Analysis
-
max time kernel
137s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
16-01-2024 05:06
Static task
static1
Behavioral task
behavioral1
Sample
5f0969cdd00801051ff7f2afd2343ff3.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
5f0969cdd00801051ff7f2afd2343ff3.exe
Resource
win10v2004-20231222-en
General
-
Target
5f0969cdd00801051ff7f2afd2343ff3.exe
-
Size
789KB
-
MD5
5f0969cdd00801051ff7f2afd2343ff3
-
SHA1
6bbf42e0b05b025e8162404435eb1b25cc07d5f8
-
SHA256
43460a1724b2521dd5e97c68c16edfce9caf22d49452efd956a64db91b5935a7
-
SHA512
0b89a31ae863641dd0b87a7cedb566241e0df84a685f7df73e04c14580b16f80d3042eeaae65a2a09f2772187ff73d0d833f2cfad0663ba4b4a1e8a66c23a9dd
-
SSDEEP
24576:seV+CQ38aT1m7NKsDTxe1/6hTMLevYWhzDcUjMFA:DV+CQ33T1m70sDTkhYM
Malware Config
Extracted
oski
tunqyuindia.com/mar3/
Signatures
-
Oski
Oski is an infostealer targeting browser data, crypto wallets.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
5f0969cdd00801051ff7f2afd2343ff3.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation 5f0969cdd00801051ff7f2afd2343ff3.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
5f0969cdd00801051ff7f2afd2343ff3.exedescription pid process target process PID 1708 set thread context of 232 1708 5f0969cdd00801051ff7f2afd2343ff3.exe 5f0969cdd00801051ff7f2afd2343ff3.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1156 232 WerFault.exe 5f0969cdd00801051ff7f2afd2343ff3.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
5f0969cdd00801051ff7f2afd2343ff3.exedescription pid process target process PID 1708 wrote to memory of 2204 1708 5f0969cdd00801051ff7f2afd2343ff3.exe schtasks.exe PID 1708 wrote to memory of 2204 1708 5f0969cdd00801051ff7f2afd2343ff3.exe schtasks.exe PID 1708 wrote to memory of 2204 1708 5f0969cdd00801051ff7f2afd2343ff3.exe schtasks.exe PID 1708 wrote to memory of 232 1708 5f0969cdd00801051ff7f2afd2343ff3.exe 5f0969cdd00801051ff7f2afd2343ff3.exe PID 1708 wrote to memory of 232 1708 5f0969cdd00801051ff7f2afd2343ff3.exe 5f0969cdd00801051ff7f2afd2343ff3.exe PID 1708 wrote to memory of 232 1708 5f0969cdd00801051ff7f2afd2343ff3.exe 5f0969cdd00801051ff7f2afd2343ff3.exe PID 1708 wrote to memory of 232 1708 5f0969cdd00801051ff7f2afd2343ff3.exe 5f0969cdd00801051ff7f2afd2343ff3.exe PID 1708 wrote to memory of 232 1708 5f0969cdd00801051ff7f2afd2343ff3.exe 5f0969cdd00801051ff7f2afd2343ff3.exe PID 1708 wrote to memory of 232 1708 5f0969cdd00801051ff7f2afd2343ff3.exe 5f0969cdd00801051ff7f2afd2343ff3.exe PID 1708 wrote to memory of 232 1708 5f0969cdd00801051ff7f2afd2343ff3.exe 5f0969cdd00801051ff7f2afd2343ff3.exe PID 1708 wrote to memory of 232 1708 5f0969cdd00801051ff7f2afd2343ff3.exe 5f0969cdd00801051ff7f2afd2343ff3.exe PID 1708 wrote to memory of 232 1708 5f0969cdd00801051ff7f2afd2343ff3.exe 5f0969cdd00801051ff7f2afd2343ff3.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5f0969cdd00801051ff7f2afd2343ff3.exe"C:\Users\Admin\AppData\Local\Temp\5f0969cdd00801051ff7f2afd2343ff3.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vTKyEeK" /XML "C:\Users\Admin\AppData\Local\Temp\tmp270B.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\5f0969cdd00801051ff7f2afd2343ff3.exe"C:\Users\Admin\AppData\Local\Temp\5f0969cdd00801051ff7f2afd2343ff3.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 232 -s 13003⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 232 -ip 2321⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp270B.tmpFilesize
1KB
MD5508cf3d7b010c06348cdad05f3c77034
SHA1c32c9d7209ca4413623ddf7ee46e29c01927aef8
SHA25627462574074d4b63c57e7cd300b7f8403ba1166d9ef4037153cb1f4eca142624
SHA5125cbb9eddb7e51f65e4874377ba8cd87cabcc86884a8ba0a82b46bd6cbfa7237d7abae96f729abb934cbef73d9cf8640d1923d2445e8530e6c6325c326e7ecb43
-
memory/232-27-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/232-24-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/232-22-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/232-21-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/232-19-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1708-5-0x0000000005A30000-0x0000000005AC2000-memory.dmpFilesize
584KB
-
memory/1708-13-0x00000000069D0000-0x0000000006A08000-memory.dmpFilesize
224KB
-
memory/1708-7-0x0000000005960000-0x000000000596A000-memory.dmpFilesize
40KB
-
memory/1708-9-0x0000000007050000-0x0000000007066000-memory.dmpFilesize
88KB
-
memory/1708-10-0x0000000074A50000-0x0000000075200000-memory.dmpFilesize
7.7MB
-
memory/1708-11-0x0000000005980000-0x0000000005990000-memory.dmpFilesize
64KB
-
memory/1708-12-0x0000000007070000-0x000000000710C000-memory.dmpFilesize
624KB
-
memory/1708-8-0x0000000005BC0000-0x0000000005C16000-memory.dmpFilesize
344KB
-
memory/1708-6-0x0000000005980000-0x0000000005990000-memory.dmpFilesize
64KB
-
memory/1708-1-0x0000000074A50000-0x0000000075200000-memory.dmpFilesize
7.7MB
-
memory/1708-4-0x000000000A360000-0x000000000A904000-memory.dmpFilesize
5.6MB
-
memory/1708-23-0x0000000074A50000-0x0000000075200000-memory.dmpFilesize
7.7MB
-
memory/1708-2-0x00000000058C0000-0x0000000005950000-memory.dmpFilesize
576KB
-
memory/1708-3-0x0000000009D10000-0x0000000009DAC000-memory.dmpFilesize
624KB
-
memory/1708-0-0x0000000000D60000-0x0000000000E2A000-memory.dmpFilesize
808KB