oski | 64d7ba13bf3e525fc99988f742b751c9df4431af7b26a7d6cdb3191218648517

General

Target

64d7ba13bf3e525fc99988f742b751c9df4431af7b26a7d6cdb3191218648517.exe
Size

577KB
MD5

09f6231385ef6659c6045853e12b5b47
SHA1

b7ce7064240b7993ce3aa0918ddacd8581c9a4c3
SHA256

64d7ba13bf3e525fc99988f742b751c9df4431af7b26a7d6cdb3191218648517
SHA512

6aff026b1cf30874a2c0b71fdef8d2dad572998ff75da37608c62c51cf7b093492e123dcda599edf433cc66d14146af49cdca02a0ca76d56da1f5b3813932b59

Score

10^/10

oski infostealer spyware stealer

Malware Config

Extracted

Family

oski

C2

ggtyyu.pw

Signatures

Oski
Oski is an infostealer targeting browser data, crypto wallets.
infostealer oski
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1080 set thread context of 1392	1080	64d7ba13bf3e525fc99988f742b751c9df4431af7b26a7d6cdb3191218648517.exe	27

Program crash 1 IoCs

pid	pid_target	Process	procid_target
704	1392	WerFault.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1080	64d7ba13bf3e525fc99988f742b751c9df4431af7b26a7d6cdb3191218648517.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1080 wrote to memory of 1392	1080	64d7ba13bf3e525fc99988f742b751c9df4431af7b26a7d6cdb3191218648517.exe	27
PID 1080 wrote to memory of 1392	1080	64d7ba13bf3e525fc99988f742b751c9df4431af7b26a7d6cdb3191218648517.exe	27
PID 1080 wrote to memory of 1392	1080	64d7ba13bf3e525fc99988f742b751c9df4431af7b26a7d6cdb3191218648517.exe	27
PID 1080 wrote to memory of 1392	1080	64d7ba13bf3e525fc99988f742b751c9df4431af7b26a7d6cdb3191218648517.exe	27
PID 1080 wrote to memory of 1392	1080	64d7ba13bf3e525fc99988f742b751c9df4431af7b26a7d6cdb3191218648517.exe	27
PID 1080 wrote to memory of 1392	1080	64d7ba13bf3e525fc99988f742b751c9df4431af7b26a7d6cdb3191218648517.exe	27
PID 1080 wrote to memory of 1392	1080	64d7ba13bf3e525fc99988f742b751c9df4431af7b26a7d6cdb3191218648517.exe	27
PID 1080 wrote to memory of 1392	1080	64d7ba13bf3e525fc99988f742b751c9df4431af7b26a7d6cdb3191218648517.exe	27
PID 1080 wrote to memory of 1392	1080	64d7ba13bf3e525fc99988f742b751c9df4431af7b26a7d6cdb3191218648517.exe	27
PID 1080 wrote to memory of 1392	1080	64d7ba13bf3e525fc99988f742b751c9df4431af7b26a7d6cdb3191218648517.exe	27
PID 1080 wrote to memory of 1392	1080	64d7ba13bf3e525fc99988f742b751c9df4431af7b26a7d6cdb3191218648517.exe	27
PID 1392 wrote to memory of 704	1392	64d7ba13bf3e525fc99988f742b751c9df4431af7b26a7d6cdb3191218648517.exe	31
PID 1392 wrote to memory of 704	1392	64d7ba13bf3e525fc99988f742b751c9df4431af7b26a7d6cdb3191218648517.exe	31
PID 1392 wrote to memory of 704	1392	64d7ba13bf3e525fc99988f742b751c9df4431af7b26a7d6cdb3191218648517.exe	31
PID 1392 wrote to memory of 704	1392	64d7ba13bf3e525fc99988f742b751c9df4431af7b26a7d6cdb3191218648517.exe	31

C:\Users\Admin\AppData\Local\Temp\64d7ba13bf3e525fc99988f742b751c9df4431af7b26a7d6cdb3191218648517.exe
"C:\Users\Admin\AppData\Local\Temp\64d7ba13bf3e525fc99988f742b751c9df4431af7b26a7d6cdb3191218648517.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Users\Admin\AppData\Local\Temp\64d7ba13bf3e525fc99988f742b751c9df4431af7b26a7d6cdb3191218648517.exe
  "C:\Users\Admin\AppData\Local\Temp\64d7ba13bf3e525fc99988f742b751c9df4431af7b26a7d6cdb3191218648517.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1392
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1392 -s 788
    3⤵
    - Program crash
    PID:704

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1080-54-0x00000000013B0000-0x0000000001444000-memory.dmp

Filesize
592KB

Download
memory/1080-55-0x0000000000C20000-0x0000000000CA4000-memory.dmp

Filesize
528KB

Download
memory/1080-56-0x00000000752D1000-0x00000000752D3000-memory.dmp

Filesize
8KB

Download
memory/1080-57-0x0000000000320000-0x000000000033A000-memory.dmp

Filesize
104KB

Download
memory/1392-61-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/1392-59-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/1392-63-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/1392-65-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/1392-67-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/1392-69-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/1392-72-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/1392-74-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/1392-58-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download

Analysis

Sharing