Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/03/2024, 18:10

General

  • Target

    b556492c8d162c4180c0c6a5c07e6abb.exe

  • Size

    678KB

  • MD5

    b556492c8d162c4180c0c6a5c07e6abb

  • SHA1

    eb369158b45401422f550ca727c2b5a610bc7ab8

  • SHA256

    10410848d808e42758883ff2045ac5b10d16ad3d4155771483f0aba1f245a6e4

  • SHA512

    58ba5e137396a6c285033af96c01aae61983bed7cd9bb62047c554bcd63f8305f6725242851ff673d0861fe1f8a56ed8129189c652ef48799b51529dff289fec

  • SSDEEP

    12288:NXJNqcCx+8+/iMuzbe3hO2dVy3whNMgfTNBnefBgyC5+Wyco3zzpUdv5ho:N+e/UzbEhOqVqwzxQfWcw

Malware Config

Extracted

Family

oski

C2

zzz.divendesign.in

Signatures

  • Oski

    Oski is an infostealer targeting browser data, crypto wallets.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b556492c8d162c4180c0c6a5c07e6abb.exe
    "C:\Users\Admin\AppData\Local\Temp\b556492c8d162c4180c0c6a5c07e6abb.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4140
    • C:\Users\Admin\AppData\Local\Temp\b556492c8d162c4180c0c6a5c07e6abb.exe
      "{path}"
      2⤵
        PID:3128
      • C:\Users\Admin\AppData\Local\Temp\b556492c8d162c4180c0c6a5c07e6abb.exe
        "{path}"
        2⤵
          PID:4804
        • C:\Users\Admin\AppData\Local\Temp\b556492c8d162c4180c0c6a5c07e6abb.exe
          "{path}"
          2⤵
            PID:2440
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2440 -s 1284
              3⤵
              • Program crash
              PID:2232
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2440 -ip 2440
          1⤵
            PID:3032

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/2440-12-0x0000000000400000-0x0000000000438000-memory.dmp

            Filesize

            224KB

          • memory/2440-20-0x0000000000400000-0x0000000000438000-memory.dmp

            Filesize

            224KB

          • memory/2440-16-0x0000000000400000-0x0000000000438000-memory.dmp

            Filesize

            224KB

          • memory/2440-15-0x0000000000400000-0x0000000000438000-memory.dmp

            Filesize

            224KB

          • memory/2440-13-0x0000000000400000-0x0000000000438000-memory.dmp

            Filesize

            224KB

          • memory/4140-4-0x00000000052A0000-0x00000000052B0000-memory.dmp

            Filesize

            64KB

          • memory/4140-6-0x00000000064D0000-0x00000000064D8000-memory.dmp

            Filesize

            32KB

          • memory/4140-7-0x0000000008EF0000-0x0000000008F8C000-memory.dmp

            Filesize

            624KB

          • memory/4140-8-0x0000000074750000-0x0000000074F00000-memory.dmp

            Filesize

            7.7MB

          • memory/4140-9-0x00000000052A0000-0x00000000052B0000-memory.dmp

            Filesize

            64KB

          • memory/4140-10-0x00000000067C0000-0x0000000006842000-memory.dmp

            Filesize

            520KB

          • memory/4140-11-0x00000000066B0000-0x00000000066EA000-memory.dmp

            Filesize

            232KB

          • memory/4140-5-0x0000000004FF0000-0x0000000004FFA000-memory.dmp

            Filesize

            40KB

          • memory/4140-0-0x0000000000550000-0x0000000000600000-memory.dmp

            Filesize

            704KB

          • memory/4140-3-0x0000000005030000-0x00000000050C2000-memory.dmp

            Filesize

            584KB

          • memory/4140-17-0x0000000074750000-0x0000000074F00000-memory.dmp

            Filesize

            7.7MB

          • memory/4140-2-0x00000000055E0000-0x0000000005B84000-memory.dmp

            Filesize

            5.6MB

          • memory/4140-1-0x0000000074750000-0x0000000074F00000-memory.dmp

            Filesize

            7.7MB