oski | b32a72d74944d3b196f0905e74cc233a47f8ebfdb96ddbf71a183d08c3f5475a

General

Target

dd251dae550a6db360a54a963adb3adf18084b0db5bba7806b5b5ade01de69a3.exe
Size

2.5MB
MD5

ec370128bc27c7fb5eeccbb7052deca5
SHA1

a8abfd836c8e5c4aea8adc4a6000d36ea5b275a0
SHA256

dd251dae550a6db360a54a963adb3adf18084b0db5bba7806b5b5ade01de69a3
SHA512

2819ab07f2d9d23375b1b43b81e9e5efc85e5b5bb5fedaa98fc7d1f624820b14832c01404d5cc752e2523f0a80ef4de0312fdff3deb585ba0915605541b50e8f

Score

10^/10

oski evasion infostealer spyware stealer themida trojan

Malware Config

Extracted

Family

oski

C2

secureredirectinfo.com

Signatures

Oski
Oski is an infostealer targeting browser data, crypto wallets.
infostealer oski
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

dd251dae550a6db360a54a963adb3adf18084b0db5bba7806b5b5ade01de69a3.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	dd251dae550a6db360a54a963adb3adf18084b0db5bba7806b5b5ade01de69a3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	dd251dae550a6db360a54a963adb3adf18084b0db5bba7806b5b5ade01de69a3.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral1/memory/1264-56-0x00000000012B0000-0x0000000001931000-memory.dmp	themida
behavioral1/memory/1264-57-0x00000000012B0000-0x0000000001931000-memory.dmp	themida
behavioral1/memory/1264-58-0x00000000012B0000-0x0000000001931000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

dd251dae550a6db360a54a963adb3adf18084b0db5bba7806b5b5ade01de69a3.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dd251dae550a6db360a54a963adb3adf18084b0db5bba7806b5b5ade01de69a3.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

dd251dae550a6db360a54a963adb3adf18084b0db5bba7806b5b5ade01de69a3.exe

pid process

1264 dd251dae550a6db360a54a963adb3adf18084b0db5bba7806b5b5ade01de69a3.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1040 1264 WerFault.exe dd251dae550a6db360a54a963adb3adf18084b0db5bba7806b5b5ade01de69a3.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

1040 WerFault.exe
1040 WerFault.exe
1040 WerFault.exe
1040 WerFault.exe
1040 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1040 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1040 WerFault.exe

pid	process
1264	dd251dae550a6db360a54a963adb3adf18084b0db5bba7806b5b5ade01de69a3.exe

pid	pid_target	process	target process
1040	1264	WerFault.exe	dd251dae550a6db360a54a963adb3adf18084b0db5bba7806b5b5ade01de69a3.exe

pid	process
1040	WerFault.exe
1040	WerFault.exe
1040	WerFault.exe
1040	WerFault.exe
1040	WerFault.exe

pid	process
1040	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1040	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

dd251dae550a6db360a54a963adb3adf18084b0db5bba7806b5b5ade01de69a3.exe

description	pid	process	target process
PID 1264 wrote to memory of 1040	1264	dd251dae550a6db360a54a963adb3adf18084b0db5bba7806b5b5ade01de69a3.exe	WerFault.exe
PID 1264 wrote to memory of 1040	1264	dd251dae550a6db360a54a963adb3adf18084b0db5bba7806b5b5ade01de69a3.exe	WerFault.exe
PID 1264 wrote to memory of 1040	1264	dd251dae550a6db360a54a963adb3adf18084b0db5bba7806b5b5ade01de69a3.exe	WerFault.exe
PID 1264 wrote to memory of 1040	1264	dd251dae550a6db360a54a963adb3adf18084b0db5bba7806b5b5ade01de69a3.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\dd251dae550a6db360a54a963adb3adf18084b0db5bba7806b5b5ade01de69a3.exe
"C:\Users\Admin\AppData\Local\Temp\dd251dae550a6db360a54a963adb3adf18084b0db5bba7806b5b5ade01de69a3.exe"
1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1264 -s 876
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1040

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

2

T1012

Virtualization/Sandbox Evasion

1

T1497

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1040-60-0x0000000002070000-0x0000000002071000-memory.dmp

Filesize
4KB

Download
memory/1264-55-0x0000000075191000-0x0000000075193000-memory.dmp

Filesize
8KB

Download
memory/1264-56-0x00000000012B0000-0x0000000001931000-memory.dmp

Filesize
6.5MB

Download
memory/1264-57-0x00000000012B0000-0x0000000001931000-memory.dmp

Filesize
6.5MB

Download
memory/1264-58-0x00000000012B0000-0x0000000001931000-memory.dmp

Filesize
6.5MB

Download
memory/1264-59-0x0000000076EA0000-0x0000000076EA2000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads