oski | c30ce79d7b5b0708dc03f1532fa89afd4efd732531cb557dc31fe63acd5bc1ce

General

Target

gunzipped.exe
Size

411KB
MD5

c2301b62539adcba29dcf6a3200bd017
SHA1

fd80f7e8e32661d5ec12e7a901f22a9ed82e17a7
SHA256

c30ce79d7b5b0708dc03f1532fa89afd4efd732531cb557dc31fe63acd5bc1ce
SHA512

80fef672e7f48640c585f12408025ea06c67344551bb4638e10120ceb30da7e888b18a52aabd209186315c1476da905afe15d5cb68a7d7e266954de16e813037

Score

10^/10

oski infostealer

Malware Config

Extracted

Family

oski

C2

http://2.56.57.108/osk/

Signatures

Oski
Oski is an infostealer targeting browser data, crypto wallets.
infostealer oski
Loads dropped DLL 1 IoCs

Processes:

gunzipped.exe

pid process

1904 gunzipped.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

672 1404 WerFault.exe gunzipped.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

672 WerFault.exe
672 WerFault.exe
672 WerFault.exe
672 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

672 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 672 WerFault.exe

pid	process
1904	gunzipped.exe

pid	pid_target	process	target process
672	1404	WerFault.exe	gunzipped.exe

pid	process
672	WerFault.exe
672	WerFault.exe
672	WerFault.exe
672	WerFault.exe

pid	process
672	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	672	WerFault.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

gunzipped.exegunzipped.exe

description	pid	process	target process
PID 1904 wrote to memory of 1404	1904	gunzipped.exe	gunzipped.exe
PID 1904 wrote to memory of 1404	1904	gunzipped.exe	gunzipped.exe
PID 1904 wrote to memory of 1404	1904	gunzipped.exe	gunzipped.exe
PID 1904 wrote to memory of 1404	1904	gunzipped.exe	gunzipped.exe
PID 1904 wrote to memory of 1404	1904	gunzipped.exe	gunzipped.exe
PID 1904 wrote to memory of 1404	1904	gunzipped.exe	gunzipped.exe
PID 1904 wrote to memory of 1404	1904	gunzipped.exe	gunzipped.exe
PID 1904 wrote to memory of 1404	1904	gunzipped.exe	gunzipped.exe
PID 1904 wrote to memory of 1404	1904	gunzipped.exe	gunzipped.exe
PID 1904 wrote to memory of 1404	1904	gunzipped.exe	gunzipped.exe
PID 1404 wrote to memory of 672	1404	gunzipped.exe	WerFault.exe
PID 1404 wrote to memory of 672	1404	gunzipped.exe	WerFault.exe
PID 1404 wrote to memory of 672	1404	gunzipped.exe	WerFault.exe
PID 1404 wrote to memory of 672	1404	gunzipped.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\gunzipped.exe
"C:\Users\Admin\AppData\Local\Temp\gunzipped.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1904

C:\Users\Admin\AppData\Local\Temp\gunzipped.exe
"C:\Users\Admin\AppData\Local\Temp\gunzipped.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1404 -s 112
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:672

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsdC17C.tmp\qhvek.dll
MD5
e1821b88ae16db674b9a0d7e3c1eabeb

SHA1
966b2fd636a330b3812c8aae9ce7a12d98e105b7

SHA256
b570a242266192cdb433f2af8e5fc2b54368dcf6f2f385dfd836032403ef4520

SHA512
c514ca0d44c63c03b6ac34e66005cbf80e5f09cd511c7fbe11ff176720ad45bfe9d2809132f6ecd0251bb22e06e6d9e19361960913707dc958eae5f115ed22f6

Download Submit
memory/672-64-0x0000000000000000-mapping.dmp

Download
memory/672-66-0x0000000000420000-0x0000000000421000-memory.dmp

Filesize
4KB

Download
memory/1404-56-0x0000000000000000-mapping.dmp

Download
memory/1404-57-0x00000000001C0000-0x00000000001F8000-memory.dmp

Filesize
224KB

Download
memory/1404-60-0x00000000001C0000-0x00000000001F8000-memory.dmp

Filesize
224KB

Download
memory/1404-63-0x00000000001C0000-0x00000000001F8000-memory.dmp

Filesize
224KB

Download
memory/1904-54-0x0000000074F01000-0x0000000074F03000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing