Analysis
- max time kernel
147s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
04/03/2024, 22:03
General
- Target b33604969a34f8a6d4678e154e049fd3.ps1
- Size 656KB
- Sample240304-1ylakaff69
- SHA256 db7c19cc03486f9948a0d9bb304baea5017f937802c88bb8ad85c7493fb5aeeb
Malware Config
Extracted
-
oski
-
/103.114.107.28/l27/
Signatures
- Oski
Oski is an infostealer targeting browser data, crypto wallets.
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\b33604969a34f8a6d4678e154e049fd3.ps11⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe#cmd2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3420 -s 11083⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 3420 -ip 34201⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_kdgzf4kf.1re.ps1
memory/2776-33-0x0000022BB7980000-0x0000022BB79A0000-memory.dmp
memory/2776-37-0x0000022BB7980000-0x0000022BB79A0000-memory.dmp
memory/2776-11-0x0000022BB7940000-0x0000022BB7950000-memory.dmp
memory/2776-12-0x0000022BB7940000-0x0000022BB7950000-memory.dmp
memory/2776-13-0x0000022BB7980000-0x0000022BB79A6000-memory.dmp
memory/2776-14-0x0000022BB7980000-0x0000022BB79A0000-memory.dmp
memory/2776-15-0x0000022BB7980000-0x0000022BB79A0000-memory.dmp
memory/2776-17-0x0000022BB7980000-0x0000022BB79A0000-memory.dmp
memory/2776-19-0x0000022BB7980000-0x0000022BB79A0000-memory.dmp
memory/2776-21-0x0000022BB7980000-0x0000022BB79A0000-memory.dmp
memory/2776-23-0x0000022BB7980000-0x0000022BB79A0000-memory.dmp
memory/2776-25-0x0000022BB7980000-0x0000022BB79A0000-memory.dmp
memory/2776-27-0x0000022BB7980000-0x0000022BB79A0000-memory.dmp
memory/2776-29-0x0000022BB7980000-0x0000022BB79A0000-memory.dmp
memory/2776-31-0x0000022BB7980000-0x0000022BB79A0000-memory.dmp
memory/2776-6-0x0000022BB79B0000-0x0000022BB79D2000-memory.dmp
memory/2776-10-0x00007FFA6FFF0000-0x00007FFA70AB1000-memory.dmp
memory/2776-39-0x0000022BB7980000-0x0000022BB79A0000-memory.dmp
memory/2776-35-0x0000022BB7980000-0x0000022BB79A0000-memory.dmp
memory/2776-41-0x0000022BB7980000-0x0000022BB79A0000-memory.dmp
memory/2776-43-0x0000022BB7980000-0x0000022BB79A0000-memory.dmp
memory/2776-45-0x0000022BB7980000-0x0000022BB79A0000-memory.dmp
memory/2776-47-0x0000022BB7980000-0x0000022BB79A0000-memory.dmp
memory/2776-49-0x0000022BB7980000-0x0000022BB79A0000-memory.dmp
memory/2776-51-0x0000022BB7980000-0x0000022BB79A0000-memory.dmp
memory/2776-53-0x0000022BB7980000-0x0000022BB79A0000-memory.dmp
memory/2776-54-0x0000022BB79A0000-0x0000022BB79A1000-memory.dmp
memory/2776-59-0x00007FFA6FFF0000-0x00007FFA70AB1000-memory.dmp
memory/3420-55-0x0000000000400000-0x0000000000438000-memory.dmp
memory/3420-58-0x0000000000400000-0x0000000000438000-memory.dmp
memory/3420-60-0x0000000000400000-0x0000000000438000-memory.dmp
memory/3420-61-0x0000000000400000-0x0000000000438000-memory.dmp
memory/3420-64-0x0000000000400000-0x0000000000438000-memory.dmp