oski | 76891a7bc50be94f6c5ad4e10cbb3a6eb515d452e5bcf80efbde25d8b61d8607

General

Target
f93fe182b5ec5a3a1e343110b1ca22a0.exe
Size 243KB
Sample211008-nz6xfaeba2
SHA256 76891a7bc50be94f6c5ad4e10cbb3a6eb515d452e5bcf80efbde25d8b61d8607
MD5 f93fe182b5ec5a3a1e343110b1ca22a0
SHA1 0e0071d31a81435b3f3af726a6ecb69e75fe4d15
SHA512 3b9ef3ce57590f598896c837209cedc1bf7164637342b46b578418f2e64036c332df0dc80a25402130757baac8d97221a9f4eddac5ac84058493f6a611b7625b
MD5 SHA1 SHA512

Score

10^/10

oski infostealer

Malware Config

Extracted

Family

oski

C2

lg-tvproducts.xyz

Signatures

Oski
Oski is an infostealer targeting browser data, crypto wallets.
infostealer oski

Loads dropped DLL 1 IoCs

pid	Process
1856	f93fe182b5ec5a3a1e343110b1ca22a0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1756	1628	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1756	WerFault.exe
1756	WerFault.exe
1756	WerFault.exe
1756	WerFault.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1756	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1756	WerFault.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1856 wrote to memory of 1628	1856	f93fe182b5ec5a3a1e343110b1ca22a0.exe	27
PID 1856 wrote to memory of 1628	1856	f93fe182b5ec5a3a1e343110b1ca22a0.exe	27
PID 1856 wrote to memory of 1628	1856	f93fe182b5ec5a3a1e343110b1ca22a0.exe	27
PID 1856 wrote to memory of 1628	1856	f93fe182b5ec5a3a1e343110b1ca22a0.exe	27
PID 1856 wrote to memory of 1628	1856	f93fe182b5ec5a3a1e343110b1ca22a0.exe	27
PID 1856 wrote to memory of 1628	1856	f93fe182b5ec5a3a1e343110b1ca22a0.exe	27
PID 1856 wrote to memory of 1628	1856	f93fe182b5ec5a3a1e343110b1ca22a0.exe	27
PID 1856 wrote to memory of 1628	1856	f93fe182b5ec5a3a1e343110b1ca22a0.exe	27
PID 1856 wrote to memory of 1628	1856	f93fe182b5ec5a3a1e343110b1ca22a0.exe	27
PID 1856 wrote to memory of 1628	1856	f93fe182b5ec5a3a1e343110b1ca22a0.exe	27
PID 1628 wrote to memory of 1756	1628	f93fe182b5ec5a3a1e343110b1ca22a0.exe	28
PID 1628 wrote to memory of 1756	1628	f93fe182b5ec5a3a1e343110b1ca22a0.exe	28
PID 1628 wrote to memory of 1756	1628	f93fe182b5ec5a3a1e343110b1ca22a0.exe	28
PID 1628 wrote to memory of 1756	1628	f93fe182b5ec5a3a1e343110b1ca22a0.exe	28

C:\Users\Admin\AppData\Local\Temp\f93fe182b5ec5a3a1e343110b1ca22a0.exe
"C:\Users\Admin\AppData\Local\Temp\f93fe182b5ec5a3a1e343110b1ca22a0.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Users\Admin\AppData\Local\Temp\f93fe182b5ec5a3a1e343110b1ca22a0.exe
  "C:\Users\Admin\AppData\Local\Temp\f93fe182b5ec5a3a1e343110b1ca22a0.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1628
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1628 -s 112
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:1756

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1628-63-0x00000000001C0000-0x00000000001F8000-memory.dmp

Download

memory/1628-66-0x00000000001C0000-0x00000000001F8000-memory.dmp

Download

memory/1628-69-0x00000000001C0000-0x00000000001F8000-memory.dmp

Download

memory/1756-72-0x00000000006A0000-0x00000000006D8000-memory.dmp

Download

memory/1856-60-0x0000000075041000-0x0000000075043000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads