Analysis
- max time kernel
143s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
01/02/2024, 00:16
General
- Target Items.exe
- Size 444KB
- Sample240201-aktfxafca9
- SHA256 6f9991b2dbb68f2cb2f1846a641e54857cc5a1b3f683e7883ac85e3a040987d1
Score
10/10
Malware Config
Extracted
Family
-
oski
C2
-
edkark.xyz
Signatures
- Oski
Oski is an infostealer targeting browser data, crypto wallets.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 1 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Items.exe"C:\Users\Admin\AppData\Local\Temp\Items.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Items.exe"C:\Users\Admin\AppData\Local\Temp\Items.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1716 -s 12923⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1716 -ip 17161⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1716-3-0x0000000000400000-0x0000000000438000-memory.dmp
memory/1716-4-0x0000000000400000-0x0000000000438000-memory.dmp
memory/1716-5-0x0000000000400000-0x0000000000438000-memory.dmp
memory/1716-6-0x0000000000400000-0x0000000000438000-memory.dmp
memory/1716-9-0x0000000000400000-0x0000000000438000-memory.dmp
memory/1724-1-0x00000000000A0000-0x00000000001A0000-memory.dmp
memory/1724-2-0x0000000000A70000-0x0000000000A72000-memory.dmp