oski | 913a7c8a88dc0720ff7fe2005243939f2fdadc129f69a46cc8fcfe54a16f0e75

General

Target
8577d33d01e9b4d70ba0abef53c03277.exe
Size 355KB
Sample220330-ckjmtaafaq
SHA256 913a7c8a88dc0720ff7fe2005243939f2fdadc129f69a46cc8fcfe54a16f0e75
MD5 8577d33d01e9b4d70ba0abef53c03277
SHA1 1f84eecb02e4179c554f8cfe27fad4b17d26025d
SHA512 4848150c8810ec4c0fb58e3f7b8d823cc7959107f696cd446b0514a0b1aaaf4fac66d83c8a95acdb02b8a8724316f12a6fff8972589b463bca05c2ca40dc3c46
MD5 SHA1 SHA512

Score

10^/10

oski infostealer spyware stealer suricata

Malware Config

Extracted

Family

oski

C2

e4v5sa.xyz

Signatures

Oski
Oski is an infostealer targeting browser data, crypto wallets.
infostealer oski
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern
suricata

Executes dropped EXE 2 IoCs

pid	Process
3596	bbjjgn.exe
3124	bbjjgn.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4216	3124	WerFault.exe	84

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1404 wrote to memory of 3596	1404	8577d33d01e9b4d70ba0abef53c03277.exe	83
PID 1404 wrote to memory of 3596	1404	8577d33d01e9b4d70ba0abef53c03277.exe	83
PID 1404 wrote to memory of 3596	1404	8577d33d01e9b4d70ba0abef53c03277.exe	83
PID 3596 wrote to memory of 3124	3596	bbjjgn.exe	84
PID 3596 wrote to memory of 3124	3596	bbjjgn.exe	84
PID 3596 wrote to memory of 3124	3596	bbjjgn.exe	84
PID 3596 wrote to memory of 3124	3596	bbjjgn.exe	84
PID 3596 wrote to memory of 3124	3596	bbjjgn.exe	84
PID 3596 wrote to memory of 3124	3596	bbjjgn.exe	84
PID 3596 wrote to memory of 3124	3596	bbjjgn.exe	84
PID 3596 wrote to memory of 3124	3596	bbjjgn.exe	84
PID 3596 wrote to memory of 3124	3596	bbjjgn.exe	84

C:\Users\Admin\AppData\Local\Temp\8577d33d01e9b4d70ba0abef53c03277.exe
"C:\Users\Admin\AppData\Local\Temp\8577d33d01e9b4d70ba0abef53c03277.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1404
- C:\Users\Admin\AppData\Local\Temp\bbjjgn.exe
  C:\Users\Admin\AppData\Local\Temp\bbjjgn.exe C:\Users\Admin\AppData\Local\Temp\gqrgzrmb
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3596
- - C:\Users\Admin\AppData\Local\Temp\bbjjgn.exe
    C:\Users\Admin\AppData\Local\Temp\bbjjgn.exe C:\Users\Admin\AppData\Local\Temp\gqrgzrmb
    3⤵
    - Executes dropped EXE
    PID:3124
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3124 -s 1344
      4⤵
      Program crash
      PID:4216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 124 -p 3124 -ip 3124
1⤵
PID:2060

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bbjjgn.exe

Path C:\Users\Admin\AppData\Local\Temp\bbjjgn.exe
Size 109KB
SHA256 74bfefcce9e8c2e34558f25efdaee37e2ba7db59e40965859065a2e408a75770
MD5 55c5d5f188d7d14b75e90d81bbedb15b
SHA1 698e0272fe1dc6368a6d50e3ae9d12184098639e
SHA512 5f105e09abb2c67e5bec9271cb1bd1a96f93b1ccbd420ad987f8d39a2e8c7268e5f8ac7f0ef2630137a82f165231206fcbe21ef6695bc69cb39229de4a5baf08
MD5 SHA1 SHA512

Submit Download

bbjjgn.exe

Path C:\Users\Admin\AppData\Local\Temp\bbjjgn.exe
Size 109KB
SHA256 74bfefcce9e8c2e34558f25efdaee37e2ba7db59e40965859065a2e408a75770
MD5 55c5d5f188d7d14b75e90d81bbedb15b
SHA1 698e0272fe1dc6368a6d50e3ae9d12184098639e
SHA512 5f105e09abb2c67e5bec9271cb1bd1a96f93b1ccbd420ad987f8d39a2e8c7268e5f8ac7f0ef2630137a82f165231206fcbe21ef6695bc69cb39229de4a5baf08
MD5 SHA1 SHA512

Submit Download

bbjjgn.exe

Path C:\Users\Admin\AppData\Local\Temp\bbjjgn.exe
Size 109KB
SHA256 74bfefcce9e8c2e34558f25efdaee37e2ba7db59e40965859065a2e408a75770
MD5 55c5d5f188d7d14b75e90d81bbedb15b
SHA1 698e0272fe1dc6368a6d50e3ae9d12184098639e
SHA512 5f105e09abb2c67e5bec9271cb1bd1a96f93b1ccbd420ad987f8d39a2e8c7268e5f8ac7f0ef2630137a82f165231206fcbe21ef6695bc69cb39229de4a5baf08
MD5 SHA1 SHA512

Submit Download

gqrgzrmb

Path C:\Users\Admin\AppData\Local\Temp\gqrgzrmb
Size 4KB
SHA256 6241a6b459412efd44fe4bca18f57d802dff4682211c15bf970ddb34cfc95e4b
MD5 ec86abe57beb8a315221634c1163d772
SHA1 3c1f4ae6ba50b2a900147659669318f65df8b4d8
SHA512 444227f8b3db866d057be1c583f8c043a44a2899457ce2c3843a7f69bb318ec0961cb0bc2dfac384bc5631b38422eda5514167fd83b00820d052babff0aa1f85
MD5 SHA1 SHA512

Submit Download

yqjkc03awp

Path C:\Users\Admin\AppData\Local\Temp\yqjkc03awp
Size 214KB
SHA256 00b831f5cccded55477fd0fe55d554a7375daae88c815b8cc3ef793f7a4e3ae5
MD5 d5c7c2dc6891be5104aa4c826890772a
SHA1 21b86d278094e84fce3f455524160f4e81c673fc
SHA512 afa170c230f718edbd53a9ec9e570c73c28ca4d2f8ded477584262e49fcef3389d1e76bb79fc6bec70fb1f68aa9194c09d35f42dae4e2b2969203fbb251d9f0d
MD5 SHA1 SHA512

Submit Download

memory/3124-141-0x0000000000700000-0x0000000000738000-memory.dmp

Download

memory/3124-144-0x0000000000700000-0x0000000000738000-memory.dmp

Download

memory/3124-147-0x0000000000700000-0x0000000000738000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads