oski | 4c51a9f2c247d7a7d027a9b5a440f7cbe1a7d85b23f5d2a803f6548e4f7100c5

General

Target

0e99aef5608c3357e1425734aad75eaff3d241c1676d5af60cd3c9c43dd1441f.exe
Size

1.2MB
MD5

61bca80732c3e682e00fb4bd8c48d52b
SHA1

f32a21133c750d1c26e412b305b32110d281a981
SHA256

0e99aef5608c3357e1425734aad75eaff3d241c1676d5af60cd3c9c43dd1441f
SHA512

498efd615df973793d222bf55573499199b6c1d775b58a0c0c6eb2b94eb8234f6c263156c651e5084eede2bf6d0589500fc375c16728d32ef324be4eb354bca1

Score

10^/10

oski infostealer

Malware Config

Extracted

Family

oski

C2

ibroot.com

Signatures

Oski
Oski is an infostealer targeting browser data, crypto wallets.
infostealer oski

Suspicious use of SetThreadContext 1 IoCs

Processes:

0e99aef5608c3357e1425734aad75eaff3d241c1676d5af60cd3c9c43dd1441f.exe

description	pid	process	target process
PID 4064 set thread context of 4444	4064	0e99aef5608c3357e1425734aad75eaff3d241c1676d5af60cd3c9c43dd1441f.exe	bitsadmin.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1016 4444 WerFault.exe bitsadmin.exe

pid	pid_target	process	target process
1016	4444	WerFault.exe	bitsadmin.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

0e99aef5608c3357e1425734aad75eaff3d241c1676d5af60cd3c9c43dd1441f.exe

pid	process
4064	0e99aef5608c3357e1425734aad75eaff3d241c1676d5af60cd3c9c43dd1441f.exe
4064	0e99aef5608c3357e1425734aad75eaff3d241c1676d5af60cd3c9c43dd1441f.exe
4064	0e99aef5608c3357e1425734aad75eaff3d241c1676d5af60cd3c9c43dd1441f.exe
4064	0e99aef5608c3357e1425734aad75eaff3d241c1676d5af60cd3c9c43dd1441f.exe
4064	0e99aef5608c3357e1425734aad75eaff3d241c1676d5af60cd3c9c43dd1441f.exe
4064	0e99aef5608c3357e1425734aad75eaff3d241c1676d5af60cd3c9c43dd1441f.exe
4064	0e99aef5608c3357e1425734aad75eaff3d241c1676d5af60cd3c9c43dd1441f.exe
4064	0e99aef5608c3357e1425734aad75eaff3d241c1676d5af60cd3c9c43dd1441f.exe
4064	0e99aef5608c3357e1425734aad75eaff3d241c1676d5af60cd3c9c43dd1441f.exe
4064	0e99aef5608c3357e1425734aad75eaff3d241c1676d5af60cd3c9c43dd1441f.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

0e99aef5608c3357e1425734aad75eaff3d241c1676d5af60cd3c9c43dd1441f.exe

description pid process

Token: SeDebugPrivilege 4064 0e99aef5608c3357e1425734aad75eaff3d241c1676d5af60cd3c9c43dd1441f.exe

description	pid	process
Token: SeDebugPrivilege	4064	0e99aef5608c3357e1425734aad75eaff3d241c1676d5af60cd3c9c43dd1441f.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

0e99aef5608c3357e1425734aad75eaff3d241c1676d5af60cd3c9c43dd1441f.exe

description	pid	process	target process
PID 4064 wrote to memory of 4444	4064	0e99aef5608c3357e1425734aad75eaff3d241c1676d5af60cd3c9c43dd1441f.exe	bitsadmin.exe
PID 4064 wrote to memory of 4444	4064	0e99aef5608c3357e1425734aad75eaff3d241c1676d5af60cd3c9c43dd1441f.exe	bitsadmin.exe
PID 4064 wrote to memory of 4444	4064	0e99aef5608c3357e1425734aad75eaff3d241c1676d5af60cd3c9c43dd1441f.exe	bitsadmin.exe
PID 4064 wrote to memory of 4444	4064	0e99aef5608c3357e1425734aad75eaff3d241c1676d5af60cd3c9c43dd1441f.exe	bitsadmin.exe
PID 4064 wrote to memory of 4444	4064	0e99aef5608c3357e1425734aad75eaff3d241c1676d5af60cd3c9c43dd1441f.exe	bitsadmin.exe
PID 4064 wrote to memory of 4444	4064	0e99aef5608c3357e1425734aad75eaff3d241c1676d5af60cd3c9c43dd1441f.exe	bitsadmin.exe
PID 4064 wrote to memory of 4444	4064	0e99aef5608c3357e1425734aad75eaff3d241c1676d5af60cd3c9c43dd1441f.exe	bitsadmin.exe
PID 4064 wrote to memory of 4444	4064	0e99aef5608c3357e1425734aad75eaff3d241c1676d5af60cd3c9c43dd1441f.exe	bitsadmin.exe
PID 4064 wrote to memory of 4444	4064	0e99aef5608c3357e1425734aad75eaff3d241c1676d5af60cd3c9c43dd1441f.exe	bitsadmin.exe
PID 4064 wrote to memory of 4444	4064	0e99aef5608c3357e1425734aad75eaff3d241c1676d5af60cd3c9c43dd1441f.exe	bitsadmin.exe

C:\Users\Admin\AppData\Local\Temp\0e99aef5608c3357e1425734aad75eaff3d241c1676d5af60cd3c9c43dd1441f.exe
"C:\Users\Admin\AppData\Local\Temp\0e99aef5608c3357e1425734aad75eaff3d241c1676d5af60cd3c9c43dd1441f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4064

C:\Windows\SysWOW64\bitsadmin.exe
"C:\Windows\SysWOW64\bitsadmin.exe"
2⤵
PID:4444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4444 -s 1272
3⤵
- Program crash
PID:1016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4444 -ip 4444
1⤵
PID:2064

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4064-130-0x0000000000C30000-0x0000000000D60000-memory.dmp

Filesize
1.2MB

Download
memory/4064-131-0x0000000005690000-0x000000000572C000-memory.dmp

Filesize
624KB

Download
memory/4444-132-0x0000000000000000-mapping.dmp

Download
memory/4444-133-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4444-134-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4444-135-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4444-136-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4444-137-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads