Analysis
-
max time kernel
119s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
16-01-2024 05:06
Static task
static1
Behavioral task
behavioral1
Sample
5f0969cdd00801051ff7f2afd2343ff3.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
5f0969cdd00801051ff7f2afd2343ff3.exe
Resource
win10v2004-20231222-en
General
-
Target
5f0969cdd00801051ff7f2afd2343ff3.exe
-
Size
789KB
-
MD5
5f0969cdd00801051ff7f2afd2343ff3
-
SHA1
6bbf42e0b05b025e8162404435eb1b25cc07d5f8
-
SHA256
43460a1724b2521dd5e97c68c16edfce9caf22d49452efd956a64db91b5935a7
-
SHA512
0b89a31ae863641dd0b87a7cedb566241e0df84a685f7df73e04c14580b16f80d3042eeaae65a2a09f2772187ff73d0d833f2cfad0663ba4b4a1e8a66c23a9dd
-
SSDEEP
24576:seV+CQ38aT1m7NKsDTxe1/6hTMLevYWhzDcUjMFA:DV+CQ33T1m70sDTkhYM
Malware Config
Extracted
oski
tunqyuindia.com/mar3/
Signatures
-
Oski
Oski is an infostealer targeting browser data, crypto wallets.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
5f0969cdd00801051ff7f2afd2343ff3.exedescription pid process target process PID 2880 set thread context of 3044 2880 5f0969cdd00801051ff7f2afd2343ff3.exe 5f0969cdd00801051ff7f2afd2343ff3.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1860 3044 WerFault.exe 5f0969cdd00801051ff7f2afd2343ff3.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
5f0969cdd00801051ff7f2afd2343ff3.exepid process 2880 5f0969cdd00801051ff7f2afd2343ff3.exe 2880 5f0969cdd00801051ff7f2afd2343ff3.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
5f0969cdd00801051ff7f2afd2343ff3.exedescription pid process Token: SeDebugPrivilege 2880 5f0969cdd00801051ff7f2afd2343ff3.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
5f0969cdd00801051ff7f2afd2343ff3.exe5f0969cdd00801051ff7f2afd2343ff3.exedescription pid process target process PID 2880 wrote to memory of 2592 2880 5f0969cdd00801051ff7f2afd2343ff3.exe schtasks.exe PID 2880 wrote to memory of 2592 2880 5f0969cdd00801051ff7f2afd2343ff3.exe schtasks.exe PID 2880 wrote to memory of 2592 2880 5f0969cdd00801051ff7f2afd2343ff3.exe schtasks.exe PID 2880 wrote to memory of 2592 2880 5f0969cdd00801051ff7f2afd2343ff3.exe schtasks.exe PID 2880 wrote to memory of 2940 2880 5f0969cdd00801051ff7f2afd2343ff3.exe 5f0969cdd00801051ff7f2afd2343ff3.exe PID 2880 wrote to memory of 2940 2880 5f0969cdd00801051ff7f2afd2343ff3.exe 5f0969cdd00801051ff7f2afd2343ff3.exe PID 2880 wrote to memory of 2940 2880 5f0969cdd00801051ff7f2afd2343ff3.exe 5f0969cdd00801051ff7f2afd2343ff3.exe PID 2880 wrote to memory of 2940 2880 5f0969cdd00801051ff7f2afd2343ff3.exe 5f0969cdd00801051ff7f2afd2343ff3.exe PID 2880 wrote to memory of 3044 2880 5f0969cdd00801051ff7f2afd2343ff3.exe 5f0969cdd00801051ff7f2afd2343ff3.exe PID 2880 wrote to memory of 3044 2880 5f0969cdd00801051ff7f2afd2343ff3.exe 5f0969cdd00801051ff7f2afd2343ff3.exe PID 2880 wrote to memory of 3044 2880 5f0969cdd00801051ff7f2afd2343ff3.exe 5f0969cdd00801051ff7f2afd2343ff3.exe PID 2880 wrote to memory of 3044 2880 5f0969cdd00801051ff7f2afd2343ff3.exe 5f0969cdd00801051ff7f2afd2343ff3.exe PID 2880 wrote to memory of 3044 2880 5f0969cdd00801051ff7f2afd2343ff3.exe 5f0969cdd00801051ff7f2afd2343ff3.exe PID 2880 wrote to memory of 3044 2880 5f0969cdd00801051ff7f2afd2343ff3.exe 5f0969cdd00801051ff7f2afd2343ff3.exe PID 2880 wrote to memory of 3044 2880 5f0969cdd00801051ff7f2afd2343ff3.exe 5f0969cdd00801051ff7f2afd2343ff3.exe PID 2880 wrote to memory of 3044 2880 5f0969cdd00801051ff7f2afd2343ff3.exe 5f0969cdd00801051ff7f2afd2343ff3.exe PID 2880 wrote to memory of 3044 2880 5f0969cdd00801051ff7f2afd2343ff3.exe 5f0969cdd00801051ff7f2afd2343ff3.exe PID 2880 wrote to memory of 3044 2880 5f0969cdd00801051ff7f2afd2343ff3.exe 5f0969cdd00801051ff7f2afd2343ff3.exe PID 3044 wrote to memory of 1860 3044 5f0969cdd00801051ff7f2afd2343ff3.exe WerFault.exe PID 3044 wrote to memory of 1860 3044 5f0969cdd00801051ff7f2afd2343ff3.exe WerFault.exe PID 3044 wrote to memory of 1860 3044 5f0969cdd00801051ff7f2afd2343ff3.exe WerFault.exe PID 3044 wrote to memory of 1860 3044 5f0969cdd00801051ff7f2afd2343ff3.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5f0969cdd00801051ff7f2afd2343ff3.exe"C:\Users\Admin\AppData\Local\Temp\5f0969cdd00801051ff7f2afd2343ff3.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vTKyEeK" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1BEA.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\5f0969cdd00801051ff7f2afd2343ff3.exe"C:\Users\Admin\AppData\Local\Temp\5f0969cdd00801051ff7f2afd2343ff3.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\5f0969cdd00801051ff7f2afd2343ff3.exe"C:\Users\Admin\AppData\Local\Temp\5f0969cdd00801051ff7f2afd2343ff3.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3044 -s 1123⤵
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp1BEA.tmpFilesize
1KB
MD5e770a473ca84fe3e9e922c7225948c42
SHA1161a556c636e4073fcde9e75df3a0100441597e3
SHA256a3547a65c1d5f47e841c514c438cfc33ce6ce70468810fc35490205a7acbcfa3
SHA512f3b33ac3b69eb229bcf4f325f01c1ec6ea3526beea4fe3e15c305b05571146114ab851f8f91f56668429f35d0e9e889f8af06223e1fb47a744171324ddfe7ef5
-
memory/2880-8-0x0000000000AA0000-0x0000000000AD8000-memory.dmpFilesize
224KB
-
memory/2880-3-0x0000000001260000-0x00000000012A0000-memory.dmpFilesize
256KB
-
memory/2880-1-0x00000000747D0000-0x0000000074EBE000-memory.dmpFilesize
6.9MB
-
memory/2880-4-0x00000000003F0000-0x0000000000406000-memory.dmpFilesize
88KB
-
memory/2880-5-0x00000000747D0000-0x0000000074EBE000-memory.dmpFilesize
6.9MB
-
memory/2880-6-0x0000000001260000-0x00000000012A0000-memory.dmpFilesize
256KB
-
memory/2880-7-0x000000000D270000-0x000000000D30C000-memory.dmpFilesize
624KB
-
memory/2880-0-0x0000000001340000-0x000000000140A000-memory.dmpFilesize
808KB
-
memory/2880-28-0x00000000747D0000-0x0000000074EBE000-memory.dmpFilesize
6.9MB
-
memory/2880-2-0x0000000000B30000-0x0000000000BC0000-memory.dmpFilesize
576KB
-
memory/3044-16-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/3044-19-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/3044-23-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/3044-25-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/3044-21-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/3044-17-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/3044-27-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/3044-14-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB