oski | fb0901c0241896831cac8f3e139c461ae327fc884812d3a206d4e0b8b7931a2e

Analysis

Target

bb12e61f99f6c7b2d4c8702d02dec5d9.exe
Size

200KB
MD5

bb12e61f99f6c7b2d4c8702d02dec5d9
SHA1

3924763176734ee12f708a7f0fdd05f49c473ac4
SHA256

fb0901c0241896831cac8f3e139c461ae327fc884812d3a206d4e0b8b7931a2e
SHA512

49f6e0ac1ffc8638f8116f5e5d5e3a9548ced2f788638f370bba55225184d71bf1e10e9c8a12aff3911a40b228f337a1bfeb20fc3394e2630601d0b2cd709220

Score

10^/10

Oski
Oski is an infostealer targeting browser data, crypto wallets.
infostealer oski
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern
suricata
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1692 3856 WerFault.exe bb12e61f99f6c7b2d4c8702d02dec5d9.exe

pid	pid_target	process	target process
1692	3856	WerFault.exe	bb12e61f99f6c7b2d4c8702d02dec5d9.exe

C:\Users\Admin\AppData\Local\Temp\bb12e61f99f6c7b2d4c8702d02dec5d9.exe
"C:\Users\Admin\AppData\Local\Temp\bb12e61f99f6c7b2d4c8702d02dec5d9.exe"
1⤵
PID:3856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3856 -s 1356
2⤵
- Program crash
PID:1692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3856 -ip 3856
1⤵
PID:1272

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact