oski | d94c8028fa7fd7062dc2cd8c78b458d68bc7c8e8e260afc827bef217aeeac693

Analysis

max time kernel
142s
max time network
134s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
07-04-2024 04:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e4086615e3011d916a50689cef433c77_JaffaCakes118.exe
Size

5.4MB
MD5

e4086615e3011d916a50689cef433c77
SHA1

24c38d07046c2781f01d98ae3d7b1d9a80ea69e0
SHA256

d94c8028fa7fd7062dc2cd8c78b458d68bc7c8e8e260afc827bef217aeeac693
SHA512

06ed1a259f5d6f668508399e61a4465eabd642f966ea0903746ac6b4981f5df7bdaef2de231d1b50f5d271b357435aed21b81b66ed2fca78e219ea72d8db7966
SSDEEP

98304:3EAKCzqdfS72BW2WLASB3MgsESIXaM3dm8j6o8DQDvALRmn6BKVq:0LNS7tASVMgdR3sWx5LALonQK4

Score

10^/10

oski stormkitty infostealer spyware stealer

Malware Config

Extracted

Family

oski

web24host.com/a/a/www/

Signatures

Oski
Oski is an infostealer targeting browser data, crypto wallets.
infostealer oski
StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 4 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\Microsoft Update.exe	family_stormkitty
behavioral1/memory/320-21-0x000000013F4D0000-0x000000013F520000-memory.dmp	family_stormkitty
behavioral1/memory/320-29-0x0000000000850000-0x00000000008C4000-memory.dmp	family_stormkitty
behavioral1/memory/320-235-0x000000001BD30000-0x000000001BDB0000-memory.dmp	family_stormkitty

Executes dropped EXE 4 IoCs

Processes:

Microsoft Update.exeCliper.exeMACGen.v1.7.exe

pid process

320 Microsoft Update.exe
2228 Cliper.exe
2652 MACGen.v1.7.exe
1208

pid	process
320	Microsoft Update.exe
2228	Cliper.exe
2652	MACGen.v1.7.exe
1208

Loads dropped DLL 12 IoCs

Processes:

e4086615e3011d916a50689cef433c77_JaffaCakes118.exeCliper.exeMACGen.v1.7.exeWerFault.exe

pid	process
1512	e4086615e3011d916a50689cef433c77_JaffaCakes118.exe
1512	e4086615e3011d916a50689cef433c77_JaffaCakes118.exe
1512	e4086615e3011d916a50689cef433c77_JaffaCakes118.exe
2228	Cliper.exe
2228	Cliper.exe
2228	Cliper.exe
1512	e4086615e3011d916a50689cef433c77_JaffaCakes118.exe
2652	MACGen.v1.7.exe
2652	MACGen.v1.7.exe
2876	WerFault.exe
2876	WerFault.exe
2876	WerFault.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service
T1102

Processes:

flow ioc

9 raw.githubusercontent.com
12 raw.githubusercontent.com
13 raw.githubusercontent.com
8 raw.githubusercontent.com
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

6 ip-api.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2876 2228 WerFault.exe Cliper.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

Microsoft Update.exe

pid process

320 Microsoft Update.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Microsoft Update.exe

description pid process

Token: SeDebugPrivilege 320 Microsoft Update.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

MACGen.v1.7.exe

pid process

2652 MACGen.v1.7.exe

flow	ioc
9	raw.githubusercontent.com
12	raw.githubusercontent.com
13	raw.githubusercontent.com
8	raw.githubusercontent.com

flow	ioc
6	ip-api.com

pid	pid_target	process	target process
2876	2228	WerFault.exe	Cliper.exe

pid	process
320	Microsoft Update.exe

description	pid	process
Token: SeDebugPrivilege	320	Microsoft Update.exe

pid	process
2652	MACGen.v1.7.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

e4086615e3011d916a50689cef433c77_JaffaCakes118.exeCliper.exe

description	pid	process	target process
PID 1512 wrote to memory of 320	1512	e4086615e3011d916a50689cef433c77_JaffaCakes118.exe	Microsoft Update.exe
PID 1512 wrote to memory of 320	1512	e4086615e3011d916a50689cef433c77_JaffaCakes118.exe	Microsoft Update.exe
PID 1512 wrote to memory of 320	1512	e4086615e3011d916a50689cef433c77_JaffaCakes118.exe	Microsoft Update.exe
PID 1512 wrote to memory of 320	1512	e4086615e3011d916a50689cef433c77_JaffaCakes118.exe	Microsoft Update.exe
PID 1512 wrote to memory of 2228	1512	e4086615e3011d916a50689cef433c77_JaffaCakes118.exe	Cliper.exe
PID 1512 wrote to memory of 2228	1512	e4086615e3011d916a50689cef433c77_JaffaCakes118.exe	Cliper.exe
PID 1512 wrote to memory of 2228	1512	e4086615e3011d916a50689cef433c77_JaffaCakes118.exe	Cliper.exe
PID 1512 wrote to memory of 2228	1512	e4086615e3011d916a50689cef433c77_JaffaCakes118.exe	Cliper.exe
PID 1512 wrote to memory of 2228	1512	e4086615e3011d916a50689cef433c77_JaffaCakes118.exe	Cliper.exe
PID 1512 wrote to memory of 2228	1512	e4086615e3011d916a50689cef433c77_JaffaCakes118.exe	Cliper.exe
PID 1512 wrote to memory of 2228	1512	e4086615e3011d916a50689cef433c77_JaffaCakes118.exe	Cliper.exe
PID 1512 wrote to memory of 2652	1512	e4086615e3011d916a50689cef433c77_JaffaCakes118.exe	MACGen.v1.7.exe
PID 1512 wrote to memory of 2652	1512	e4086615e3011d916a50689cef433c77_JaffaCakes118.exe	MACGen.v1.7.exe
PID 1512 wrote to memory of 2652	1512	e4086615e3011d916a50689cef433c77_JaffaCakes118.exe	MACGen.v1.7.exe
PID 1512 wrote to memory of 2652	1512	e4086615e3011d916a50689cef433c77_JaffaCakes118.exe	MACGen.v1.7.exe
PID 1512 wrote to memory of 2652	1512	e4086615e3011d916a50689cef433c77_JaffaCakes118.exe	MACGen.v1.7.exe
PID 1512 wrote to memory of 2652	1512	e4086615e3011d916a50689cef433c77_JaffaCakes118.exe	MACGen.v1.7.exe
PID 1512 wrote to memory of 2652	1512	e4086615e3011d916a50689cef433c77_JaffaCakes118.exe	MACGen.v1.7.exe
PID 2228 wrote to memory of 2876	2228	Cliper.exe	WerFault.exe
PID 2228 wrote to memory of 2876	2228	Cliper.exe	WerFault.exe
PID 2228 wrote to memory of 2876	2228	Cliper.exe	WerFault.exe
PID 2228 wrote to memory of 2876	2228	Cliper.exe	WerFault.exe
PID 2228 wrote to memory of 2876	2228	Cliper.exe	WerFault.exe
PID 2228 wrote to memory of 2876	2228	Cliper.exe	WerFault.exe
PID 2228 wrote to memory of 2876	2228	Cliper.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\e4086615e3011d916a50689cef433c77_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e4086615e3011d916a50689cef433c77_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1512

C:\Users\Admin\AppData\Local\Temp\Microsoft Update.exe
"C:\Users\Admin\AppData\Local\Temp\Microsoft Update.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:320

C:\Users\Admin\AppData\Local\Temp\Cliper.exe
"C:\Users\Admin\AppData\Local\Temp\Cliper.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 880
3⤵
- Loads dropped DLL
- Program crash
PID:2876

C:\Users\Admin\AppData\Local\Temp\MACGen.v1.7.exe
"C:\Users\Admin\AppData\Local\Temp\MACGen.v1.7.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2652

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4937.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
\Users\Admin\AppData\Local\Temp\Cliper.exe
Filesize
200KB

MD5
94835b6d4af91fc977e840d64adaa485

SHA1
77635f373780022f21f74ade8ee80d0e652248ed

SHA256
9e2455642e046af82e21bdc6bc8659a5acc10796e383dcd7064227b0e8c6675b

SHA512
c1ff6e810d1f3476e635a206ef7b9e762230e29a0608cb961df6931d415315e1661277f2cebb2bdd15ef8291c5adae7311f97f0690aefea8fc4a3af1665d779a

Download Submit
\Users\Admin\AppData\Local\Temp\MACGen.v1.7.exe
Filesize
16.0MB

MD5
b9811425b010c92811573d4a1b94e90f

SHA1
a10a1b1b7d762fcc28b1ca16a09684305b0e8666

SHA256
8fb5143ef3cb8d3e8a83a42c90a74d68d7b9c4d56cfd2caa93f8bd575e7c04a7

SHA512
8c0d4cdad37f82c6fdad3aaee35fa4048e6f3a1f94d81fd8f40800173e3dc893c3f93b29de4d55923b5ff6d1d31c19b10ac58b017c5f34501f44f4598494fb08

Download Submit
\Users\Admin\AppData\Local\Temp\Microsoft Update.exe
Filesize
310KB

MD5
56b988f42827cff418d61f5738beb321

SHA1
d1440332895941edfa037d425eff00c109cfc15a

SHA256
43f322f83191d6990afee7dc4b5528e217e162b434afe06478f191d76b64d939

SHA512
2792bd3e0a1750fce7f33a06f78bb23df20ab6c841b5228d0cd3709afe578fc0af0596e9e9d7ec958a3a3b103df014b7db8fd7fe323e993e32971b3460af1506

Download Submit
memory/320-31-0x000007FEF5B70000-0x000007FEF655C000-memory.dmp

Filesize
9.9MB

Download
memory/320-29-0x0000000000850000-0x00000000008C4000-memory.dmp

Filesize
464KB

Download
memory/320-36-0x0000000000540000-0x0000000000546000-memory.dmp

Filesize
24KB

Download
memory/320-38-0x000000001BD30000-0x000000001BDB0000-memory.dmp

Filesize
512KB

Download
memory/320-21-0x000000013F4D0000-0x000000013F520000-memory.dmp

Filesize
320KB

Download
memory/320-234-0x000007FEF5B70000-0x000007FEF655C000-memory.dmp

Filesize
9.9MB

Download
memory/320-235-0x000000001BD30000-0x000000001BDB0000-memory.dmp

Filesize
512KB

Download
memory/2652-50-0x0000000000400000-0x0000000001415000-memory.dmp

Filesize
16.1MB

Download