oski | d9a8ff42d8a53247338920a5d7c8f2ecbb512d9e81334e68d1c54a6cc46c5351

Analysis

max time kernel
122s
max time network
126s
platform
windows10_x64
resource
win10-en-20211208
submitted
02/01/2022, 17:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
19623242f86476316add324df9105497.exe
Size 893KB
Sample220102-vs5jcshadr
SHA256 d9a8ff42d8a53247338920a5d7c8f2ecbb512d9e81334e68d1c54a6cc46c5351
MD5 19623242f86476316add324df9105497
SHA1 64ae8ad39ba354adb009b2d2836eea5d8fe893f7
SHA512 234a871671f91efc14eac6e4efaf2a1b85de75f82ad88825703a740199d420261f0bc0f630f1b64668d4923abfa85d99599d88ac33ee8b726a7b502727339bc9
MD5 SHA1 SHA512

Score

10^/10

oski infostealer spyware suricata

Malware Config

Extracted

Family

oski

destad.axfree.com

Signatures

Oski
Oski is an infostealer targeting browser data, crypto wallets.
infostealer oski
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
suricata
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern
suricata
Downloads MZ/PE file

Loads dropped DLL 3 IoCs

pid	Process
4176	aspnet_state.exe
4176	aspnet_state.exe
4176	aspnet_state.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3584 set thread context of 4176	3584	19623242f86476316add324df9105497.exe	71

Checks processor information in registry 2 TTPs 1 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	aspnet_state.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
4328	taskkill.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
3584	19623242f86476316add324df9105497.exe
3584	19623242f86476316add324df9105497.exe
3584	19623242f86476316add324df9105497.exe
3584	19623242f86476316add324df9105497.exe
3584	19623242f86476316add324df9105497.exe
3584	19623242f86476316add324df9105497.exe
3584	19623242f86476316add324df9105497.exe
3584	19623242f86476316add324df9105497.exe
3584	19623242f86476316add324df9105497.exe
3584	19623242f86476316add324df9105497.exe
3584	19623242f86476316add324df9105497.exe
3584	19623242f86476316add324df9105497.exe
3584	19623242f86476316add324df9105497.exe
3584	19623242f86476316add324df9105497.exe
3584	19623242f86476316add324df9105497.exe
3584	19623242f86476316add324df9105497.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3584	19623242f86476316add324df9105497.exe
Token: SeDebugPrivilege	4328	taskkill.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 3584 wrote to memory of 4160	3584	19623242f86476316add324df9105497.exe	68
PID 3584 wrote to memory of 4160	3584	19623242f86476316add324df9105497.exe	68
PID 3584 wrote to memory of 4160	3584	19623242f86476316add324df9105497.exe	68
PID 3584 wrote to memory of 3932	3584	19623242f86476316add324df9105497.exe	69
PID 3584 wrote to memory of 3932	3584	19623242f86476316add324df9105497.exe	69
PID 3584 wrote to memory of 3932	3584	19623242f86476316add324df9105497.exe	69
PID 3584 wrote to memory of 8	3584	19623242f86476316add324df9105497.exe	70
PID 3584 wrote to memory of 8	3584	19623242f86476316add324df9105497.exe	70
PID 3584 wrote to memory of 8	3584	19623242f86476316add324df9105497.exe	70
PID 3584 wrote to memory of 4176	3584	19623242f86476316add324df9105497.exe	71
PID 3584 wrote to memory of 4176	3584	19623242f86476316add324df9105497.exe	71
PID 3584 wrote to memory of 4176	3584	19623242f86476316add324df9105497.exe	71
PID 3584 wrote to memory of 4176	3584	19623242f86476316add324df9105497.exe	71
PID 3584 wrote to memory of 4176	3584	19623242f86476316add324df9105497.exe	71
PID 3584 wrote to memory of 4176	3584	19623242f86476316add324df9105497.exe	71
PID 3584 wrote to memory of 4176	3584	19623242f86476316add324df9105497.exe	71
PID 3584 wrote to memory of 4176	3584	19623242f86476316add324df9105497.exe	71
PID 3584 wrote to memory of 4176	3584	19623242f86476316add324df9105497.exe	71
PID 3584 wrote to memory of 4176	3584	19623242f86476316add324df9105497.exe	71
PID 4176 wrote to memory of 4456	4176	aspnet_state.exe	72
PID 4176 wrote to memory of 4456	4176	aspnet_state.exe	72
PID 4176 wrote to memory of 4456	4176	aspnet_state.exe	72
PID 4456 wrote to memory of 4328	4456	cmd.exe	74
PID 4456 wrote to memory of 4328	4456	cmd.exe	74
PID 4456 wrote to memory of 4328	4456	cmd.exe	74

C:\Users\Admin\AppData\Local\Temp\19623242f86476316add324df9105497.exe
"C:\Users\Admin\AppData\Local\Temp\19623242f86476316add324df9105497.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3584
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
  2⤵
  PID:4160
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:3932
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
  2⤵
  PID:8
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe"
  2⤵
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious use of WriteProcessMemory
  PID:4176
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c taskkill /pid 4176 & erase C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe & RD /S /Q C:\\ProgramData\\938073000834347\\* & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4456
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /pid 4176
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4328

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3584-131-0x00000000016E0000-0x00000000016EC000-memory.dmp

Download

memory/3584-135-0x0000000001700000-0x0000000001708000-memory.dmp

Download

memory/3584-120-0x0000000005780000-0x0000000005C7E000-memory.dmp

Download

memory/3584-121-0x00000000055B0000-0x00000000055B8000-memory.dmp

Download

memory/3584-122-0x0000000005660000-0x0000000005668000-memory.dmp

Download

memory/3584-123-0x0000000005670000-0x0000000005678000-memory.dmp

Download

memory/3584-124-0x0000000005680000-0x0000000005688000-memory.dmp

Download

memory/3584-125-0x0000000005820000-0x00000000058DA000-memory.dmp

Download

memory/3584-134-0x0000000001700000-0x0000000001739000-memory.dmp

Download

memory/3584-127-0x0000000005AC0000-0x0000000005B7E000-memory.dmp

Download

memory/3584-128-0x0000000005C00000-0x0000000005C39000-memory.dmp

Download

memory/3584-129-0x00000000064E0000-0x00000000066F4000-memory.dmp

Download

memory/3584-130-0x00000000016E0000-0x0000000001719000-memory.dmp

Download

memory/3584-115-0x0000000000CE0000-0x0000000000DC4000-memory.dmp

Download

memory/3584-119-0x0000000005780000-0x0000000005812000-memory.dmp

Download

memory/3584-132-0x0000000005C20000-0x0000000005C76000-memory.dmp

Download

memory/3584-126-0x0000000005900000-0x000000000591E000-memory.dmp

Download

memory/3584-133-0x00000000064E0000-0x0000000006772000-memory.dmp

Download

memory/3584-136-0x0000000001720000-0x0000000001728000-memory.dmp

Download

memory/3584-137-0x0000000001730000-0x0000000001752000-memory.dmp

Download

memory/3584-138-0x0000000001730000-0x0000000001769000-memory.dmp

Download

memory/3584-139-0x0000000001700000-0x000000000170C000-memory.dmp

Download

memory/3584-116-0x00000000055C0000-0x0000000005636000-memory.dmp

Download

memory/3584-117-0x00000000056E0000-0x000000000577C000-memory.dmp

Download

memory/3584-118-0x0000000005C80000-0x000000000617E000-memory.dmp

Download

memory/4176-143-0x0000000004510000-0x0000000004511000-memory.dmp

Download

memory/4176-144-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/4176-142-0x0000000004510000-0x0000000004511000-memory.dmp

Download

memory/4176-140-0x0000000000400000-0x0000000000439000-memory.dmp

Download