oski | 165a20cece5bd869502d23ed2c9fdf5cb2e83451cca502b110f61371da70134d

Analysis

Target

165A20CECE5BD869502D23ED2C9FDF5CB2E83451CCA50.exe
Size

200KB
MD5

07ac7806a3f2bc0fc993d736ecb3572b
SHA1

49b54d7ece61cf9198dfc306a641f0d002b56acb
SHA256

165a20cece5bd869502d23ed2c9fdf5cb2e83451cca502b110f61371da70134d
SHA512

0bb78905d87356841e97e68be1d7c731f5cc4d15fa162017f9c520fceca327c589f8f31b9002c4869179af8626a03e89ef9b667a1a6d5e8f42eef2db98e1e123

Score

10^/10

Oski
Oski is an infostealer targeting browser data, crypto wallets.
infostealer oski
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1880 952 WerFault.exe 165A20CECE5BD869502D23ED2C9FDF5CB2E83451CCA50.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

1880 WerFault.exe
1880 WerFault.exe
1880 WerFault.exe
1880 WerFault.exe
1880 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1880 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1880 WerFault.exe

pid	pid_target	process	target process
1880	952	WerFault.exe	165A20CECE5BD869502D23ED2C9FDF5CB2E83451CCA50.exe

pid	process
1880	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1880	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

165A20CECE5BD869502D23ED2C9FDF5CB2E83451CCA50.exe

description	pid	process	target process
PID 952 wrote to memory of 1880	952	165A20CECE5BD869502D23ED2C9FDF5CB2E83451CCA50.exe	WerFault.exe
PID 952 wrote to memory of 1880	952	165A20CECE5BD869502D23ED2C9FDF5CB2E83451CCA50.exe	WerFault.exe
PID 952 wrote to memory of 1880	952	165A20CECE5BD869502D23ED2C9FDF5CB2E83451CCA50.exe	WerFault.exe
PID 952 wrote to memory of 1880	952	165A20CECE5BD869502D23ED2C9FDF5CB2E83451CCA50.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\165A20CECE5BD869502D23ED2C9FDF5CB2E83451CCA50.exe
"C:\Users\Admin\AppData\Local\Temp\165A20CECE5BD869502D23ED2C9FDF5CB2E83451CCA50.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:952

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

memory/952-55-0x0000000076431000-0x0000000076433000-memory.dmp

Filesize
8KB

Download
memory/1880-56-0x0000000000000000-mapping.dmp

Download
memory/1880-57-0x0000000000A90000-0x0000000000A91000-memory.dmp

Filesize
4KB

Download