Overview

overview

10

Static

static

8

DSV INV 10...21.ppt

windows7_x64

10

DSV INV 10...21.ppt

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    DSV INV 103823 14072021.ppt

  • Size

    58KB

  • Sample

    210714-2qya4dzzqj

  • MD5

    4c5105952fcc267dc7b8bf5a2220fb51

  • SHA1

    9f43f9de80672d5d228d254394360ae362d9a673

  • SHA256

    5bd1784bd0379cb65a32f1c71989082c6b9168c150e18ba21b351b2320f667da

  • SHA512

    88f09a875c5e6164fec848a535b2601262e90f4c110ebf34acbdbc31bccc6684c1d2f98359347c325354197a252d02b644da4e20e7d68365a52cca736590a540

Score
10/10
oskiinfostealermacrospywarexlm

Malware Config

Extracted

Family

oski

C2

103.153.76.164/we/mark/

Targets

    • Target

      DSV INV 103823 14072021.ppt

    • Size

      58KB

    • MD5

      4c5105952fcc267dc7b8bf5a2220fb51

    • SHA1

      9f43f9de80672d5d228d254394360ae362d9a673

    • SHA256

      5bd1784bd0379cb65a32f1c71989082c6b9168c150e18ba21b351b2320f667da

    • SHA512

      88f09a875c5e6164fec848a535b2601262e90f4c110ebf34acbdbc31bccc6684c1d2f98359347c325354197a252d02b644da4e20e7d68365a52cca736590a540

    Score
    10/10
    oskiinfostealerspyware

    • Oski

      Oski is an infostealer targeting browser data, crypto wallets.

      infostealeroski

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

2
T1112

Install Root Certificate

1
T1130

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks