oski | c9b7cd9594e42b49718c8e4c093ce9bd2e494ab5d11ae6fbe505ce24a5cc3867

General

Target

C9B7CD9594E42B49718C8E4C093CE9BD2E494AB5D11AE.exe
Size

318KB
MD5

6fbe0d88a13f078bdb6ce169f64cf2d6
SHA1

cafb904a8227f35ca916e1c7b1213ce76b4282b2
SHA256

c9b7cd9594e42b49718c8e4c093ce9bd2e494ab5d11ae6fbe505ce24a5cc3867
SHA512

f7a9123cd0bcf342372c3e3f898ae2be9e0085680092366e1469d888366c96d78e069edb2fee4bb6d578422ee459f6bc436fc85b9018b5d0e0d84efd5835b4bd

Score

10^/10

oski infostealer spyware stealer suricata

Malware Config

Extracted

Family

oski

C2

weirdtrendz.com

Signatures

Oski
Oski is an infostealer targeting browser data, crypto wallets.
infostealer oski
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern
suricata
Executes dropped EXE 1 IoCs

Processes:

svchost.exe

pid process

1912 svchost.exe
Loads dropped DLL 6 IoCs

Processes:

C9B7CD9594E42B49718C8E4C093CE9BD2E494AB5D11AE.exeWerFault.exe

pid process

560 C9B7CD9594E42B49718C8E4C093CE9BD2E494AB5D11AE.exe
1120 WerFault.exe
1120 WerFault.exe
1120 WerFault.exe
1120 WerFault.exe
1120 WerFault.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Suspicious use of SetThreadContext 1 IoCs

Processes:

C9B7CD9594E42B49718C8E4C093CE9BD2E494AB5D11AE.exe

description pid process target process

PID 560 set thread context of 1912 560 C9B7CD9594E42B49718C8E4C093CE9BD2E494AB5D11AE.exe svchost.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1120 1912 WerFault.exe svchost.exe

pid	process
1912	svchost.exe

pid	process
560	C9B7CD9594E42B49718C8E4C093CE9BD2E494AB5D11AE.exe
1120	WerFault.exe
1120	WerFault.exe
1120	WerFault.exe
1120	WerFault.exe
1120	WerFault.exe

description	pid	process	target process
PID 560 set thread context of 1912	560	C9B7CD9594E42B49718C8E4C093CE9BD2E494AB5D11AE.exe	svchost.exe

pid	pid_target	process	target process
1120	1912	WerFault.exe	svchost.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

C9B7CD9594E42B49718C8E4C093CE9BD2E494AB5D11AE.exesvchost.exe

description	pid	process	target process
PID 560 wrote to memory of 1912	560	C9B7CD9594E42B49718C8E4C093CE9BD2E494AB5D11AE.exe	svchost.exe
PID 560 wrote to memory of 1912	560	C9B7CD9594E42B49718C8E4C093CE9BD2E494AB5D11AE.exe	svchost.exe
PID 560 wrote to memory of 1912	560	C9B7CD9594E42B49718C8E4C093CE9BD2E494AB5D11AE.exe	svchost.exe
PID 560 wrote to memory of 1912	560	C9B7CD9594E42B49718C8E4C093CE9BD2E494AB5D11AE.exe	svchost.exe
PID 560 wrote to memory of 1912	560	C9B7CD9594E42B49718C8E4C093CE9BD2E494AB5D11AE.exe	svchost.exe
PID 560 wrote to memory of 1912	560	C9B7CD9594E42B49718C8E4C093CE9BD2E494AB5D11AE.exe	svchost.exe
PID 560 wrote to memory of 1912	560	C9B7CD9594E42B49718C8E4C093CE9BD2E494AB5D11AE.exe	svchost.exe
PID 560 wrote to memory of 1912	560	C9B7CD9594E42B49718C8E4C093CE9BD2E494AB5D11AE.exe	svchost.exe
PID 560 wrote to memory of 1912	560	C9B7CD9594E42B49718C8E4C093CE9BD2E494AB5D11AE.exe	svchost.exe
PID 560 wrote to memory of 1912	560	C9B7CD9594E42B49718C8E4C093CE9BD2E494AB5D11AE.exe	svchost.exe
PID 1912 wrote to memory of 1120	1912	svchost.exe	WerFault.exe
PID 1912 wrote to memory of 1120	1912	svchost.exe	WerFault.exe
PID 1912 wrote to memory of 1120	1912	svchost.exe	WerFault.exe
PID 1912 wrote to memory of 1120	1912	svchost.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\C9B7CD9594E42B49718C8E4C093CE9BD2E494AB5D11AE.exe
"C:\Users\Admin\AppData\Local\Temp\C9B7CD9594E42B49718C8E4C093CE9BD2E494AB5D11AE.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:560

C:\Users\Admin\AppData\Local\Temp\svchost.exe
C:\Users\Admin\AppData\Local\Temp\svchost.exe
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1912 -s 772
3⤵
- Loads dropped DLL
- Program crash
PID:1120

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\svchost.exe
Filesize
1.1MB

MD5
34aa912defa18c2c129f1e09d75c1d7e

SHA1
9c3046324657505a30ecd9b1fdb46c05bde7d470

SHA256
6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386

SHA512
d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

Download Submit
\Users\Admin\AppData\Local\Temp\svchost.exe
Filesize
1.1MB

MD5
34aa912defa18c2c129f1e09d75c1d7e

SHA1
9c3046324657505a30ecd9b1fdb46c05bde7d470

SHA256
6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386

SHA512
d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

Download Submit
\Users\Admin\AppData\Local\Temp\svchost.exe
Filesize
1.1MB

MD5
34aa912defa18c2c129f1e09d75c1d7e

SHA1
9c3046324657505a30ecd9b1fdb46c05bde7d470

SHA256
6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386

SHA512
d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

Download Submit
\Users\Admin\AppData\Local\Temp\svchost.exe
Filesize
1.1MB

MD5
34aa912defa18c2c129f1e09d75c1d7e

SHA1
9c3046324657505a30ecd9b1fdb46c05bde7d470

SHA256
6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386

SHA512
d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

Download Submit
\Users\Admin\AppData\Local\Temp\svchost.exe
Filesize
1.1MB

MD5
34aa912defa18c2c129f1e09d75c1d7e

SHA1
9c3046324657505a30ecd9b1fdb46c05bde7d470

SHA256
6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386

SHA512
d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

Download Submit
\Users\Admin\AppData\Local\Temp\svchost.exe
Filesize
1.1MB

MD5
34aa912defa18c2c129f1e09d75c1d7e

SHA1
9c3046324657505a30ecd9b1fdb46c05bde7d470

SHA256
6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386

SHA512
d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

Download Submit
\Users\Admin\AppData\Local\Temp\svchost.exe
Filesize
1.1MB

MD5
34aa912defa18c2c129f1e09d75c1d7e

SHA1
9c3046324657505a30ecd9b1fdb46c05bde7d470

SHA256
6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386

SHA512
d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

Download Submit
memory/560-71-0x0000000074500000-0x0000000074AAB000-memory.dmp

Filesize
5.7MB

Download
memory/560-54-0x0000000075271000-0x0000000075273000-memory.dmp

Filesize
8KB

Download
memory/1120-73-0x0000000000000000-mapping.dmp

Download
memory/1912-66-0x000000000040717B-mapping.dmp

Download
memory/1912-69-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1912-72-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1912-65-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1912-63-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1912-61-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1912-59-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1912-57-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1912-56-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download

Analysis

Sharing