oski | 0f95674881b43d8ef2847c7794b00bb4b4e0d94cb8f8099d0d5108d09303b9bf

Analysis

Target

0021b817e1306a450e86beb8fd3eb204f027d193b317500739ebc38324f89b44.exe
Size

1.3MB
MD5

a66e0719560248b1c5a9cb1b28f66b41
SHA1

f77ed452781f5b60702c26a78249b667094dbe95
SHA256

0021b817e1306a450e86beb8fd3eb204f027d193b317500739ebc38324f89b44
SHA512

5d731685aac8a8a4bdf92854649a24cc24ea4bbb0a5339624b68d0476d47961fcdb47dbbf1e64c7606a78a1d7adec57aa32feb98b157cfe7615462784d7bf9b5

Score

10^/10

Family

oski

chika1992.xyz

Oski
Oski is an infostealer targeting browser data, crypto wallets.
infostealer oski
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern
suricata

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4160 set thread context of 3388	4160	0021b817e1306a450e86beb8fd3eb204f027d193b317500739ebc38324f89b44.exe	83

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4160 wrote to memory of 3388	4160	0021b817e1306a450e86beb8fd3eb204f027d193b317500739ebc38324f89b44.exe	83
PID 4160 wrote to memory of 3388	4160	0021b817e1306a450e86beb8fd3eb204f027d193b317500739ebc38324f89b44.exe	83
PID 4160 wrote to memory of 3388	4160	0021b817e1306a450e86beb8fd3eb204f027d193b317500739ebc38324f89b44.exe	83
PID 4160 wrote to memory of 3388	4160	0021b817e1306a450e86beb8fd3eb204f027d193b317500739ebc38324f89b44.exe	83
PID 4160 wrote to memory of 3388	4160	0021b817e1306a450e86beb8fd3eb204f027d193b317500739ebc38324f89b44.exe	83
PID 4160 wrote to memory of 3388	4160	0021b817e1306a450e86beb8fd3eb204f027d193b317500739ebc38324f89b44.exe	83
PID 4160 wrote to memory of 3388	4160	0021b817e1306a450e86beb8fd3eb204f027d193b317500739ebc38324f89b44.exe	83
PID 4160 wrote to memory of 3388	4160	0021b817e1306a450e86beb8fd3eb204f027d193b317500739ebc38324f89b44.exe	83
PID 4160 wrote to memory of 3388	4160	0021b817e1306a450e86beb8fd3eb204f027d193b317500739ebc38324f89b44.exe	83

C:\Users\Admin\AppData\Local\Temp\0021b817e1306a450e86beb8fd3eb204f027d193b317500739ebc38324f89b44.exe
"C:\Users\Admin\AppData\Local\Temp\0021b817e1306a450e86beb8fd3eb204f027d193b317500739ebc38324f89b44.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4160
- C:\Users\Admin\AppData\Local\Temp\0021b817e1306a450e86beb8fd3eb204f027d193b317500739ebc38324f89b44.exe
  "C:\Users\Admin\AppData\Local\Temp\0021b817e1306a450e86beb8fd3eb204f027d193b317500739ebc38324f89b44.exe"
  2⤵
  PID:3388

memory/3388-137-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3388-138-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3388-139-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3388-140-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4160-130-0x0000000000600000-0x0000000000748000-memory.dmp

Filesize
1.3MB

Download
memory/4160-131-0x0000000004F70000-0x000000000500C000-memory.dmp

Filesize
624KB

Download
memory/4160-132-0x0000000005680000-0x0000000005C24000-memory.dmp

Filesize
5.6MB

Download
memory/4160-133-0x00000000050D0000-0x0000000005162000-memory.dmp

Filesize
584KB

Download
memory/4160-134-0x0000000005040000-0x000000000504A000-memory.dmp

Filesize
40KB

Download
memory/4160-135-0x00000000052C0000-0x0000000005316000-memory.dmp

Filesize
344KB

Download