oski | c0fa9b79d5ff08641d2490f2942b205120e157e790bfb7540aaed7a0e69a1d49

Analysis

Target

c0fa9b79d5ff08641d2490f2942b205120e157e790bfb7540aaed7a0e69a1d49.exe
Size

200KB
MD5

9c75d0a696028660f0f7333c2d3f5d8a
SHA1

3a3f86412b3d48bf9bf4f73fac3fc0d6c2a49293
SHA256

c0fa9b79d5ff08641d2490f2942b205120e157e790bfb7540aaed7a0e69a1d49
SHA512

58b1494fb5455e761ca99fdc80c6b648f23d1183355c0742ceb134bd0ac77a37385e736014319a1f801644ea741fab1ba9babb7b4323660f55870263c33bb000

Score

10^/10

Oski
Oski is an infostealer targeting browser data, crypto wallets.
infostealer oski
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1124 1208 WerFault.exe c0fa9b79d5ff08641d2490f2942b205120e157e790bfb7540aaed7a0e69a1d49.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

1124 WerFault.exe
1124 WerFault.exe
1124 WerFault.exe
1124 WerFault.exe
1124 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1124 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1124 WerFault.exe

pid	pid_target	process	target process
1124	1208	WerFault.exe	c0fa9b79d5ff08641d2490f2942b205120e157e790bfb7540aaed7a0e69a1d49.exe

pid	process
1124	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1124	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

c0fa9b79d5ff08641d2490f2942b205120e157e790bfb7540aaed7a0e69a1d49.exe

description	pid	process	target process
PID 1208 wrote to memory of 1124	1208	c0fa9b79d5ff08641d2490f2942b205120e157e790bfb7540aaed7a0e69a1d49.exe	WerFault.exe
PID 1208 wrote to memory of 1124	1208	c0fa9b79d5ff08641d2490f2942b205120e157e790bfb7540aaed7a0e69a1d49.exe	WerFault.exe
PID 1208 wrote to memory of 1124	1208	c0fa9b79d5ff08641d2490f2942b205120e157e790bfb7540aaed7a0e69a1d49.exe	WerFault.exe
PID 1208 wrote to memory of 1124	1208	c0fa9b79d5ff08641d2490f2942b205120e157e790bfb7540aaed7a0e69a1d49.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\c0fa9b79d5ff08641d2490f2942b205120e157e790bfb7540aaed7a0e69a1d49.exe
"C:\Users\Admin\AppData\Local\Temp\c0fa9b79d5ff08641d2490f2942b205120e157e790bfb7540aaed7a0e69a1d49.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1208

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

memory/1124-60-0x0000000000000000-mapping.dmp

Download
memory/1124-61-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/1208-59-0x0000000076281000-0x0000000076283000-memory.dmp

Filesize
8KB

Download