oski | 4c51a9f2c247d7a7d027a9b5a440f7cbe1a7d85b23f5d2a803f6548e4f7100c5

General

Target

0e99aef5608c3357e1425734aad75eaff3d241c1676d5af60cd3c9c43dd1441f.exe
Size

1.2MB
MD5

61bca80732c3e682e00fb4bd8c48d52b
SHA1

f32a21133c750d1c26e412b305b32110d281a981
SHA256

0e99aef5608c3357e1425734aad75eaff3d241c1676d5af60cd3c9c43dd1441f
SHA512

498efd615df973793d222bf55573499199b6c1d775b58a0c0c6eb2b94eb8234f6c263156c651e5084eede2bf6d0589500fc375c16728d32ef324be4eb354bca1

Score

10^/10

oski infostealer

Family

oski

C2

ibroot.com

Oski
Oski is an infostealer targeting browser data, crypto wallets.
infostealer oski

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4064 set thread context of 4444	4064	0e99aef5608c3357e1425734aad75eaff3d241c1676d5af60cd3c9c43dd1441f.exe	79

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1016	4444	WerFault.exe	79

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4064	0e99aef5608c3357e1425734aad75eaff3d241c1676d5af60cd3c9c43dd1441f.exe
4064	0e99aef5608c3357e1425734aad75eaff3d241c1676d5af60cd3c9c43dd1441f.exe
4064	0e99aef5608c3357e1425734aad75eaff3d241c1676d5af60cd3c9c43dd1441f.exe
4064	0e99aef5608c3357e1425734aad75eaff3d241c1676d5af60cd3c9c43dd1441f.exe
4064	0e99aef5608c3357e1425734aad75eaff3d241c1676d5af60cd3c9c43dd1441f.exe
4064	0e99aef5608c3357e1425734aad75eaff3d241c1676d5af60cd3c9c43dd1441f.exe
4064	0e99aef5608c3357e1425734aad75eaff3d241c1676d5af60cd3c9c43dd1441f.exe
4064	0e99aef5608c3357e1425734aad75eaff3d241c1676d5af60cd3c9c43dd1441f.exe
4064	0e99aef5608c3357e1425734aad75eaff3d241c1676d5af60cd3c9c43dd1441f.exe
4064	0e99aef5608c3357e1425734aad75eaff3d241c1676d5af60cd3c9c43dd1441f.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4064	0e99aef5608c3357e1425734aad75eaff3d241c1676d5af60cd3c9c43dd1441f.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4064 wrote to memory of 4444	4064	0e99aef5608c3357e1425734aad75eaff3d241c1676d5af60cd3c9c43dd1441f.exe	79
PID 4064 wrote to memory of 4444	4064	0e99aef5608c3357e1425734aad75eaff3d241c1676d5af60cd3c9c43dd1441f.exe	79
PID 4064 wrote to memory of 4444	4064	0e99aef5608c3357e1425734aad75eaff3d241c1676d5af60cd3c9c43dd1441f.exe	79
PID 4064 wrote to memory of 4444	4064	0e99aef5608c3357e1425734aad75eaff3d241c1676d5af60cd3c9c43dd1441f.exe	79
PID 4064 wrote to memory of 4444	4064	0e99aef5608c3357e1425734aad75eaff3d241c1676d5af60cd3c9c43dd1441f.exe	79
PID 4064 wrote to memory of 4444	4064	0e99aef5608c3357e1425734aad75eaff3d241c1676d5af60cd3c9c43dd1441f.exe	79
PID 4064 wrote to memory of 4444	4064	0e99aef5608c3357e1425734aad75eaff3d241c1676d5af60cd3c9c43dd1441f.exe	79
PID 4064 wrote to memory of 4444	4064	0e99aef5608c3357e1425734aad75eaff3d241c1676d5af60cd3c9c43dd1441f.exe	79
PID 4064 wrote to memory of 4444	4064	0e99aef5608c3357e1425734aad75eaff3d241c1676d5af60cd3c9c43dd1441f.exe	79
PID 4064 wrote to memory of 4444	4064	0e99aef5608c3357e1425734aad75eaff3d241c1676d5af60cd3c9c43dd1441f.exe	79

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4444 -ip 4444
1⤵
PID:2064

memory/4064-130-0x0000000000C30000-0x0000000000D60000-memory.dmp

Filesize
1.2MB

Download
memory/4064-131-0x0000000005690000-0x000000000572C000-memory.dmp

Filesize
624KB

Download
memory/4444-133-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4444-134-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4444-135-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4444-136-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4444-137-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download