oski | 42745214d98c128bbc0ffcbe666bb45738aef6ef725c04c05aa77aa32b3759bf

General

Target

1c53cbedc20ce9cf5b5e69fac6211133faa197f85b214a865f71cf4e0879dd99.exe
Size

598KB
MD5

9f8456f6d52c0afbbbb4600c383c051a
SHA1

f38291c94071200290251937b091a3ac0565c00f
SHA256

1c53cbedc20ce9cf5b5e69fac6211133faa197f85b214a865f71cf4e0879dd99
SHA512

925fcaf9fce9aa844ad16ab180dc5d476c9f3bd0025afba20d6ff6895c341696491fcd4b07ba923b221b9ba113c800fd3fb45e17eab7ac0b4229415714d72ead

Score

10^/10

oski infostealer spyware stealer

Malware Config

Extracted

Family

oski

C2

st4q2p.xyz

Signatures

Oski
Oski is an infostealer targeting browser data, crypto wallets.
infostealer oski
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

Processes:

1c53cbedc20ce9cf5b5e69fac6211133faa197f85b214a865f71cf4e0879dd99.exe

description	pid	process	target process
PID 556 set thread context of 1520	556	1c53cbedc20ce9cf5b5e69fac6211133faa197f85b214a865f71cf4e0879dd99.exe	1c53cbedc20ce9cf5b5e69fac6211133faa197f85b214a865f71cf4e0879dd99.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1176 1520 WerFault.exe 1c53cbedc20ce9cf5b5e69fac6211133faa197f85b214a865f71cf4e0879dd99.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1652 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

1c53cbedc20ce9cf5b5e69fac6211133faa197f85b214a865f71cf4e0879dd99.exe

pid process

556 1c53cbedc20ce9cf5b5e69fac6211133faa197f85b214a865f71cf4e0879dd99.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

1c53cbedc20ce9cf5b5e69fac6211133faa197f85b214a865f71cf4e0879dd99.exe

description pid process

Token: SeDebugPrivilege 556 1c53cbedc20ce9cf5b5e69fac6211133faa197f85b214a865f71cf4e0879dd99.exe

pid	pid_target	process	target process
1176	1520	WerFault.exe	1c53cbedc20ce9cf5b5e69fac6211133faa197f85b214a865f71cf4e0879dd99.exe

pid	process
1652	schtasks.exe

pid	process
556	1c53cbedc20ce9cf5b5e69fac6211133faa197f85b214a865f71cf4e0879dd99.exe

description	pid	process
Token: SeDebugPrivilege	556	1c53cbedc20ce9cf5b5e69fac6211133faa197f85b214a865f71cf4e0879dd99.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

1c53cbedc20ce9cf5b5e69fac6211133faa197f85b214a865f71cf4e0879dd99.exe1c53cbedc20ce9cf5b5e69fac6211133faa197f85b214a865f71cf4e0879dd99.exe

description	pid	process	target process
PID 556 wrote to memory of 1652	556	1c53cbedc20ce9cf5b5e69fac6211133faa197f85b214a865f71cf4e0879dd99.exe	schtasks.exe
PID 556 wrote to memory of 1652	556	1c53cbedc20ce9cf5b5e69fac6211133faa197f85b214a865f71cf4e0879dd99.exe	schtasks.exe
PID 556 wrote to memory of 1652	556	1c53cbedc20ce9cf5b5e69fac6211133faa197f85b214a865f71cf4e0879dd99.exe	schtasks.exe
PID 556 wrote to memory of 1652	556	1c53cbedc20ce9cf5b5e69fac6211133faa197f85b214a865f71cf4e0879dd99.exe	schtasks.exe
PID 556 wrote to memory of 1520	556	1c53cbedc20ce9cf5b5e69fac6211133faa197f85b214a865f71cf4e0879dd99.exe	1c53cbedc20ce9cf5b5e69fac6211133faa197f85b214a865f71cf4e0879dd99.exe
PID 556 wrote to memory of 1520	556	1c53cbedc20ce9cf5b5e69fac6211133faa197f85b214a865f71cf4e0879dd99.exe	1c53cbedc20ce9cf5b5e69fac6211133faa197f85b214a865f71cf4e0879dd99.exe
PID 556 wrote to memory of 1520	556	1c53cbedc20ce9cf5b5e69fac6211133faa197f85b214a865f71cf4e0879dd99.exe	1c53cbedc20ce9cf5b5e69fac6211133faa197f85b214a865f71cf4e0879dd99.exe
PID 556 wrote to memory of 1520	556	1c53cbedc20ce9cf5b5e69fac6211133faa197f85b214a865f71cf4e0879dd99.exe	1c53cbedc20ce9cf5b5e69fac6211133faa197f85b214a865f71cf4e0879dd99.exe
PID 556 wrote to memory of 1520	556	1c53cbedc20ce9cf5b5e69fac6211133faa197f85b214a865f71cf4e0879dd99.exe	1c53cbedc20ce9cf5b5e69fac6211133faa197f85b214a865f71cf4e0879dd99.exe
PID 556 wrote to memory of 1520	556	1c53cbedc20ce9cf5b5e69fac6211133faa197f85b214a865f71cf4e0879dd99.exe	1c53cbedc20ce9cf5b5e69fac6211133faa197f85b214a865f71cf4e0879dd99.exe
PID 556 wrote to memory of 1520	556	1c53cbedc20ce9cf5b5e69fac6211133faa197f85b214a865f71cf4e0879dd99.exe	1c53cbedc20ce9cf5b5e69fac6211133faa197f85b214a865f71cf4e0879dd99.exe
PID 556 wrote to memory of 1520	556	1c53cbedc20ce9cf5b5e69fac6211133faa197f85b214a865f71cf4e0879dd99.exe	1c53cbedc20ce9cf5b5e69fac6211133faa197f85b214a865f71cf4e0879dd99.exe
PID 556 wrote to memory of 1520	556	1c53cbedc20ce9cf5b5e69fac6211133faa197f85b214a865f71cf4e0879dd99.exe	1c53cbedc20ce9cf5b5e69fac6211133faa197f85b214a865f71cf4e0879dd99.exe
PID 556 wrote to memory of 1520	556	1c53cbedc20ce9cf5b5e69fac6211133faa197f85b214a865f71cf4e0879dd99.exe	1c53cbedc20ce9cf5b5e69fac6211133faa197f85b214a865f71cf4e0879dd99.exe
PID 1520 wrote to memory of 1176	1520	1c53cbedc20ce9cf5b5e69fac6211133faa197f85b214a865f71cf4e0879dd99.exe	WerFault.exe
PID 1520 wrote to memory of 1176	1520	1c53cbedc20ce9cf5b5e69fac6211133faa197f85b214a865f71cf4e0879dd99.exe	WerFault.exe
PID 1520 wrote to memory of 1176	1520	1c53cbedc20ce9cf5b5e69fac6211133faa197f85b214a865f71cf4e0879dd99.exe	WerFault.exe
PID 1520 wrote to memory of 1176	1520	1c53cbedc20ce9cf5b5e69fac6211133faa197f85b214a865f71cf4e0879dd99.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\1c53cbedc20ce9cf5b5e69fac6211133faa197f85b214a865f71cf4e0879dd99.exe
"C:\Users\Admin\AppData\Local\Temp\1c53cbedc20ce9cf5b5e69fac6211133faa197f85b214a865f71cf4e0879dd99.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:556

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LlAcqqDPnbTr" /XML "C:\Users\Admin\AppData\Local\Temp\tmp715A.tmp"
2⤵
- Creates scheduled task(s)
PID:1652

C:\Users\Admin\AppData\Local\Temp\1c53cbedc20ce9cf5b5e69fac6211133faa197f85b214a865f71cf4e0879dd99.exe
"{path}"
2⤵
- Suspicious use of WriteProcessMemory
PID:1520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 788
3⤵
- Program crash
PID:1176

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp715A.tmp
Filesize
1KB

MD5
1452564ec4a86f1ae88c40217e224313

SHA1
891a54c7125c23aca5e2ea09cdeeb13e5b50c6e6

SHA256
9a1cab3e410a2ef0455617593801adfa2367771fcb3106e021d1ba2d37b1f114

SHA512
d507c98da96ea1462823080c28b3bd390488751e37e8c02dfc71cbb9d40cad2e2ccdf1e280b8e165793c5641c2784f369a4125de058d2baa50df1a913e584f58

Download Submit
memory/556-70-0x0000000005F60000-0x0000000005FE6000-memory.dmp

Filesize
536KB

Download
memory/556-62-0x0000000074130000-0x0000000074301000-memory.dmp

Filesize
1.8MB

Download
memory/556-57-0x0000000071CB0000-0x00000000726C0000-memory.dmp

Filesize
10.1MB

Download
memory/556-58-0x00000000743A0000-0x0000000074534000-memory.dmp

Filesize
1.6MB

Download
memory/556-71-0x0000000000C10000-0x0000000000C48000-memory.dmp

Filesize
224KB

Download
memory/556-60-0x0000000000390000-0x000000000039A000-memory.dmp

Filesize
40KB

Download
memory/556-61-0x00000000707B0000-0x0000000070F90000-memory.dmp

Filesize
7.9MB

Download
memory/556-93-0x0000000074130000-0x0000000074301000-memory.dmp

Filesize
1.8MB

Download
memory/556-63-0x0000000074010000-0x000000007410C000-memory.dmp

Filesize
1008KB

Download
memory/556-55-0x00000000755C1000-0x00000000755C3000-memory.dmp

Filesize
8KB

Download
memory/556-65-0x00000000726C0000-0x0000000073A4F000-memory.dmp

Filesize
19.6MB

Download
memory/556-66-0x0000000071CB0000-0x00000000726C0000-memory.dmp

Filesize
10.1MB

Download
memory/556-67-0x00000000743A0000-0x0000000074534000-memory.dmp

Filesize
1.6MB

Download
memory/556-68-0x0000000070F90000-0x0000000071CAD000-memory.dmp

Filesize
13.1MB

Download
memory/556-69-0x00000000707B0000-0x0000000070F90000-memory.dmp

Filesize
7.9MB

Download
memory/556-54-0x0000000001230000-0x00000000012CC000-memory.dmp

Filesize
624KB

Download
memory/556-59-0x0000000070F90000-0x0000000071CAD000-memory.dmp

Filesize
13.1MB

Download
memory/556-56-0x00000000726C0000-0x0000000073A4F000-memory.dmp

Filesize
19.6MB

Download
memory/556-64-0x0000000070070000-0x00000000707AE000-memory.dmp

Filesize
7.2MB

Download
memory/556-92-0x0000000070F90000-0x0000000071CAD000-memory.dmp

Filesize
13.1MB

Download
memory/556-91-0x00000000743A0000-0x0000000074534000-memory.dmp

Filesize
1.6MB

Download
memory/556-90-0x0000000071CB0000-0x00000000726C0000-memory.dmp

Filesize
10.1MB

Download
memory/556-89-0x00000000726C0000-0x0000000073A4F000-memory.dmp

Filesize
19.6MB

Download
memory/1176-94-0x0000000000000000-mapping.dmp

Download
memory/1520-81-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1520-83-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1520-84-0x000000000040717B-mapping.dmp

Download
memory/1520-86-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1520-88-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1520-79-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1520-77-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1520-75-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1520-74-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1652-72-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads