oski | 5ffe71b977866248e55612e20cea0bf3ad51a50896443d791081f58b49cdc5df

General

Target
MT100098764.exe
Size 517KB
Sample210901-7bttv3cef6
SHA256 5ffe71b977866248e55612e20cea0bf3ad51a50896443d791081f58b49cdc5df
MD5 2269f021d855a0d6a65e7167962a23b0
SHA1 658e9df44920828b6bf73aad814f885efbb63cef
SHA512 e7c72459a963cf7d01543e2b0df4013121dde40be1a492bfdb9c96a5c7a4832f35bf1df87afa0e4acbd2190b8ea99609c426e7a813a56121daabea75acf26217
MD5 SHA1 SHA512

Score

10^/10

oski infostealer spyware suricata

Malware Config

Extracted

Family

oski

C2

http://bctpump.us

Signatures

Oski
Oski is an infostealer targeting browser data, crypto wallets.
infostealer oski
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
suricata
Downloads MZ/PE file

Loads dropped DLL 3 IoCs

pid	Process
2204	RegSvcs.exe
2204	RegSvcs.exe
2204	RegSvcs.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4056 set thread context of 2204	4056	MT100098764.exe	78

Checks processor information in registry 2 TTPs 1 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RegSvcs.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
2960	taskkill.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4056	MT100098764.exe
4056	MT100098764.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4056	MT100098764.exe
Token: SeDebugPrivilege	2960	taskkill.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4056 wrote to memory of 2204	4056	MT100098764.exe	78
PID 4056 wrote to memory of 2204	4056	MT100098764.exe	78
PID 4056 wrote to memory of 2204	4056	MT100098764.exe	78
PID 4056 wrote to memory of 2204	4056	MT100098764.exe	78
PID 4056 wrote to memory of 2204	4056	MT100098764.exe	78
PID 4056 wrote to memory of 2204	4056	MT100098764.exe	78
PID 4056 wrote to memory of 2204	4056	MT100098764.exe	78
PID 4056 wrote to memory of 2204	4056	MT100098764.exe	78
PID 4056 wrote to memory of 2204	4056	MT100098764.exe	78
PID 2204 wrote to memory of 1308	2204	RegSvcs.exe	79
PID 2204 wrote to memory of 1308	2204	RegSvcs.exe	79
PID 2204 wrote to memory of 1308	2204	RegSvcs.exe	79
PID 1308 wrote to memory of 2960	1308	cmd.exe	81
PID 1308 wrote to memory of 2960	1308	cmd.exe	81
PID 1308 wrote to memory of 2960	1308	cmd.exe	81

C:\Users\Admin\AppData\Local\Temp\MT100098764.exe
"C:\Users\Admin\AppData\Local\Temp\MT100098764.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4056
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious use of WriteProcessMemory
  PID:2204
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c taskkill /pid 2204 & erase C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe & RD /S /Q C:\\ProgramData\\883973699354565\\* & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1308
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /pid 2204
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2960

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2204-126-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2204-124-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4056-119-0x0000000009C70000-0x0000000009C86000-memory.dmp

Download

memory/4056-123-0x0000000001510000-0x000000000154C000-memory.dmp

Download

memory/4056-122-0x00000000094E0000-0x0000000009549000-memory.dmp

Download

memory/4056-121-0x0000000007800000-0x0000000007CFE000-memory.dmp

Download

memory/4056-120-0x0000000009D30000-0x0000000009D31000-memory.dmp

Download

memory/4056-114-0x0000000000B00000-0x0000000000B01000-memory.dmp

Download

memory/4056-118-0x0000000007A00000-0x0000000007A01000-memory.dmp

Download

memory/4056-117-0x00000000078A0000-0x00000000078A1000-memory.dmp

Download

memory/4056-116-0x0000000007D00000-0x0000000007D01000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads