oski | d9a8ff42d8a53247338920a5d7c8f2ecbb512d9e81334e68d1c54a6cc46c5351

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-en-20211208
submitted
02/01/2022, 17:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
19623242f86476316add324df9105497.exe
Size 893KB
Sample220102-vs5jcshadr
SHA256 d9a8ff42d8a53247338920a5d7c8f2ecbb512d9e81334e68d1c54a6cc46c5351
MD5 19623242f86476316add324df9105497
SHA1 64ae8ad39ba354adb009b2d2836eea5d8fe893f7
SHA512 234a871671f91efc14eac6e4efaf2a1b85de75f82ad88825703a740199d420261f0bc0f630f1b64668d4923abfa85d99599d88ac33ee8b726a7b502727339bc9
MD5 SHA1 SHA512

Score

10^/10

oski infostealer spyware suricata

Malware Config

Extracted

Family

oski

destad.axfree.com

Signatures

Oski
Oski is an infostealer targeting browser data, crypto wallets.
infostealer oski
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern
suricata
Downloads MZ/PE file

Loads dropped DLL 5 IoCs

pid	Process
696	aspnet_regiis.exe
696	aspnet_regiis.exe
696	aspnet_regiis.exe
696	aspnet_regiis.exe
696	aspnet_regiis.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1540 set thread context of 696	1540	19623242f86476316add324df9105497.exe	27

Checks processor information in registry 2 TTPs 1 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	aspnet_regiis.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
848	taskkill.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1540	19623242f86476316add324df9105497.exe
1540	19623242f86476316add324df9105497.exe
1540	19623242f86476316add324df9105497.exe
1540	19623242f86476316add324df9105497.exe
1540	19623242f86476316add324df9105497.exe
1540	19623242f86476316add324df9105497.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1540	19623242f86476316add324df9105497.exe
Token: SeDebugPrivilege	848	taskkill.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 696	1540	19623242f86476316add324df9105497.exe	27
PID 1540 wrote to memory of 696	1540	19623242f86476316add324df9105497.exe	27
PID 1540 wrote to memory of 696	1540	19623242f86476316add324df9105497.exe	27
PID 1540 wrote to memory of 696	1540	19623242f86476316add324df9105497.exe	27
PID 1540 wrote to memory of 696	1540	19623242f86476316add324df9105497.exe	27
PID 1540 wrote to memory of 696	1540	19623242f86476316add324df9105497.exe	27
PID 1540 wrote to memory of 696	1540	19623242f86476316add324df9105497.exe	27
PID 1540 wrote to memory of 696	1540	19623242f86476316add324df9105497.exe	27
PID 1540 wrote to memory of 696	1540	19623242f86476316add324df9105497.exe	27
PID 1540 wrote to memory of 696	1540	19623242f86476316add324df9105497.exe	27
PID 1540 wrote to memory of 696	1540	19623242f86476316add324df9105497.exe	27
PID 696 wrote to memory of 1508	696	aspnet_regiis.exe	30
PID 696 wrote to memory of 1508	696	aspnet_regiis.exe	30
PID 696 wrote to memory of 1508	696	aspnet_regiis.exe	30
PID 696 wrote to memory of 1508	696	aspnet_regiis.exe	30
PID 1508 wrote to memory of 848	1508	cmd.exe	32
PID 1508 wrote to memory of 848	1508	cmd.exe	32
PID 1508 wrote to memory of 848	1508	cmd.exe	32
PID 1508 wrote to memory of 848	1508	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\19623242f86476316add324df9105497.exe
"C:\Users\Admin\AppData\Local\Temp\19623242f86476316add324df9105497.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
  2⤵
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious use of WriteProcessMemory
  PID:696
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c taskkill /pid 696 & erase C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe & RD /S /Q C:\\ProgramData\\926075610443034\\* & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1508
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /pid 696
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:848

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/696-72-0x0000000076731000-0x0000000076733000-memory.dmp

Download

memory/696-73-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/696-70-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/696-69-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/696-64-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/696-65-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/696-66-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/696-67-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/696-68-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/1540-63-0x0000000000DF0000-0x0000000000DFC000-memory.dmp

Download

memory/1540-60-0x0000000001260000-0x000000000131E000-memory.dmp

Download

memory/1540-62-0x0000000000C50000-0x0000000000C5C000-memory.dmp

Download

memory/1540-54-0x00000000013C0000-0x00000000014A4000-memory.dmp

Download

memory/1540-61-0x0000000000DE0000-0x0000000000E19000-memory.dmp

Download

memory/1540-59-0x0000000000AC0000-0x0000000000B7A000-memory.dmp

Download

memory/1540-58-0x0000000000A20000-0x0000000000A28000-memory.dmp

Download

memory/1540-57-0x0000000000680000-0x0000000000688000-memory.dmp

Download

memory/1540-56-0x0000000000670000-0x0000000000678000-memory.dmp

Download

memory/1540-55-0x0000000004F40000-0x0000000004F41000-memory.dmp

Download