oski | 7e1fe76f273a5af1221edea44b386e3c2240d80a0577ef6ed8a1db7cb756c45c

General

Target

7e1fe76f273a5af1221edea44b386e3c2240d80a0577ef6ed8a1db7cb756c45c.exe
Size

502KB
MD5

73102502f0e548c16c740cbfeb6ce6c9
SHA1

19c33b9d9bbffde348cbf4dcb20005253e020775
SHA256

7e1fe76f273a5af1221edea44b386e3c2240d80a0577ef6ed8a1db7cb756c45c
SHA512

2636520d7f6500f3631a60d1f56f74546c84a4a34864fbfb2fcf0a5dd29a6565d5ef6c6b1e31e708f9b3cd4fe566fe3924f0f972372f39411ef691f3886c1863

Score

10^/10

oski infostealer spyware stealer

Malware Config

Extracted

Family

oski

C2

k6vq28tbjbz5rhjsgtm3gmsy.xyz

Signatures

Oski
Oski is an infostealer targeting browser data, crypto wallets.
infostealer oski
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1960 set thread context of 1832	1960	7e1fe76f273a5af1221edea44b386e3c2240d80a0577ef6ed8a1db7cb756c45c.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1964	1832	WerFault.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1960	7e1fe76f273a5af1221edea44b386e3c2240d80a0577ef6ed8a1db7cb756c45c.exe
1960	7e1fe76f273a5af1221edea44b386e3c2240d80a0577ef6ed8a1db7cb756c45c.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1960	7e1fe76f273a5af1221edea44b386e3c2240d80a0577ef6ed8a1db7cb756c45c.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 1832	1960	7e1fe76f273a5af1221edea44b386e3c2240d80a0577ef6ed8a1db7cb756c45c.exe	28
PID 1960 wrote to memory of 1832	1960	7e1fe76f273a5af1221edea44b386e3c2240d80a0577ef6ed8a1db7cb756c45c.exe	28
PID 1960 wrote to memory of 1832	1960	7e1fe76f273a5af1221edea44b386e3c2240d80a0577ef6ed8a1db7cb756c45c.exe	28
PID 1960 wrote to memory of 1832	1960	7e1fe76f273a5af1221edea44b386e3c2240d80a0577ef6ed8a1db7cb756c45c.exe	28
PID 1960 wrote to memory of 1832	1960	7e1fe76f273a5af1221edea44b386e3c2240d80a0577ef6ed8a1db7cb756c45c.exe	28
PID 1960 wrote to memory of 1832	1960	7e1fe76f273a5af1221edea44b386e3c2240d80a0577ef6ed8a1db7cb756c45c.exe	28
PID 1960 wrote to memory of 1832	1960	7e1fe76f273a5af1221edea44b386e3c2240d80a0577ef6ed8a1db7cb756c45c.exe	28
PID 1960 wrote to memory of 1832	1960	7e1fe76f273a5af1221edea44b386e3c2240d80a0577ef6ed8a1db7cb756c45c.exe	28
PID 1960 wrote to memory of 1832	1960	7e1fe76f273a5af1221edea44b386e3c2240d80a0577ef6ed8a1db7cb756c45c.exe	28
PID 1960 wrote to memory of 1832	1960	7e1fe76f273a5af1221edea44b386e3c2240d80a0577ef6ed8a1db7cb756c45c.exe	28
PID 1832 wrote to memory of 1964	1832	7e1fe76f273a5af1221edea44b386e3c2240d80a0577ef6ed8a1db7cb756c45c.exe	31
PID 1832 wrote to memory of 1964	1832	7e1fe76f273a5af1221edea44b386e3c2240d80a0577ef6ed8a1db7cb756c45c.exe	31
PID 1832 wrote to memory of 1964	1832	7e1fe76f273a5af1221edea44b386e3c2240d80a0577ef6ed8a1db7cb756c45c.exe	31
PID 1832 wrote to memory of 1964	1832	7e1fe76f273a5af1221edea44b386e3c2240d80a0577ef6ed8a1db7cb756c45c.exe	31

C:\Users\Admin\AppData\Local\Temp\7e1fe76f273a5af1221edea44b386e3c2240d80a0577ef6ed8a1db7cb756c45c.exe
"C:\Users\Admin\AppData\Local\Temp\7e1fe76f273a5af1221edea44b386e3c2240d80a0577ef6ed8a1db7cb756c45c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Users\Admin\AppData\Local\Temp\7e1fe76f273a5af1221edea44b386e3c2240d80a0577ef6ed8a1db7cb756c45c.exe
  "{path}"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1832
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1832 -s 760
    3⤵
    - Program crash
    PID:1964

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1832-57-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1832-68-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1832-65-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1832-63-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1832-61-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1832-59-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1832-56-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1832-70-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1960-54-0x0000000075381000-0x0000000075383000-memory.dmp

Filesize
8KB

Download
memory/1960-55-0x0000000074950000-0x0000000074EFB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing