oski | 0f95674881b43d8ef2847c7794b00bb4b4e0d94cb8f8099d0d5108d09303b9bf

General

Target

0021b817e1306a450e86beb8fd3eb204f027d193b317500739ebc38324f89b44.exe
Size

1.3MB
MD5

a66e0719560248b1c5a9cb1b28f66b41
SHA1

f77ed452781f5b60702c26a78249b667094dbe95
SHA256

0021b817e1306a450e86beb8fd3eb204f027d193b317500739ebc38324f89b44
SHA512

5d731685aac8a8a4bdf92854649a24cc24ea4bbb0a5339624b68d0476d47961fcdb47dbbf1e64c7606a78a1d7adec57aa32feb98b157cfe7615462784d7bf9b5

Score

10^/10

oski infostealer suricata

Malware Config

Extracted

Family

oski

C2

chika1992.xyz

Signatures

Oski
Oski is an infostealer targeting browser data, crypto wallets.
infostealer oski
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern
suricata

Suspicious use of SetThreadContext 1 IoCs

Processes:

0021b817e1306a450e86beb8fd3eb204f027d193b317500739ebc38324f89b44.exe

description	pid	process	target process
PID 960 set thread context of 744	960	0021b817e1306a450e86beb8fd3eb204f027d193b317500739ebc38324f89b44.exe	0021b817e1306a450e86beb8fd3eb204f027d193b317500739ebc38324f89b44.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

0021b817e1306a450e86beb8fd3eb204f027d193b317500739ebc38324f89b44.exe

description	pid	process	target process
PID 960 wrote to memory of 744	960	0021b817e1306a450e86beb8fd3eb204f027d193b317500739ebc38324f89b44.exe	0021b817e1306a450e86beb8fd3eb204f027d193b317500739ebc38324f89b44.exe
PID 960 wrote to memory of 744	960	0021b817e1306a450e86beb8fd3eb204f027d193b317500739ebc38324f89b44.exe	0021b817e1306a450e86beb8fd3eb204f027d193b317500739ebc38324f89b44.exe
PID 960 wrote to memory of 744	960	0021b817e1306a450e86beb8fd3eb204f027d193b317500739ebc38324f89b44.exe	0021b817e1306a450e86beb8fd3eb204f027d193b317500739ebc38324f89b44.exe
PID 960 wrote to memory of 744	960	0021b817e1306a450e86beb8fd3eb204f027d193b317500739ebc38324f89b44.exe	0021b817e1306a450e86beb8fd3eb204f027d193b317500739ebc38324f89b44.exe
PID 960 wrote to memory of 744	960	0021b817e1306a450e86beb8fd3eb204f027d193b317500739ebc38324f89b44.exe	0021b817e1306a450e86beb8fd3eb204f027d193b317500739ebc38324f89b44.exe
PID 960 wrote to memory of 744	960	0021b817e1306a450e86beb8fd3eb204f027d193b317500739ebc38324f89b44.exe	0021b817e1306a450e86beb8fd3eb204f027d193b317500739ebc38324f89b44.exe
PID 960 wrote to memory of 744	960	0021b817e1306a450e86beb8fd3eb204f027d193b317500739ebc38324f89b44.exe	0021b817e1306a450e86beb8fd3eb204f027d193b317500739ebc38324f89b44.exe
PID 960 wrote to memory of 744	960	0021b817e1306a450e86beb8fd3eb204f027d193b317500739ebc38324f89b44.exe	0021b817e1306a450e86beb8fd3eb204f027d193b317500739ebc38324f89b44.exe
PID 960 wrote to memory of 744	960	0021b817e1306a450e86beb8fd3eb204f027d193b317500739ebc38324f89b44.exe	0021b817e1306a450e86beb8fd3eb204f027d193b317500739ebc38324f89b44.exe
PID 960 wrote to memory of 744	960	0021b817e1306a450e86beb8fd3eb204f027d193b317500739ebc38324f89b44.exe	0021b817e1306a450e86beb8fd3eb204f027d193b317500739ebc38324f89b44.exe

C:\Users\Admin\AppData\Local\Temp\0021b817e1306a450e86beb8fd3eb204f027d193b317500739ebc38324f89b44.exe
"C:\Users\Admin\AppData\Local\Temp\0021b817e1306a450e86beb8fd3eb204f027d193b317500739ebc38324f89b44.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:960

C:\Users\Admin\AppData\Local\Temp\0021b817e1306a450e86beb8fd3eb204f027d193b317500739ebc38324f89b44.exe
"C:\Users\Admin\AppData\Local\Temp\0021b817e1306a450e86beb8fd3eb204f027d193b317500739ebc38324f89b44.exe"
2⤵
PID:744

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/744-72-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/744-91-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/744-84-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/744-82-0x000000000040717B-mapping.dmp

Download
memory/744-81-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/744-79-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/744-77-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/744-75-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/744-73-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/960-62-0x0000000070E70000-0x0000000070F6C000-memory.dmp

Filesize
1008KB

Download
memory/960-61-0x0000000070F70000-0x0000000071C8D000-memory.dmp

Filesize
13.1MB

Download
memory/960-65-0x0000000000840000-0x0000000000854000-memory.dmp

Filesize
80KB

Download
memory/960-66-0x0000000072A20000-0x0000000073DAF000-memory.dmp

Filesize
19.6MB

Download
memory/960-67-0x0000000071E30000-0x0000000072001000-memory.dmp

Filesize
1.8MB

Download
memory/960-68-0x0000000071C90000-0x0000000071E24000-memory.dmp

Filesize
1.6MB

Download
memory/960-69-0x0000000070F70000-0x0000000071C8D000-memory.dmp

Filesize
13.1MB

Download
memory/960-70-0x0000000005580000-0x000000000562E000-memory.dmp

Filesize
696KB

Download
memory/960-71-0x0000000005630000-0x00000000056B4000-memory.dmp

Filesize
528KB

Download
memory/960-63-0x00000000705D0000-0x0000000070699000-memory.dmp

Filesize
804KB

Download
memory/960-54-0x0000000000CC0000-0x0000000000E08000-memory.dmp

Filesize
1.3MB

Download
memory/960-64-0x0000000070730000-0x0000000070E6E000-memory.dmp

Filesize
7.2MB

Download
memory/960-60-0x0000000071C90000-0x0000000071E24000-memory.dmp

Filesize
1.6MB

Download
memory/960-59-0x0000000071E30000-0x0000000072001000-memory.dmp

Filesize
1.8MB

Download
memory/960-58-0x00000000740D0000-0x00000000748B0000-memory.dmp

Filesize
7.9MB

Download
memory/960-57-0x0000000072010000-0x0000000072A20000-memory.dmp

Filesize
10.1MB

Download
memory/960-56-0x0000000072A20000-0x0000000073DAF000-memory.dmp

Filesize
19.6MB

Download
memory/960-86-0x0000000072010000-0x0000000072A20000-memory.dmp

Filesize
10.1MB

Download
memory/960-87-0x0000000071E30000-0x0000000072001000-memory.dmp

Filesize
1.8MB

Download
memory/960-88-0x0000000071C90000-0x0000000071E24000-memory.dmp

Filesize
1.6MB

Download
memory/960-89-0x0000000070F70000-0x0000000071C8D000-memory.dmp

Filesize
13.1MB

Download
memory/960-90-0x0000000072A20000-0x0000000073DAF000-memory.dmp

Filesize
19.6MB

Download
memory/960-55-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing