oski | 3bd85c9e47dd89f20f5ae78807a8e98288195c70ee6250e0e86583c672685119

Analysis

Target

884c97781aefe7f3f8aef45d44fa9340.exe
Size

200KB
MD5

884c97781aefe7f3f8aef45d44fa9340
SHA1

4d340d7a615e07b8d2c9d27e9d94862ea40bb577
SHA256

3bd85c9e47dd89f20f5ae78807a8e98288195c70ee6250e0e86583c672685119
SHA512

4f30c56596877c7b7fbd217cc03094d8e3bd5929d5aa52816d90414d4734523c7f61310cf15105dd2130c34f3dcf5799810dda4039f850af6d486910cf83d466

Score

10^/10

Oski
Oski is an infostealer targeting browser data, crypto wallets.
infostealer oski
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1712 1220 WerFault.exe 884c97781aefe7f3f8aef45d44fa9340.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

1712 WerFault.exe
1712 WerFault.exe
1712 WerFault.exe
1712 WerFault.exe
1712 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1712 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1712 WerFault.exe

pid	pid_target	process	target process
1712	1220	WerFault.exe	884c97781aefe7f3f8aef45d44fa9340.exe

pid	process
1712	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1712	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

884c97781aefe7f3f8aef45d44fa9340.exe

description	pid	process	target process
PID 1220 wrote to memory of 1712	1220	884c97781aefe7f3f8aef45d44fa9340.exe	WerFault.exe
PID 1220 wrote to memory of 1712	1220	884c97781aefe7f3f8aef45d44fa9340.exe	WerFault.exe
PID 1220 wrote to memory of 1712	1220	884c97781aefe7f3f8aef45d44fa9340.exe	WerFault.exe
PID 1220 wrote to memory of 1712	1220	884c97781aefe7f3f8aef45d44fa9340.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\884c97781aefe7f3f8aef45d44fa9340.exe
"C:\Users\Admin\AppData\Local\Temp\884c97781aefe7f3f8aef45d44fa9340.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1220
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1220 -s 632
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:1712

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

memory/1220-59-0x00000000769B1000-0x00000000769B3000-memory.dmp

Filesize
8KB

Download
memory/1712-60-0x0000000000000000-mapping.dmp

Download
memory/1712-61-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download