oski | 10ff4344f698547a27e67167438038e64b2b7ec9d0329b2848eac9d1eb1b420a

General

Target

28d5e4dcaadfbd31a3c06048031bf9070d8a6f81abeef808cdf4a6d5c19d783c.exe
Size

322KB
MD5

f61ed5198e5dd131980bbd500c0aa319
SHA1

b777cb080166f9268067981e963455e084c5dfe2
SHA256

28d5e4dcaadfbd31a3c06048031bf9070d8a6f81abeef808cdf4a6d5c19d783c
SHA512

67ca7388607ffeaa980222f9cab550c2f8bd7c2099eeb41059ae1415dc3aa8e36c4feaf892e617819249bd34f9c3ede4eb554e9ae3bae83ea8ef67fe5fe31ae9

Score

10^/10

oski infostealer persistence spyware stealer

Malware Config

Extracted

Family

oski

C2

gemsbundle.com

Signatures

Oski
Oski is an infostealer targeting browser data, crypto wallets.
infostealer oski
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

28d5e4dcaadfbd31a3c06048031bf9070d8a6f81abeef808cdf4a6d5c19d783c.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\MbSAXaLzRE = "C:\\Users\\Admin\\AppData\\Roaming\\TpPsESMjAC\\YbZNCwDeSR.exe"	28d5e4dcaadfbd31a3c06048031bf9070d8a6f81abeef808cdf4a6d5c19d783c.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

28d5e4dcaadfbd31a3c06048031bf9070d8a6f81abeef808cdf4a6d5c19d783c.exe

description	pid	process	target process
PID 1548 set thread context of 1304	1548	28d5e4dcaadfbd31a3c06048031bf9070d8a6f81abeef808cdf4a6d5c19d783c.exe	28d5e4dcaadfbd31a3c06048031bf9070d8a6f81abeef808cdf4a6d5c19d783c.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1812 1304 WerFault.exe 28d5e4dcaadfbd31a3c06048031bf9070d8a6f81abeef808cdf4a6d5c19d783c.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

1812 WerFault.exe
1812 WerFault.exe
1812 WerFault.exe
1812 WerFault.exe
1812 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1812 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1812 WerFault.exe

pid	pid_target	process	target process
1812	1304	WerFault.exe	28d5e4dcaadfbd31a3c06048031bf9070d8a6f81abeef808cdf4a6d5c19d783c.exe

pid	process
1812	WerFault.exe
1812	WerFault.exe
1812	WerFault.exe
1812	WerFault.exe
1812	WerFault.exe

pid	process
1812	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1812	WerFault.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

28d5e4dcaadfbd31a3c06048031bf9070d8a6f81abeef808cdf4a6d5c19d783c.exe28d5e4dcaadfbd31a3c06048031bf9070d8a6f81abeef808cdf4a6d5c19d783c.exe

description	pid	process	target process
PID 1548 wrote to memory of 1304	1548	28d5e4dcaadfbd31a3c06048031bf9070d8a6f81abeef808cdf4a6d5c19d783c.exe	28d5e4dcaadfbd31a3c06048031bf9070d8a6f81abeef808cdf4a6d5c19d783c.exe
PID 1548 wrote to memory of 1304	1548	28d5e4dcaadfbd31a3c06048031bf9070d8a6f81abeef808cdf4a6d5c19d783c.exe	28d5e4dcaadfbd31a3c06048031bf9070d8a6f81abeef808cdf4a6d5c19d783c.exe
PID 1548 wrote to memory of 1304	1548	28d5e4dcaadfbd31a3c06048031bf9070d8a6f81abeef808cdf4a6d5c19d783c.exe	28d5e4dcaadfbd31a3c06048031bf9070d8a6f81abeef808cdf4a6d5c19d783c.exe
PID 1548 wrote to memory of 1304	1548	28d5e4dcaadfbd31a3c06048031bf9070d8a6f81abeef808cdf4a6d5c19d783c.exe	28d5e4dcaadfbd31a3c06048031bf9070d8a6f81abeef808cdf4a6d5c19d783c.exe
PID 1548 wrote to memory of 1304	1548	28d5e4dcaadfbd31a3c06048031bf9070d8a6f81abeef808cdf4a6d5c19d783c.exe	28d5e4dcaadfbd31a3c06048031bf9070d8a6f81abeef808cdf4a6d5c19d783c.exe
PID 1548 wrote to memory of 1304	1548	28d5e4dcaadfbd31a3c06048031bf9070d8a6f81abeef808cdf4a6d5c19d783c.exe	28d5e4dcaadfbd31a3c06048031bf9070d8a6f81abeef808cdf4a6d5c19d783c.exe
PID 1548 wrote to memory of 1304	1548	28d5e4dcaadfbd31a3c06048031bf9070d8a6f81abeef808cdf4a6d5c19d783c.exe	28d5e4dcaadfbd31a3c06048031bf9070d8a6f81abeef808cdf4a6d5c19d783c.exe
PID 1548 wrote to memory of 1304	1548	28d5e4dcaadfbd31a3c06048031bf9070d8a6f81abeef808cdf4a6d5c19d783c.exe	28d5e4dcaadfbd31a3c06048031bf9070d8a6f81abeef808cdf4a6d5c19d783c.exe
PID 1548 wrote to memory of 1304	1548	28d5e4dcaadfbd31a3c06048031bf9070d8a6f81abeef808cdf4a6d5c19d783c.exe	28d5e4dcaadfbd31a3c06048031bf9070d8a6f81abeef808cdf4a6d5c19d783c.exe
PID 1548 wrote to memory of 1304	1548	28d5e4dcaadfbd31a3c06048031bf9070d8a6f81abeef808cdf4a6d5c19d783c.exe	28d5e4dcaadfbd31a3c06048031bf9070d8a6f81abeef808cdf4a6d5c19d783c.exe
PID 1304 wrote to memory of 1812	1304	28d5e4dcaadfbd31a3c06048031bf9070d8a6f81abeef808cdf4a6d5c19d783c.exe	WerFault.exe
PID 1304 wrote to memory of 1812	1304	28d5e4dcaadfbd31a3c06048031bf9070d8a6f81abeef808cdf4a6d5c19d783c.exe	WerFault.exe
PID 1304 wrote to memory of 1812	1304	28d5e4dcaadfbd31a3c06048031bf9070d8a6f81abeef808cdf4a6d5c19d783c.exe	WerFault.exe
PID 1304 wrote to memory of 1812	1304	28d5e4dcaadfbd31a3c06048031bf9070d8a6f81abeef808cdf4a6d5c19d783c.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\28d5e4dcaadfbd31a3c06048031bf9070d8a6f81abeef808cdf4a6d5c19d783c.exe
"C:\Users\Admin\AppData\Local\Temp\28d5e4dcaadfbd31a3c06048031bf9070d8a6f81abeef808cdf4a6d5c19d783c.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1548

C:\Users\Admin\AppData\Local\Temp\28d5e4dcaadfbd31a3c06048031bf9070d8a6f81abeef808cdf4a6d5c19d783c.exe
"C:\Users\Admin\AppData\Local\Temp\28d5e4dcaadfbd31a3c06048031bf9070d8a6f81abeef808cdf4a6d5c19d783c.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 772
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1812

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1304-63-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1304-64-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1304-67-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1304-59-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1304-61-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1304-60-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1304-62-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1304-65-0x000000000040717B-mapping.dmp

Download
memory/1304-66-0x0000000076531000-0x0000000076533000-memory.dmp

Filesize
8KB

Download
memory/1548-55-0x00000000012D0000-0x00000000012D1000-memory.dmp

Filesize
4KB

Download
memory/1548-57-0x0000000004B00000-0x0000000004B01000-memory.dmp

Filesize
4KB

Download
memory/1548-58-0x0000000000460000-0x0000000000463000-memory.dmp

Filesize
12KB

Download
memory/1812-68-0x0000000000000000-mapping.dmp

Download
memory/1812-69-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads