oski | c9b7cd9594e42b49718c8e4c093ce9bd2e494ab5d11ae6fbe505ce24a5cc3867

General

Target

C9B7CD9594E42B49718C8E4C093CE9BD2E494AB5D11AE.exe
Size

318KB
MD5

6fbe0d88a13f078bdb6ce169f64cf2d6
SHA1

cafb904a8227f35ca916e1c7b1213ce76b4282b2
SHA256

c9b7cd9594e42b49718c8e4c093ce9bd2e494ab5d11ae6fbe505ce24a5cc3867
SHA512

f7a9123cd0bcf342372c3e3f898ae2be9e0085680092366e1469d888366c96d78e069edb2fee4bb6d578422ee459f6bc436fc85b9018b5d0e0d84efd5835b4bd

Score

10^/10

oski infostealer spyware stealer suricata

Malware Config

Extracted

Family

oski

C2

weirdtrendz.com

Signatures

Oski
Oski is an infostealer targeting browser data, crypto wallets.
infostealer oski
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern
suricata
Executes dropped EXE 1 IoCs

Processes:

svchost.exe

pid process

1968 svchost.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Suspicious use of SetThreadContext 1 IoCs

Processes:

C9B7CD9594E42B49718C8E4C093CE9BD2E494AB5D11AE.exe

description pid process target process

PID 312 set thread context of 1968 312 C9B7CD9594E42B49718C8E4C093CE9BD2E494AB5D11AE.exe svchost.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1540 1968 WerFault.exe svchost.exe

pid	process
1968	svchost.exe

description	pid	process	target process
PID 312 set thread context of 1968	312	C9B7CD9594E42B49718C8E4C093CE9BD2E494AB5D11AE.exe	svchost.exe

pid	pid_target	process	target process
1540	1968	WerFault.exe	svchost.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

C9B7CD9594E42B49718C8E4C093CE9BD2E494AB5D11AE.exe

description	pid	process	target process
PID 312 wrote to memory of 1968	312	C9B7CD9594E42B49718C8E4C093CE9BD2E494AB5D11AE.exe	svchost.exe
PID 312 wrote to memory of 1968	312	C9B7CD9594E42B49718C8E4C093CE9BD2E494AB5D11AE.exe	svchost.exe
PID 312 wrote to memory of 1968	312	C9B7CD9594E42B49718C8E4C093CE9BD2E494AB5D11AE.exe	svchost.exe
PID 312 wrote to memory of 1968	312	C9B7CD9594E42B49718C8E4C093CE9BD2E494AB5D11AE.exe	svchost.exe
PID 312 wrote to memory of 1968	312	C9B7CD9594E42B49718C8E4C093CE9BD2E494AB5D11AE.exe	svchost.exe
PID 312 wrote to memory of 1968	312	C9B7CD9594E42B49718C8E4C093CE9BD2E494AB5D11AE.exe	svchost.exe
PID 312 wrote to memory of 1968	312	C9B7CD9594E42B49718C8E4C093CE9BD2E494AB5D11AE.exe	svchost.exe
PID 312 wrote to memory of 1968	312	C9B7CD9594E42B49718C8E4C093CE9BD2E494AB5D11AE.exe	svchost.exe
PID 312 wrote to memory of 1968	312	C9B7CD9594E42B49718C8E4C093CE9BD2E494AB5D11AE.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\C9B7CD9594E42B49718C8E4C093CE9BD2E494AB5D11AE.exe
"C:\Users\Admin\AppData\Local\Temp\C9B7CD9594E42B49718C8E4C093CE9BD2E494AB5D11AE.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:312

C:\Users\Admin\AppData\Local\Temp\svchost.exe
C:\Users\Admin\AppData\Local\Temp\svchost.exe
2⤵
- Executes dropped EXE
PID:1968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 1364
3⤵
- Program crash
PID:1540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1968 -ip 1968
1⤵
PID:1428

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\svchost.exe
Filesize
1.1MB

MD5
d881de17aa8f2e2c08cbb7b265f928f9

SHA1
08936aebc87decf0af6e8eada191062b5e65ac2a

SHA256
b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0

SHA512
5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

Download Submit
C:\Users\Admin\AppData\Local\Temp\svchost.exe
Filesize
1.1MB

MD5
d881de17aa8f2e2c08cbb7b265f928f9

SHA1
08936aebc87decf0af6e8eada191062b5e65ac2a

SHA256
b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0

SHA512
5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

Download Submit
memory/312-130-0x00000000752F0000-0x00000000758A1000-memory.dmp

Filesize
5.7MB

Download
memory/312-131-0x00000000752F0000-0x00000000758A1000-memory.dmp

Filesize
5.7MB

Download
memory/312-137-0x00000000752F0000-0x00000000758A1000-memory.dmp

Filesize
5.7MB

Download
memory/1968-132-0x0000000000000000-mapping.dmp

Download
memory/1968-133-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1968-136-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1968-138-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1968-139-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1968-140-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download

Analysis

Sharing