d7a85d063d7cf86bea98948c03965ebc18
-
C:\Users\Admin\AppData\Roaming\service.exeFilesize
307KB
MD5b77d6ad852a07967357551461fe4b162
SHA1890f8e6640ff3c67e813c9a58d8cc16ccfa4288c
SHA25680d15a0decd0f7c2731066f466aea3f76adc1de4efe03d6041e357f1f1248c9d
SHA5128cb8de2e02c110e2d9d5d869d4aaa3e7a10ef34c0079c7971f3b520284063ea18aaba145e44c87d1dfcdaae279e6495abf2187208d6d0e5248ab384b5ab6329f
-
memory/1532-40-0x000001961E150000-0x000001961E160000-memory.dmpFilesize
64KB
-
memory/1532-14-0x00007FFBD0070000-0x00007FFBD0265000-memory.dmpFilesize
2.0MB
-
memory/1532-32-0x000001961F9E0000-0x000001961F9F0000-memory.dmpFilesize
64KB
-
memory/1532-13-0x00007FFBD0070000-0x00007FFBD0265000-memory.dmpFilesize
2.0MB
-
memory/1532-31-0x000001961F9E0000-0x000001961F9F0000-memory.dmpFilesize
64KB
-
memory/1532-16-0x00007FFBD0070000-0x00007FFBD0265000-memory.dmpFilesize
2.0MB
-
memory/1532-17-0x00007FFBD0070000-0x00007FFBD0265000-memory.dmpFilesize
2.0MB
-
memory/1532-19-0x00007FFBD0070000-0x00007FFBD0265000-memory.dmpFilesize
2.0MB
-
memory/1532-20-0x00007FFBD0070000-0x00007FFBD0265000-memory.dmpFilesize
2.0MB
-
memory/1532-22-0x00007FFBD0070000-0x00007FFBD0265000-memory.dmpFilesize
2.0MB
-
memory/1532-21-0x00007FFBD0070000-0x00007FFBD0265000-memory.dmpFilesize
2.0MB
-
memory/1532-18-0x00007FFB8E090000-0x00007FFB8E0A0000-memory.dmpFilesize
64KB
-
memory/1532-15-0x00007FFBD0070000-0x00007FFBD0265000-memory.dmpFilesize
2.0MB
-
memory/1532-12-0x00007FFB8E090000-0x00007FFB8E0A0000-memory.dmpFilesize
64KB
-
memory/1532-8-0x00007FFB900F0000-0x00007FFB90100000-memory.dmpFilesize
64KB
-
memory/1532-6-0x00007FFB900F0000-0x00007FFB90100000-memory.dmpFilesize
64KB
-
memory/1532-25-0x000001961D510000-0x000001961D606000-memory.dmpFilesize
984KB
-
memory/1532-10-0x00007FFBD0070000-0x00007FFBD0265000-memory.dmpFilesize
2.0MB
-
memory/1532-7-0x00007FFBD0070000-0x00007FFBD0265000-memory.dmpFilesize
2.0MB
-
memory/1532-28-0x000001961F8E0000-0x000001961F8FC000-memory.dmpFilesize
112KB
-
memory/1532-29-0x000001961FA30000-0x000001961FA6C000-memory.dmpFilesize
240KB
-
memory/1532-36-0x000001961F9E0000-0x000001961F9F0000-memory.dmpFilesize
64KB
-
memory/1532-35-0x000001961F9E0000-0x000001961F9F0000-memory.dmpFilesize
64KB
-
memory/1532-34-0x000001961F9E0000-0x000001961F9F0000-memory.dmpFilesize
64KB
-
memory/1532-30-0x00007FFBA7BE0000-0x00007FFBA86A1000-memory.dmpFilesize
10.8MB
-
memory/1532-0-0x00007FFB900F0000-0x00007FFB90100000-memory.dmpFilesize
64KB
-
memory/1532-39-0x000001961E0A0000-0x000001961E156000-memory.dmpFilesize
728KB
-
memory/1532-33-0x000001961F9E0000-0x000001961F9F0000-memory.dmpFilesize
64KB
-
memory/1532-11-0x00007FFBD0070000-0x00007FFBD0265000-memory.dmpFilesize
2.0MB
-
memory/1532-9-0x00007FFBD0070000-0x00007FFBD0265000-memory.dmpFilesize
2.0MB
-
memory/1532-2-0x00007FFB900F0000-0x00007FFB90100000-memory.dmpFilesize
64KB
-
memory/1532-3-0x00007FFBD0070000-0x00007FFBD0265000-memory.dmpFilesize
2.0MB
-
memory/1532-4-0x00007FFB900F0000-0x00007FFB90100000-memory.dmpFilesize
64KB
-
memory/1532-5-0x00007FFBD0070000-0x00007FFBD0265000-memory.dmpFilesize
2.0MB
-
memory/1532-122-0x00007FFBA7BE0000-0x00007FFBA86A1000-memory.dmpFilesize
10.8MB
-
memory/1532-121-0x00007FFBD0070000-0x00007FFBD0265000-memory.dmpFilesize
2.0MB
-
memory/1532-120-0x00007FFB900F0000-0x00007FFB90100000-memory.dmpFilesize
64KB
-
memory/1532-1-0x00007FFBD0070000-0x00007FFBD0265000-memory.dmpFilesize
2.0MB
-
memory/1532-119-0x00007FFB900F0000-0x00007FFB90100000-memory.dmpFilesize
64KB
-
memory/1532-118-0x00007FFB900F0000-0x00007FFB90100000-memory.dmpFilesize
64KB
-
memory/1532-117-0x00007FFB900F0000-0x00007FFB90100000-memory.dmpFilesize
64KB
-
memory/1532-100-0x000001961F9E0000-0x000001961F9F0000-memory.dmpFilesize
64KB
-
memory/1532-89-0x00007FFBD0070000-0x00007FFBD0265000-memory.dmpFilesize
2.0MB
-
memory/1532-92-0x00007FFBD0070000-0x00007FFBD0265000-memory.dmpFilesize
2.0MB
-
memory/1532-93-0x00007FFBD0070000-0x00007FFBD0265000-memory.dmpFilesize
2.0MB
-
memory/1532-94-0x00007FFBA7BE0000-0x00007FFBA86A1000-memory.dmpFilesize
10.8MB
-
memory/1532-96-0x000001961F9E0000-0x000001961F9F0000-memory.dmpFilesize
64KB
-
memory/1532-95-0x000001961F9E0000-0x000001961F9F0000-memory.dmpFilesize
64KB
-
memory/1532-99-0x000001961F9E0000-0x000001961F9F0000-memory.dmpFilesize
64KB
-
memory/1532-98-0x000001961F9E0000-0x000001961F9F0000-memory.dmpFilesize
64KB
-
memory/1532-97-0x000001961F9E0000-0x000001961F9F0000-memory.dmpFilesize
64KB
-
memory/2520-85-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2520-78-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2520-81-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2520-82-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2520-80-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2928-76-0x0000000000A40000-0x0000000000B40000-memory.dmpFilesize
1024KB
-
memory/2928-77-0x00000000029C0000-0x00000000029C2000-memory.dmpFilesize
8KB