oski | 5020e9aafe88de7c7eff6fdd858ebcf460975c5add2bf6ace88b98bdaa62d933

Analysis

max time kernel
13s
max time network
112s
platform
windows10_x64
resource
win10v20210410
submitted
08/06/2021, 12:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1-2.txt.exe
Size 210KB
Sample210608-9jtxmpkbq2
SHA256 5020e9aafe88de7c7eff6fdd858ebcf460975c5add2bf6ace88b98bdaa62d933
MD5 593a6ef29f337e124cefe26e55304dfd
SHA1 139394bbddc4b872b2b8229a0002dba6a3320255
SHA512 0b426fd726d1c78d62ab49a8700704d903e4919a29c39ba527cffb92981fc1f81e6eec479f276965897e53f807ca0fe83aca70f3993640ac61555f4787b704ec
MD5 SHA1 SHA512

Score

10^/10

oski discovery infostealer spyware stealer

Malware Config

Signatures

Oski
Oski is an infostealer targeting browser data, crypto wallets.
infostealer oski
Downloads MZ/PE file

Loads dropped DLL 3 IoCs

pid	Process
3984	1-2.txt.exe
3984	1-2.txt.exe
3984	1-2.txt.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 1 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	1-2.txt.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
4060	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4060	taskkill.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3984 wrote to memory of 932	3984	1-2.txt.exe	79
PID 3984 wrote to memory of 932	3984	1-2.txt.exe	79
PID 3984 wrote to memory of 932	3984	1-2.txt.exe	79
PID 932 wrote to memory of 4060	932	cmd.exe	81
PID 932 wrote to memory of 4060	932	cmd.exe	81
PID 932 wrote to memory of 4060	932	cmd.exe	81

C:\Users\Admin\AppData\Local\Temp\1-2.txt.exe
"C:\Users\Admin\AppData\Local\Temp\1-2.txt.exe"
1⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:3984
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c taskkill /pid 3984 & erase C:\Users\Admin\AppData\Local\Temp\1-2.txt.exe & RD /S /Q C:\\ProgramData\\876711297372841\\* & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:932
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /pid 3984
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4060

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads