oski | c5c067473ed4bdd85dcd133a73a5423971d2f8da5c63490ec0a8b774d7b341fc

Analysis

Target

c5c067473ed4bdd85dcd133a73a5423971d2f8da5c63490ec0a8b774d7b341fc.exe
Size

1.2MB
MD5

a1ff7975810b6a9bf046f6a4782bc934
SHA1

e60b9301d29f640f8eb671d97fd63e2eb3298eca
SHA256

c5c067473ed4bdd85dcd133a73a5423971d2f8da5c63490ec0a8b774d7b341fc
SHA512

a9be74ada359a353eaa0d73529abb7d9db564b93e165f2f9bce7ab5e52d09a2a3a515860f6c950a71d86d5616c1e6f69ca3d00d155ce68e90777e9c91662be7b

Score

10^/10

oski infostealer

Oski
Oski is an infostealer targeting browser data, crypto wallets.
infostealer oski

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5056 set thread context of 3696	5056	c5c067473ed4bdd85dcd133a73a5423971d2f8da5c63490ec0a8b774d7b341fc.exe	62

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
5056	c5c067473ed4bdd85dcd133a73a5423971d2f8da5c63490ec0a8b774d7b341fc.exe
5056	c5c067473ed4bdd85dcd133a73a5423971d2f8da5c63490ec0a8b774d7b341fc.exe
5056	c5c067473ed4bdd85dcd133a73a5423971d2f8da5c63490ec0a8b774d7b341fc.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
5056	c5c067473ed4bdd85dcd133a73a5423971d2f8da5c63490ec0a8b774d7b341fc.exe
5056	c5c067473ed4bdd85dcd133a73a5423971d2f8da5c63490ec0a8b774d7b341fc.exe
5056	c5c067473ed4bdd85dcd133a73a5423971d2f8da5c63490ec0a8b774d7b341fc.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5056 wrote to memory of 3696	5056	c5c067473ed4bdd85dcd133a73a5423971d2f8da5c63490ec0a8b774d7b341fc.exe	62
PID 5056 wrote to memory of 3696	5056	c5c067473ed4bdd85dcd133a73a5423971d2f8da5c63490ec0a8b774d7b341fc.exe	62
PID 5056 wrote to memory of 3696	5056	c5c067473ed4bdd85dcd133a73a5423971d2f8da5c63490ec0a8b774d7b341fc.exe	62
PID 5056 wrote to memory of 3696	5056	c5c067473ed4bdd85dcd133a73a5423971d2f8da5c63490ec0a8b774d7b341fc.exe	62
PID 5056 wrote to memory of 3696	5056	c5c067473ed4bdd85dcd133a73a5423971d2f8da5c63490ec0a8b774d7b341fc.exe	62

C:\Users\Admin\AppData\Local\Temp\c5c067473ed4bdd85dcd133a73a5423971d2f8da5c63490ec0a8b774d7b341fc.exe
"C:\Users\Admin\AppData\Local\Temp\c5c067473ed4bdd85dcd133a73a5423971d2f8da5c63490ec0a8b774d7b341fc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5056
- C:\Users\Admin\AppData\Local\Temp\c5c067473ed4bdd85dcd133a73a5423971d2f8da5c63490ec0a8b774d7b341fc.exe
  "C:\Users\Admin\AppData\Local\Temp\c5c067473ed4bdd85dcd133a73a5423971d2f8da5c63490ec0a8b774d7b341fc.exe"
  2⤵
  PID:3696

memory/3696-131-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3696-138-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/5056-137-0x00000000026C0000-0x00000000026ED000-memory.dmp

Filesize
180KB

Download