oski | 5e71696919b1dcac97300cee304cec686b19aee23888b1a35822dc974dacb542

Analysis

Target

5e71696919b1dcac97300cee304cec686b19aee23888b1a35822dc974dacb542.exe
Size

837KB
MD5

f123e73cc5fd5e6de566d0515ddb03b2
SHA1

2a3f62804a340bd9ae3afa2626653942c8ec33a7
SHA256

5e71696919b1dcac97300cee304cec686b19aee23888b1a35822dc974dacb542
SHA512

fe99aa5e074b5b0a3c74ea9a0346c5e6f36533de2c28d0ba7c7a05461105d07f1e2260a90293efc36797c9a1af6593abb5d2a6e95b4f7fc8cadd25bd74ae51dc

Score

10^/10

Family

oski

fsefsfeg.xyz

Oski
Oski is an infostealer targeting browser data, crypto wallets.
infostealer oski
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1156 732 WerFault.exe 5e71696919b1dcac97300cee304cec686b19aee23888b1a35822dc974dacb542.exe

pid	pid_target	process	target process
1156	732	WerFault.exe	5e71696919b1dcac97300cee304cec686b19aee23888b1a35822dc974dacb542.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

5e71696919b1dcac97300cee304cec686b19aee23888b1a35822dc974dacb542.exe

description	pid	process	target process
PID 732 wrote to memory of 1156	732	5e71696919b1dcac97300cee304cec686b19aee23888b1a35822dc974dacb542.exe	WerFault.exe
PID 732 wrote to memory of 1156	732	5e71696919b1dcac97300cee304cec686b19aee23888b1a35822dc974dacb542.exe	WerFault.exe
PID 732 wrote to memory of 1156	732	5e71696919b1dcac97300cee304cec686b19aee23888b1a35822dc974dacb542.exe	WerFault.exe
PID 732 wrote to memory of 1156	732	5e71696919b1dcac97300cee304cec686b19aee23888b1a35822dc974dacb542.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\5e71696919b1dcac97300cee304cec686b19aee23888b1a35822dc974dacb542.exe
"C:\Users\Admin\AppData\Local\Temp\5e71696919b1dcac97300cee304cec686b19aee23888b1a35822dc974dacb542.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 732 -s 804
2⤵
- Program crash
PID:1156

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

memory/732-54-0x00000000002C0000-0x0000000000314000-memory.dmp

Filesize
336KB

Download
memory/732-55-0x0000000076561000-0x0000000076563000-memory.dmp

Filesize
8KB

Download
memory/732-56-0x0000000000400000-0x00000000004D1000-memory.dmp

Filesize
836KB

Download
memory/732-57-0x00000000002C0000-0x0000000000314000-memory.dmp

Filesize
336KB

Download
memory/1156-58-0x0000000000000000-mapping.dmp

Download