Analysis
- max time kernel
101s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
- submitted
29/01/2024, 23:26
General
- Target PO# HM00050746 13461-001,xls.xll
- Size 1.4MB
- Sample240129-3e642achh3
- SHA256 fd042d218a6adcb4d496f6d0e9f6fb3dfabdc24bc8bc86681480d76597ec258b
Malware Config
Extracted
-
xlm4.0
Extracted
-
oski
-
himarkh.xyz
Signatures
- Oski
Oski is an infostealer targeting browser data, crypto wallets.
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 1 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SetWindowsHookEx 11 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\PO# HM00050746 13461-001,xls.xll"1⤵
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\service.exe"C:\Users\Admin\AppData\Roaming\service.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\service.exe"C:\Users\Admin\AppData\Roaming\service.exe"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4196 -s 13164⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4196 -ip 41961⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
PO# HM00050746 13461-001,xls.xll
PO# HM00050746 13461-001,xls.xll
sample.xlsx
service.exe
service.exe
service.exe
service.exe
memory/2136-19-0x00007FF8E8930000-0x00007FF8E8B25000-memory.dmp
memory/2136-87-0x00007FF8E8930000-0x00007FF8E8B25000-memory.dmp
memory/2136-133-0x00007FF8BFF90000-0x00007FF8C0A51000-memory.dmp
memory/2136-9-0x00007FF8E8930000-0x00007FF8E8B25000-memory.dmp
memory/2136-11-0x00007FF8E8930000-0x00007FF8E8B25000-memory.dmp
memory/2136-13-0x00007FF8E8930000-0x00007FF8E8B25000-memory.dmp
memory/2136-12-0x00007FF8A65C0000-0x00007FF8A65D0000-memory.dmp
memory/2136-14-0x00007FF8E8930000-0x00007FF8E8B25000-memory.dmp
memory/2136-15-0x00007FF8E8930000-0x00007FF8E8B25000-memory.dmp
memory/2136-16-0x00007FF8E8930000-0x00007FF8E8B25000-memory.dmp
memory/2136-17-0x00007FF8E8930000-0x00007FF8E8B25000-memory.dmp
memory/2136-1-0x00007FF8A89B0000-0x00007FF8A89C0000-memory.dmp
memory/2136-20-0x00007FF8E8930000-0x00007FF8E8B25000-memory.dmp
memory/2136-18-0x00007FF8A65C0000-0x00007FF8A65D0000-memory.dmp
memory/2136-8-0x00007FF8E8930000-0x00007FF8E8B25000-memory.dmp
memory/2136-23-0x000001A51FCF0000-0x000001A51FE6C000-memory.dmp
memory/2136-6-0x00007FF8A89B0000-0x00007FF8A89C0000-memory.dmp
memory/2136-26-0x000001A5215A0000-0x000001A5215BC000-memory.dmp
memory/2136-28-0x000001A5396E0000-0x000001A53971C000-memory.dmp
memory/2136-31-0x000001A539860000-0x000001A539870000-memory.dmp
memory/2136-36-0x000001A539860000-0x000001A539870000-memory.dmp
memory/2136-35-0x000001A539860000-0x000001A539870000-memory.dmp
memory/2136-34-0x000001A539860000-0x000001A539870000-memory.dmp
memory/2136-33-0x000001A539860000-0x000001A539870000-memory.dmp
memory/2136-32-0x000001A539860000-0x000001A539870000-memory.dmp
memory/2136-30-0x00007FF8BFF90000-0x00007FF8C0A51000-memory.dmp
memory/2136-40-0x000001A539760000-0x000001A539864000-memory.dmp
memory/2136-41-0x000001A5213E0000-0x000001A5213F0000-memory.dmp
memory/2136-7-0x00007FF8E8930000-0x00007FF8E8B25000-memory.dmp
memory/2136-4-0x00007FF8A89B0000-0x00007FF8A89C0000-memory.dmp
memory/2136-3-0x00007FF8A89B0000-0x00007FF8A89C0000-memory.dmp
memory/2136-2-0x00007FF8E8930000-0x00007FF8E8B25000-memory.dmp
memory/2136-10-0x00007FF8E8930000-0x00007FF8E8B25000-memory.dmp
memory/2136-132-0x00007FF8E8930000-0x00007FF8E8B25000-memory.dmp
memory/2136-5-0x00007FF8E8930000-0x00007FF8E8B25000-memory.dmp
memory/2136-131-0x00007FF8A89B0000-0x00007FF8A89C0000-memory.dmp
memory/2136-130-0x00007FF8A89B0000-0x00007FF8A89C0000-memory.dmp
memory/2136-129-0x00007FF8A89B0000-0x00007FF8A89C0000-memory.dmp
memory/2136-128-0x00007FF8A89B0000-0x00007FF8A89C0000-memory.dmp
memory/2136-0-0x00007FF8A89B0000-0x00007FF8A89C0000-memory.dmp
memory/2136-86-0x00007FF8E8930000-0x00007FF8E8B25000-memory.dmp
memory/2136-97-0x000001A539860000-0x000001A539870000-memory.dmp
memory/2136-88-0x00007FF8BFF90000-0x00007FF8C0A51000-memory.dmp
memory/2136-89-0x000001A539860000-0x000001A539870000-memory.dmp
memory/2136-93-0x000001A539860000-0x000001A539870000-memory.dmp
memory/2136-95-0x000001A539860000-0x000001A539870000-memory.dmp
memory/2136-94-0x000001A539860000-0x000001A539870000-memory.dmp
memory/2136-96-0x000001A539860000-0x000001A539870000-memory.dmp
memory/4196-102-0x0000000000400000-0x0000000000438000-memory.dmp
memory/4196-111-0x0000000000400000-0x0000000000438000-memory.dmp
memory/4196-105-0x0000000000400000-0x0000000000438000-memory.dmp
memory/4196-106-0x0000000000400000-0x0000000000438000-memory.dmp
memory/4196-108-0x0000000000400000-0x0000000000438000-memory.dmp
memory/5060-101-0x0000000009C00000-0x0000000009C38000-memory.dmp
memory/5060-83-0x00000000072B0000-0x00000000072CA000-memory.dmp
memory/5060-78-0x0000000005FE0000-0x0000000006584000-memory.dmp
memory/5060-100-0x0000000007550000-0x00000000075F0000-memory.dmp
memory/5060-99-0x0000000005D90000-0x0000000005DA0000-memory.dmp
memory/5060-107-0x00000000743C0000-0x0000000074B70000-memory.dmp
memory/5060-98-0x00000000743C0000-0x0000000074B70000-memory.dmp
memory/5060-82-0x0000000005A90000-0x0000000005A9A000-memory.dmp
memory/5060-81-0x0000000005D90000-0x0000000005DA0000-memory.dmp
memory/5060-80-0x0000000005B70000-0x0000000005C0C000-memory.dmp
memory/5060-76-0x0000000000FA0000-0x00000000010A0000-memory.dmp
memory/5060-79-0x0000000005AD0000-0x0000000005B62000-memory.dmp
memory/5060-77-0x00000000743C0000-0x0000000074B70000-memory.dmp