oski | 1205ff704d6dc1efc0a09c708a5e1fee891656497917cdbdad03306102abb407

General

Target

3825e98d175412654d7f6dd6089c59d603eb1e2cd3ea3746a221aaae42dcab56.exe
Size

609KB
MD5

57eb53676024058c2c05bf2fd22aecaf
SHA1

6accbb2957dfb1c6eb55a52dcf7170a547b48a58
SHA256

3825e98d175412654d7f6dd6089c59d603eb1e2cd3ea3746a221aaae42dcab56
SHA512

7bef54c5c1c283b8d82d47b26169ffa608beb9dee1d5e356c41c3bcfc3e60cc08c295855338ff93156080efe79da3aced16bc2861de4730b7a0c17130ff5d190

Score

10^/10

oski infostealer spyware stealer

Malware Config

Extracted

Family

oski

C2

datafishers.club

Signatures

Oski
Oski is an infostealer targeting browser data, crypto wallets.
infostealer oski
Executes dropped EXE 1 IoCs

Processes:

WinSec.exe

pid process

3780 WinSec.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
3780	WinSec.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

3825e98d175412654d7f6dd6089c59d603eb1e2cd3ea3746a221aaae42dcab56.exe

description	pid	process	target process
PID 2936 set thread context of 3780	2936	3825e98d175412654d7f6dd6089c59d603eb1e2cd3ea3746a221aaae42dcab56.exe	WinSec.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1148 3780 WerFault.exe WinSec.exe

pid	pid_target	process	target process
1148	3780	WerFault.exe	WinSec.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
1148	WerFault.exe
1148	WerFault.exe
1148	WerFault.exe
1148	WerFault.exe
1148	WerFault.exe
1148	WerFault.exe
1148	WerFault.exe
1148	WerFault.exe
1148	WerFault.exe
1148	WerFault.exe
1148	WerFault.exe
1148	WerFault.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

3825e98d175412654d7f6dd6089c59d603eb1e2cd3ea3746a221aaae42dcab56.exeWerFault.exe

description	pid	process
Token: SeDebugPrivilege	2936	3825e98d175412654d7f6dd6089c59d603eb1e2cd3ea3746a221aaae42dcab56.exe
Token: SeRestorePrivilege	1148	WerFault.exe
Token: SeBackupPrivilege	1148	WerFault.exe
Token: SeDebugPrivilege	1148	WerFault.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

3825e98d175412654d7f6dd6089c59d603eb1e2cd3ea3746a221aaae42dcab56.exe

description	pid	process	target process
PID 2936 wrote to memory of 3780	2936	3825e98d175412654d7f6dd6089c59d603eb1e2cd3ea3746a221aaae42dcab56.exe	WinSec.exe
PID 2936 wrote to memory of 3780	2936	3825e98d175412654d7f6dd6089c59d603eb1e2cd3ea3746a221aaae42dcab56.exe	WinSec.exe
PID 2936 wrote to memory of 3780	2936	3825e98d175412654d7f6dd6089c59d603eb1e2cd3ea3746a221aaae42dcab56.exe	WinSec.exe
PID 2936 wrote to memory of 3780	2936	3825e98d175412654d7f6dd6089c59d603eb1e2cd3ea3746a221aaae42dcab56.exe	WinSec.exe
PID 2936 wrote to memory of 3780	2936	3825e98d175412654d7f6dd6089c59d603eb1e2cd3ea3746a221aaae42dcab56.exe	WinSec.exe
PID 2936 wrote to memory of 3780	2936	3825e98d175412654d7f6dd6089c59d603eb1e2cd3ea3746a221aaae42dcab56.exe	WinSec.exe
PID 2936 wrote to memory of 3780	2936	3825e98d175412654d7f6dd6089c59d603eb1e2cd3ea3746a221aaae42dcab56.exe	WinSec.exe
PID 2936 wrote to memory of 3780	2936	3825e98d175412654d7f6dd6089c59d603eb1e2cd3ea3746a221aaae42dcab56.exe	WinSec.exe
PID 2936 wrote to memory of 3780	2936	3825e98d175412654d7f6dd6089c59d603eb1e2cd3ea3746a221aaae42dcab56.exe	WinSec.exe

C:\Users\Admin\AppData\Local\Temp\3825e98d175412654d7f6dd6089c59d603eb1e2cd3ea3746a221aaae42dcab56.exe
"C:\Users\Admin\AppData\Local\Temp\3825e98d175412654d7f6dd6089c59d603eb1e2cd3ea3746a221aaae42dcab56.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2936

C:\Users\Admin\AppData\Local\Temp\WinSec.exe
C:\Users\Admin\AppData\Local\Temp\WinSec.exe
2⤵
- Executes dropped EXE
PID:3780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3780 -s 1280
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1148

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\WinSec.exe
MD5
dd0ee56841e535a3a3ae7c20c32de9cd

SHA1
fc1ea172fd3c67a00e37f930f7595784fc0d1f84

SHA256
8649df38276968d1417ec064360339610ff644491c87eb8ac2b2e67e7cbe47c9

SHA512
ee6a7982e194a5a24f5bd596d1ad6582defcababa19ea8011ba71ead2ee8945dce9f5af56e47b088c16ca00cb6c7225cc18b9b6f026e623283c0e02f9bed524e

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinSec.exe
MD5
dd0ee56841e535a3a3ae7c20c32de9cd

SHA1
fc1ea172fd3c67a00e37f930f7595784fc0d1f84

SHA256
8649df38276968d1417ec064360339610ff644491c87eb8ac2b2e67e7cbe47c9

SHA512
ee6a7982e194a5a24f5bd596d1ad6582defcababa19ea8011ba71ead2ee8945dce9f5af56e47b088c16ca00cb6c7225cc18b9b6f026e623283c0e02f9bed524e

Download Submit
memory/2936-118-0x00000000009F0000-0x00000000009F1000-memory.dmp

Filesize
4KB

Download
memory/3780-119-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3780-120-0x000000000040717B-mapping.dmp

Download
memory/3780-123-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads