oski | 64d7ba13bf3e525fc99988f742b751c9df4431af7b26a7d6cdb3191218648517

General

Target

64d7ba13bf3e525fc99988f742b751c9df4431af7b26a7d6cdb3191218648517.exe
Size

577KB
MD5

09f6231385ef6659c6045853e12b5b47
SHA1

b7ce7064240b7993ce3aa0918ddacd8581c9a4c3
SHA256

64d7ba13bf3e525fc99988f742b751c9df4431af7b26a7d6cdb3191218648517
SHA512

6aff026b1cf30874a2c0b71fdef8d2dad572998ff75da37608c62c51cf7b093492e123dcda599edf433cc66d14146af49cdca02a0ca76d56da1f5b3813932b59

Score

10^/10

oski infostealer spyware stealer

Malware Config

Extracted

Family

oski

C2

ggtyyu.pw

Signatures

Oski
Oski is an infostealer targeting browser data, crypto wallets.
infostealer oski
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3448 set thread context of 3636	3448	64d7ba13bf3e525fc99988f742b751c9df4431af7b26a7d6cdb3191218648517.exe	84

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4396	3636	WerFault.exe	84

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3448	64d7ba13bf3e525fc99988f742b751c9df4431af7b26a7d6cdb3191218648517.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3448 wrote to memory of 3636	3448	64d7ba13bf3e525fc99988f742b751c9df4431af7b26a7d6cdb3191218648517.exe	84
PID 3448 wrote to memory of 3636	3448	64d7ba13bf3e525fc99988f742b751c9df4431af7b26a7d6cdb3191218648517.exe	84
PID 3448 wrote to memory of 3636	3448	64d7ba13bf3e525fc99988f742b751c9df4431af7b26a7d6cdb3191218648517.exe	84
PID 3448 wrote to memory of 3636	3448	64d7ba13bf3e525fc99988f742b751c9df4431af7b26a7d6cdb3191218648517.exe	84
PID 3448 wrote to memory of 3636	3448	64d7ba13bf3e525fc99988f742b751c9df4431af7b26a7d6cdb3191218648517.exe	84
PID 3448 wrote to memory of 3636	3448	64d7ba13bf3e525fc99988f742b751c9df4431af7b26a7d6cdb3191218648517.exe	84
PID 3448 wrote to memory of 3636	3448	64d7ba13bf3e525fc99988f742b751c9df4431af7b26a7d6cdb3191218648517.exe	84
PID 3448 wrote to memory of 3636	3448	64d7ba13bf3e525fc99988f742b751c9df4431af7b26a7d6cdb3191218648517.exe	84
PID 3448 wrote to memory of 3636	3448	64d7ba13bf3e525fc99988f742b751c9df4431af7b26a7d6cdb3191218648517.exe	84
PID 3448 wrote to memory of 3636	3448	64d7ba13bf3e525fc99988f742b751c9df4431af7b26a7d6cdb3191218648517.exe	84

C:\Users\Admin\AppData\Local\Temp\64d7ba13bf3e525fc99988f742b751c9df4431af7b26a7d6cdb3191218648517.exe
"C:\Users\Admin\AppData\Local\Temp\64d7ba13bf3e525fc99988f742b751c9df4431af7b26a7d6cdb3191218648517.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3448
- C:\Users\Admin\AppData\Local\Temp\64d7ba13bf3e525fc99988f742b751c9df4431af7b26a7d6cdb3191218648517.exe
  "C:\Users\Admin\AppData\Local\Temp\64d7ba13bf3e525fc99988f742b751c9df4431af7b26a7d6cdb3191218648517.exe"
  2⤵
  PID:3636
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3636 -s 1292
    3⤵
    - Program crash
    PID:4396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3636 -ip 3636
1⤵
PID:1224

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3448-130-0x0000000000B20000-0x0000000000BB4000-memory.dmp

Filesize
592KB

Download
memory/3448-132-0x00000000056E0000-0x0000000005772000-memory.dmp

Filesize
584KB

Download
memory/3448-131-0x000000000A1F0000-0x000000000A794000-memory.dmp

Filesize
5.6MB

Download
memory/3448-133-0x00000000056A0000-0x00000000056AA000-memory.dmp

Filesize
40KB

Download
memory/3448-137-0x0000000007C20000-0x0000000007CBC000-memory.dmp

Filesize
624KB

Download
memory/3636-135-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/3636-136-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/3636-138-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/3636-139-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download

Analysis

Sharing