Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
- submitted
15/01/2024, 10:16
General
- Target 5cd29d239d3f04b7e1cb461fb2163a54.xll
- Size 882KB
- Sample240115-matedaehg2
- SHA256 b658ce4e95ffaa7288d69749ff05fa0073b68281bda83fbfb846ec77e9412ff1
Malware Config
Extracted
-
xlm4.0
Extracted
-
oski
-
nedu1994.xyz
Signatures
- Oski
Oski is an infostealer targeting browser data, crypto wallets.
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 1 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SetWindowsHookEx 11 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\5cd29d239d3f04b7e1cb461fb2163a54.xll"1⤵
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\service.exe"C:\Users\Admin\AppData\Roaming\service.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\service.exe"C:\Users\Admin\AppData\Roaming\service.exe"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2520 -s 13124⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2520 -ip 25201⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
5cd29d239d3f04b7e1cb461fb2163a54.xll
5cd29d239d3f04b7e1cb461fb2163a54.xll
sample.xlsx
service.exe
service.exe
service.exe
service.exe
memory/1532-40-0x000001961E150000-0x000001961E160000-memory.dmp
memory/1532-7-0x00007FFBD0070000-0x00007FFBD0265000-memory.dmp
memory/1532-11-0x00007FFBD0070000-0x00007FFBD0265000-memory.dmp
memory/1532-13-0x00007FFBD0070000-0x00007FFBD0265000-memory.dmp
memory/1532-14-0x00007FFBD0070000-0x00007FFBD0265000-memory.dmp
memory/1532-16-0x00007FFBD0070000-0x00007FFBD0265000-memory.dmp
memory/1532-17-0x00007FFBD0070000-0x00007FFBD0265000-memory.dmp
memory/1532-19-0x00007FFBD0070000-0x00007FFBD0265000-memory.dmp
memory/1532-20-0x00007FFBD0070000-0x00007FFBD0265000-memory.dmp
memory/1532-22-0x00007FFBD0070000-0x00007FFBD0265000-memory.dmp
memory/1532-21-0x00007FFBD0070000-0x00007FFBD0265000-memory.dmp
memory/1532-18-0x00007FFB8E090000-0x00007FFB8E0A0000-memory.dmp
memory/1532-15-0x00007FFBD0070000-0x00007FFBD0265000-memory.dmp
memory/1532-12-0x00007FFB8E090000-0x00007FFB8E0A0000-memory.dmp
memory/1532-8-0x00007FFB900F0000-0x00007FFB90100000-memory.dmp
memory/1532-6-0x00007FFB900F0000-0x00007FFB90100000-memory.dmp
memory/1532-25-0x000001961D510000-0x000001961D606000-memory.dmp
memory/1532-10-0x00007FFBD0070000-0x00007FFBD0265000-memory.dmp
memory/1532-30-0x00007FFBA7BE0000-0x00007FFBA86A1000-memory.dmp
memory/1532-28-0x000001961F8E0000-0x000001961F8FC000-memory.dmp
memory/1532-29-0x000001961FA30000-0x000001961FA6C000-memory.dmp
memory/1532-36-0x000001961F9E0000-0x000001961F9F0000-memory.dmp
memory/1532-35-0x000001961F9E0000-0x000001961F9F0000-memory.dmp
memory/1532-34-0x000001961F9E0000-0x000001961F9F0000-memory.dmp
memory/1532-2-0x00007FFB900F0000-0x00007FFB90100000-memory.dmp
memory/1532-0-0x00007FFB900F0000-0x00007FFB90100000-memory.dmp
memory/1532-39-0x000001961E0A0000-0x000001961E156000-memory.dmp
memory/1532-33-0x000001961F9E0000-0x000001961F9F0000-memory.dmp
memory/1532-9-0x00007FFBD0070000-0x00007FFBD0265000-memory.dmp
memory/1532-122-0x00007FFBA7BE0000-0x00007FFBA86A1000-memory.dmp
memory/1532-32-0x000001961F9E0000-0x000001961F9F0000-memory.dmp
memory/1532-3-0x00007FFBD0070000-0x00007FFBD0265000-memory.dmp
memory/1532-4-0x00007FFB900F0000-0x00007FFB90100000-memory.dmp
memory/1532-5-0x00007FFBD0070000-0x00007FFBD0265000-memory.dmp
memory/1532-121-0x00007FFBD0070000-0x00007FFBD0265000-memory.dmp
memory/1532-120-0x00007FFB900F0000-0x00007FFB90100000-memory.dmp
memory/1532-119-0x00007FFB900F0000-0x00007FFB90100000-memory.dmp
memory/1532-1-0x00007FFBD0070000-0x00007FFBD0265000-memory.dmp
memory/1532-31-0x000001961F9E0000-0x000001961F9F0000-memory.dmp
memory/1532-118-0x00007FFB900F0000-0x00007FFB90100000-memory.dmp
memory/1532-117-0x00007FFB900F0000-0x00007FFB90100000-memory.dmp
memory/1532-100-0x000001961F9E0000-0x000001961F9F0000-memory.dmp
memory/1532-89-0x00007FFBD0070000-0x00007FFBD0265000-memory.dmp
memory/1532-92-0x00007FFBD0070000-0x00007FFBD0265000-memory.dmp
memory/1532-93-0x00007FFBD0070000-0x00007FFBD0265000-memory.dmp
memory/1532-94-0x00007FFBA7BE0000-0x00007FFBA86A1000-memory.dmp
memory/1532-96-0x000001961F9E0000-0x000001961F9F0000-memory.dmp
memory/1532-95-0x000001961F9E0000-0x000001961F9F0000-memory.dmp
memory/1532-99-0x000001961F9E0000-0x000001961F9F0000-memory.dmp
memory/1532-98-0x000001961F9E0000-0x000001961F9F0000-memory.dmp
memory/1532-97-0x000001961F9E0000-0x000001961F9F0000-memory.dmp
memory/2520-85-0x0000000000400000-0x0000000000438000-memory.dmp
memory/2520-81-0x0000000000400000-0x0000000000438000-memory.dmp
memory/2520-82-0x0000000000400000-0x0000000000438000-memory.dmp
memory/2520-80-0x0000000000400000-0x0000000000438000-memory.dmp
memory/2520-78-0x0000000000400000-0x0000000000438000-memory.dmp
memory/2928-76-0x0000000000A40000-0x0000000000B40000-memory.dmp
memory/2928-77-0x00000000029C0000-0x00000000029C2000-memory.dmp