Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-10-2024 19:37

General

  • Target

    New Order_78947533.exe

  • Size

    881KB

  • MD5

    7f05dc92a62ddd277baaeb55ebcfa407

  • SHA1

    23c8c1a1a8d16180980f4b38a47832738f947141

  • SHA256

    06c8a1e6544aede327bad32a5732d5bcfff143da73da01d34938efbe917e3289

  • SHA512

    3cf46fbbf2e197b15fff65b3250f05add05537e534371ee50c8f0fe6524d4d32717d25ec79c60b8ebd1ed34b99d36522202834ac927fe3e1be5abb7c298768ef

  • SSDEEP

    12288:oplvxon3qGaNHEyC9/oR9gy5ZHK7z1S6TNCTm9H1tVwH9gd0pod3zBts7Vl+YJtm:dPp9AR95SbTIg1Bd4od0+YzR0xz6KV

Malware Config

Extracted

Family

oski

C2

kckark.xyz

Signatures

  • Oski

    Oski is an infostealer targeting browser data, crypto wallets.

  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\New Order_78947533.exe
    "C:\Users\Admin\AppData\Local\Temp\New Order_78947533.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4684
    • C:\Users\Admin\AppData\Local\Temp\New Order_78947533.exe
      "C:\Users\Admin\AppData\Local\Temp\New Order_78947533.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1300

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1300-13-0x0000000000400000-0x0000000000438000-memory.dmp

    Filesize

    224KB

  • memory/1300-19-0x0000000000400000-0x0000000000438000-memory.dmp

    Filesize

    224KB

  • memory/1300-17-0x0000000000400000-0x0000000000438000-memory.dmp

    Filesize

    224KB

  • memory/1300-16-0x0000000000400000-0x0000000000438000-memory.dmp

    Filesize

    224KB

  • memory/1300-14-0x0000000000400000-0x0000000000438000-memory.dmp

    Filesize

    224KB

  • memory/4684-8-0x0000000006080000-0x0000000006096000-memory.dmp

    Filesize

    88KB

  • memory/4684-12-0x000000000A300000-0x000000000A338000-memory.dmp

    Filesize

    224KB

  • memory/4684-7-0x0000000074D70000-0x0000000075520000-memory.dmp

    Filesize

    7.7MB

  • memory/4684-0-0x0000000074D7E000-0x0000000074D7F000-memory.dmp

    Filesize

    4KB

  • memory/4684-9-0x0000000074D7E000-0x0000000074D7F000-memory.dmp

    Filesize

    4KB

  • memory/4684-10-0x0000000074D70000-0x0000000075520000-memory.dmp

    Filesize

    7.7MB

  • memory/4684-11-0x0000000007B90000-0x0000000007C2E000-memory.dmp

    Filesize

    632KB

  • memory/4684-6-0x0000000004F40000-0x0000000004F96000-memory.dmp

    Filesize

    344KB

  • memory/4684-5-0x0000000004C20000-0x0000000004C2A000-memory.dmp

    Filesize

    40KB

  • memory/4684-4-0x0000000004D00000-0x0000000004D92000-memory.dmp

    Filesize

    584KB

  • memory/4684-3-0x0000000005360000-0x0000000005904000-memory.dmp

    Filesize

    5.6MB

  • memory/4684-2-0x0000000004C60000-0x0000000004CFC000-memory.dmp

    Filesize

    624KB

  • memory/4684-18-0x0000000074D70000-0x0000000075520000-memory.dmp

    Filesize

    7.7MB

  • memory/4684-1-0x0000000000190000-0x0000000000272000-memory.dmp

    Filesize

    904KB