oski | e105e4778abd8cc1d35e0d6b1f0ad17994570ead16764f012270be94de740aaf

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21-08-2024 02:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e105e4778abd8cc1d35e0d6b1f0ad17994570ead16764f012270be94de740aaf.exe
Size

1.2MB
MD5

c361fe1dc05f5d90c1ce35e0d49b6338
SHA1

267aac6007a22ca4c17eabbfe4c71f3194b181d6
SHA256

e105e4778abd8cc1d35e0d6b1f0ad17994570ead16764f012270be94de740aaf
SHA512

a1f7a311e03af563d43a2f2d3820d6ac690c99f0edd0ae935df2018205b6e970d14017dd043fd22bc24e956ea483a21116fa1e5b5be4152d3d266a51b9c9d55e
SSDEEP

24576:qQ+JBjAObi4M2rIDTU4fmj6J/d5nTWzim9W7akhWFhepaLSbK:qQGBfbiyrIDovj6l+59W7aApat

Score

10^/10

oski defense_evasion discovery infostealer persistence

Malware Config

Extracted

Family

oski

45.141.84.184

Signatures

Oski
Oski is an infostealer targeting browser data, crypto wallets.
infostealer oski

Manipulates Digital Signatures 1 TTPs 3 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.60.3.1!7\Name = "szOID_ROOT_PROGRAM_AUTO_UPDATE_CA_REVOCATION"	certutil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.60.3.2!7\Name = "szOID_ROOT_PROGRAM_AUTO_UPDATE_END_REVOCATION"	certutil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.60.3.3!7\Name = "szOID_ROOT_PROGRAM_NO_OCSP_FAILOVER_TO_CRL"	certutil.exe

Executes dropped EXE 3 IoCs

pid	Process
4680	svchost.com
4820	svchost.com
3780	svchost.com

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	e105e4778abd8cc1d35e0d6b1f0ad17994570ead16764f012270be94de740aaf.exe

Deobfuscate/Decode Files or Information 1 TTPs 2 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
3924	cmd.exe
2332	certutil.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4820 set thread context of 3780	4820	svchost.com	100

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e105e4778abd8cc1d35e0d6b1f0ad17994570ead16764f012270be94de740aaf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	certutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.com

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1936	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1936	PING.EXE

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
4680	svchost.com
4680	svchost.com
4680	svchost.com
4820	svchost.com
4820	svchost.com
4820	svchost.com

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
4680	svchost.com
4680	svchost.com
4680	svchost.com
4820	svchost.com
4820	svchost.com
4820	svchost.com

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 3924	1628	e105e4778abd8cc1d35e0d6b1f0ad17994570ead16764f012270be94de740aaf.exe	86
PID 1628 wrote to memory of 3924	1628	e105e4778abd8cc1d35e0d6b1f0ad17994570ead16764f012270be94de740aaf.exe	86
PID 1628 wrote to memory of 3924	1628	e105e4778abd8cc1d35e0d6b1f0ad17994570ead16764f012270be94de740aaf.exe	86
PID 3924 wrote to memory of 2332	3924	cmd.exe	88
PID 3924 wrote to memory of 2332	3924	cmd.exe	88
PID 3924 wrote to memory of 2332	3924	cmd.exe	88
PID 3924 wrote to memory of 4680	3924	cmd.exe	91
PID 3924 wrote to memory of 4680	3924	cmd.exe	91
PID 3924 wrote to memory of 4680	3924	cmd.exe	91
PID 4680 wrote to memory of 4820	4680	svchost.com	93
PID 4680 wrote to memory of 4820	4680	svchost.com	93
PID 4680 wrote to memory of 4820	4680	svchost.com	93
PID 3924 wrote to memory of 1936	3924	cmd.exe	94
PID 3924 wrote to memory of 1936	3924	cmd.exe	94
PID 3924 wrote to memory of 1936	3924	cmd.exe	94
PID 4820 wrote to memory of 3780	4820	svchost.com	100
PID 4820 wrote to memory of 3780	4820	svchost.com	100
PID 4820 wrote to memory of 3780	4820	svchost.com	100
PID 4820 wrote to memory of 3780	4820	svchost.com	100
PID 4820 wrote to memory of 3780	4820	svchost.com	100
PID 4820 wrote to memory of 3780	4820	svchost.com	100
PID 4820 wrote to memory of 3780	4820	svchost.com	100
PID 4820 wrote to memory of 3780	4820	svchost.com	100
PID 4820 wrote to memory of 3780	4820	svchost.com	100
PID 4820 wrote to memory of 3780	4820	svchost.com	100
PID 4820 wrote to memory of 3780	4820	svchost.com	100
PID 4820 wrote to memory of 3780	4820	svchost.com	100
PID 4820 wrote to memory of 3780	4820	svchost.com	100
PID 4820 wrote to memory of 3780	4820	svchost.com	100
PID 4820 wrote to memory of 3780	4820	svchost.com	100
PID 4820 wrote to memory of 3780	4820	svchost.com	100
PID 4820 wrote to memory of 3780	4820	svchost.com	100
PID 4820 wrote to memory of 3780	4820	svchost.com	100
PID 4820 wrote to memory of 3780	4820	svchost.com	100
PID 4820 wrote to memory of 3780	4820	svchost.com	100
PID 4820 wrote to memory of 3780	4820	svchost.com	100
PID 4820 wrote to memory of 3780	4820	svchost.com	100
PID 4820 wrote to memory of 3780	4820	svchost.com	100
PID 4820 wrote to memory of 3780	4820	svchost.com	100
PID 4820 wrote to memory of 3780	4820	svchost.com	100
PID 4820 wrote to memory of 3780	4820	svchost.com	100
PID 4820 wrote to memory of 3780	4820	svchost.com	100
PID 4820 wrote to memory of 3780	4820	svchost.com	100
PID 4820 wrote to memory of 3780	4820	svchost.com	100
PID 4820 wrote to memory of 3780	4820	svchost.com	100
PID 4820 wrote to memory of 3780	4820	svchost.com	100
PID 4820 wrote to memory of 3780	4820	svchost.com	100
PID 4820 wrote to memory of 3780	4820	svchost.com	100
PID 4820 wrote to memory of 3780	4820	svchost.com	100
PID 4820 wrote to memory of 3780	4820	svchost.com	100
PID 4820 wrote to memory of 3780	4820	svchost.com	100
PID 4820 wrote to memory of 3780	4820	svchost.com	100
PID 4820 wrote to memory of 3780	4820	svchost.com	100
PID 4820 wrote to memory of 3780	4820	svchost.com	100
PID 4820 wrote to memory of 3780	4820	svchost.com	100
PID 4820 wrote to memory of 3780	4820	svchost.com	100
PID 4820 wrote to memory of 3780	4820	svchost.com	100
PID 4820 wrote to memory of 3780	4820	svchost.com	100
PID 4820 wrote to memory of 3780	4820	svchost.com	100
PID 4820 wrote to memory of 3780	4820	svchost.com	100
PID 4820 wrote to memory of 3780	4820	svchost.com	100
PID 4820 wrote to memory of 3780	4820	svchost.com	100
PID 4820 wrote to memory of 3780	4820	svchost.com	100
PID 4820 wrote to memory of 3780	4820	svchost.com	100

C:\Users\Admin\AppData\Local\Temp\e105e4778abd8cc1d35e0d6b1f0ad17994570ead16764f012270be94de740aaf.exe
"C:\Users\Admin\AppData\Local\Temp\e105e4778abd8cc1d35e0d6b1f0ad17994570ead16764f012270be94de740aaf.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Windows\SysWOW64\cmd.exe
  cmd /c <nul set /p ="M" > svchost.com & type QEZEl.com >> svchost.com & del QEZEl.com & certutil -decode LucqD.com C & svchost.com C & ping 127.0.0.1 -n 3
  2⤵
  - Deobfuscate/Decode Files or Information
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3924
- - C:\Windows\SysWOW64\certutil.exe
    certutil -decode LucqD.com C
    3⤵
    - Manipulates Digital Signatures
    - Deobfuscate/Decode Files or Information
    - System Location Discovery: System Language Discovery
    PID:2332
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\svchost.com
    svchost.com C
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4680
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\svchost.com
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\svchost.com C
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:4820
    - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\svchost.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\svchost.com
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3780
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Remote System Discovery

T1018

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\C

Filesize
451KB

MD5
bcf0e243c2e927150dba715b423bad97

SHA1
3f9c1197703f46251d9f46d719e6dfb173b0cc9f

SHA256
f4a6970fd8ae434109374ae82915ab1047b266ee38420b269b4c7e6ef600fe10

SHA512
ef4b43b2fb8c6631b6f39247d5157f7f1c1bb3630502d9d74ea6d711fbd64126f9fe656238f3405f265a90829ca211f061f1d24fe14fb1e4adad498a160b4b69

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\LucqD.com

Filesize
620KB

MD5
773a6c4f5b9eb23e52553f3d6af76e27

SHA1
7bd5a11cb1d9d48ed62fdc892c1b161221fc4fdb

SHA256
400c564fc93ba19029944a3ba5ecbac8ee2a5d3fe95a9b4320286143fdf39af7

SHA512
8c65bb539e8caa8e9dde2bfe641ce08e4fb6f14d7ce9bccaa92429a5cf8eb625bc474cecf6092fc282a4dc3aeb55c07ebb27f084e0ca39e4ba2b4e04077d5563

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\OYeSG.com

Filesize
200KB

MD5
d825cdf4d339b91407067bf4d85f973d

SHA1
c21453bdd299451727393a1aa48daf0697070973

SHA256
2813f8d17e3d6cb808e351532f6d38beeb4e5d708ec28c37953bcf2229b840f4

SHA512
82775b46146439a49a332c96cdcf3efe7e34366e13dc7423ec6fd793b6089ec5c89edcb5bcb1fd8265e8c9d099059a9f2d1a4f0e40862957db2600967aaf7487

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\QEZEl.com

Filesize
921KB

MD5
df6fbc5de331f39be67e2b343ff02083

SHA1
2791147f5aba7d5242d531f0444695b9fecb3c42

SHA256
ccefe3c453a32c04dd03e835879aceae0b96e7d25359dc05a8cfa7a880c21936

SHA512
35e1b55975104e9ddf24fc2842848f63c954f6e69bf8a4df370caaad43ff01f259fbd4e96e45bcbd2287192551afa3df5f9ad8726a3331d80a9c53fa558bf8a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\svchost.com

Filesize
921KB

MD5
78ba0653a340bac5ff152b21a83626cc

SHA1
b12da9cb5d024555405040e65ad89d16ae749502

SHA256
05d8cf394190f3a707abfb25fb44d7da9d5f533d7d2063b23c00cc11253c8be7

SHA512
efb75e4c1e0057ffb47613fd5aae8ce3912b1558a4b74dbf5284c942eac78ecd9aca98f7c1e0e96ec38e8177e58ffdf54f2eb0385e73eef39e8a2ce611237317

Download Submit
memory/3780-18-0x0000000000F20000-0x0000000000F58000-memory.dmp

Filesize
224KB

Download
memory/3780-21-0x0000000000F20000-0x0000000000F58000-memory.dmp

Filesize
224KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads