oski | bbd4dd21dde67a96ac02aa9795ce662fa36d4edb90d13f2ffbdeee0d4aea5050

General

Target

DFI_0451_587_032.exe
Size

375KB
MD5

2e85f22e8e3436b38af2299a04f0cad8
SHA1

3cde19f615684e6f124c747bbefc3e65780c77ce
SHA256

bbd4dd21dde67a96ac02aa9795ce662fa36d4edb90d13f2ffbdeee0d4aea5050
SHA512

52b1b2f636d52c3653ed79654503a3483eacd69e2bb5552a432f222b446c3290c4afac1e786115ff9be75044022c2cee4766d50ed96aff26601613d217fb2fff

Score

10^/10

oski infostealer spyware stealer

Malware Config

Extracted

Family

oski

C2

vtqt.xyz

Signatures

Oski
Oski is an infostealer targeting browser data, crypto wallets.
infostealer oski
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1740 set thread context of 1660	1740	DFI_0451_587_032.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1036	1660	WerFault.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1740	DFI_0451_587_032.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1740	DFI_0451_587_032.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 1660	1740	DFI_0451_587_032.exe	28
PID 1740 wrote to memory of 1660	1740	DFI_0451_587_032.exe	28
PID 1740 wrote to memory of 1660	1740	DFI_0451_587_032.exe	28
PID 1740 wrote to memory of 1660	1740	DFI_0451_587_032.exe	28
PID 1740 wrote to memory of 1660	1740	DFI_0451_587_032.exe	28
PID 1740 wrote to memory of 1660	1740	DFI_0451_587_032.exe	28
PID 1740 wrote to memory of 1660	1740	DFI_0451_587_032.exe	28
PID 1740 wrote to memory of 1660	1740	DFI_0451_587_032.exe	28
PID 1740 wrote to memory of 1660	1740	DFI_0451_587_032.exe	28
PID 1740 wrote to memory of 1660	1740	DFI_0451_587_032.exe	28
PID 1660 wrote to memory of 1036	1660	DFI_0451_587_032.exe	32
PID 1660 wrote to memory of 1036	1660	DFI_0451_587_032.exe	32
PID 1660 wrote to memory of 1036	1660	DFI_0451_587_032.exe	32
PID 1660 wrote to memory of 1036	1660	DFI_0451_587_032.exe	32

C:\Users\Admin\AppData\Local\Temp\DFI_0451_587_032.exe
"C:\Users\Admin\AppData\Local\Temp\DFI_0451_587_032.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Users\Admin\AppData\Local\Temp\DFI_0451_587_032.exe
  C:\Users\Admin\AppData\Local\Temp\DFI_0451_587_032.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1660
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1660 -s 796
    3⤵
    - Program crash
    PID:1036

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1660-67-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1660-58-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1660-59-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1660-61-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1660-63-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1660-65-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1660-70-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1660-72-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1740-56-0x00000000003B0000-0x00000000003D2000-memory.dmp

Filesize
136KB

Download
memory/1740-57-0x0000000076531000-0x0000000076533000-memory.dmp

Filesize
8KB

Download
memory/1740-54-0x0000000001170000-0x00000000011D0000-memory.dmp

Filesize
384KB

Download
memory/1740-55-0x00000000001C0000-0x00000000001CA000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing