oski | 5ffe71b977866248e55612e20cea0bf3ad51a50896443d791081f58b49cdc5df

General

Target
MT100098764.exe
Size 517KB
Sample210901-7bttv3cef6
SHA256 5ffe71b977866248e55612e20cea0bf3ad51a50896443d791081f58b49cdc5df
MD5 2269f021d855a0d6a65e7167962a23b0
SHA1 658e9df44920828b6bf73aad814f885efbb63cef
SHA512 e7c72459a963cf7d01543e2b0df4013121dde40be1a492bfdb9c96a5c7a4832f35bf1df87afa0e4acbd2190b8ea99609c426e7a813a56121daabea75acf26217
MD5 SHA1 SHA512

Score

10^/10

oski infostealer spyware suricata

Malware Config

Extracted

Family

oski

C2

http://bctpump.us

Signatures

Oski
Oski is an infostealer targeting browser data, crypto wallets.
infostealer oski
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
suricata
Downloads MZ/PE file

Loads dropped DLL 5 IoCs

pid	Process
768	RegSvcs.exe
768	RegSvcs.exe
768	RegSvcs.exe
768	RegSvcs.exe
768	RegSvcs.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1656 set thread context of 768	1656	MT100098764.exe	29

Checks processor information in registry 2 TTPs 1 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RegSvcs.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
1512	taskkill.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1656	MT100098764.exe
1656	MT100098764.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1656	MT100098764.exe
Token: SeDebugPrivilege	1512	taskkill.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 768	1656	MT100098764.exe	29
PID 1656 wrote to memory of 768	1656	MT100098764.exe	29
PID 1656 wrote to memory of 768	1656	MT100098764.exe	29
PID 1656 wrote to memory of 768	1656	MT100098764.exe	29
PID 1656 wrote to memory of 768	1656	MT100098764.exe	29
PID 1656 wrote to memory of 768	1656	MT100098764.exe	29
PID 1656 wrote to memory of 768	1656	MT100098764.exe	29
PID 1656 wrote to memory of 768	1656	MT100098764.exe	29
PID 1656 wrote to memory of 768	1656	MT100098764.exe	29
PID 1656 wrote to memory of 768	1656	MT100098764.exe	29
PID 1656 wrote to memory of 768	1656	MT100098764.exe	29
PID 1656 wrote to memory of 768	1656	MT100098764.exe	29
PID 1656 wrote to memory of 768	1656	MT100098764.exe	29
PID 768 wrote to memory of 2028	768	RegSvcs.exe	32
PID 768 wrote to memory of 2028	768	RegSvcs.exe	32
PID 768 wrote to memory of 2028	768	RegSvcs.exe	32
PID 768 wrote to memory of 2028	768	RegSvcs.exe	32
PID 2028 wrote to memory of 1512	2028	cmd.exe	34
PID 2028 wrote to memory of 1512	2028	cmd.exe	34
PID 2028 wrote to memory of 1512	2028	cmd.exe	34
PID 2028 wrote to memory of 1512	2028	cmd.exe	34

C:\Users\Admin\AppData\Local\Temp\MT100098764.exe
"C:\Users\Admin\AppData\Local\Temp\MT100098764.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious use of WriteProcessMemory
  PID:768
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c taskkill /pid 768 & erase C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe & RD /S /Q C:\\ProgramData\\551668842243414\\* & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2028
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /pid 768
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1512

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/768-69-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/768-66-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/768-68-0x0000000075AA1000-0x0000000075AA3000-memory.dmp

Download

memory/1656-60-0x00000000008F0000-0x00000000008F1000-memory.dmp

Download

memory/1656-65-0x0000000001F40000-0x0000000001F7C000-memory.dmp

Download

memory/1656-64-0x0000000007AE0000-0x0000000007B49000-memory.dmp

Download

memory/1656-63-0x0000000000870000-0x0000000000886000-memory.dmp

Download

memory/1656-62-0x0000000007230000-0x0000000007231000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads