oski | 2de955e75c95085725bbd85c135b41e5678517da8fb9ba7db6d35749f63b7636

General

Target

4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe
Size

388KB
MD5

0e3b92ef55843eb0d93da30658bac843
SHA1

857182cc43c7aebd753dbf770ae5c2fa8c8e3500
SHA256

4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6
SHA512

adb128804806daa4a63daf477c2fb275af60b63c0a0cdb25f6c85f0565ee26d55b2595638d433a96ea483121893aa86c1a0cdadfa244ac4dad5137349049f241

Score

10^/10

oski infostealer

Malware Config

Extracted

Family

oski

C2

postalresolve.com

Signatures

Oski
Oski is an infostealer targeting browser data, crypto wallets.
infostealer oski

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1432 set thread context of 1756	1432	4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe	29

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1060	powershell.exe
1432	4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1060	powershell.exe
Token: SeDebugPrivilege	1432	4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1432 wrote to memory of 1060	1432	4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe	27
PID 1432 wrote to memory of 1060	1432	4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe	27
PID 1432 wrote to memory of 1060	1432	4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe	27
PID 1432 wrote to memory of 1060	1432	4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe	27
PID 1432 wrote to memory of 1756	1432	4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe	29
PID 1432 wrote to memory of 1756	1432	4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe	29
PID 1432 wrote to memory of 1756	1432	4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe	29
PID 1432 wrote to memory of 1756	1432	4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe	29
PID 1432 wrote to memory of 1756	1432	4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe	29
PID 1432 wrote to memory of 1756	1432	4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe	29
PID 1432 wrote to memory of 1756	1432	4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe	29
PID 1432 wrote to memory of 1756	1432	4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe	29
PID 1432 wrote to memory of 1756	1432	4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe	29
PID 1432 wrote to memory of 1756	1432	4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe	29

C:\Users\Admin\AppData\Local\Temp\4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe
"C:\Users\Admin\AppData\Local\Temp\4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1432
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwAzAA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1060
- C:\Users\Admin\AppData\Local\Temp\4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe
  C:\Users\Admin\AppData\Local\Temp\4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe
  2⤵
  PID:1756

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1060-63-0x0000000070990000-0x0000000070F3B000-memory.dmp

Filesize
5.7MB

Download
memory/1060-62-0x0000000070990000-0x0000000070F3B000-memory.dmp

Filesize
5.7MB

Download
memory/1060-61-0x0000000070990000-0x0000000070F3B000-memory.dmp

Filesize
5.7MB

Download
memory/1432-58-0x00000000009E0000-0x0000000000A2C000-memory.dmp

Filesize
304KB

Download
memory/1432-54-0x0000000000810000-0x0000000000876000-memory.dmp

Filesize
408KB

Download
memory/1432-57-0x0000000000750000-0x0000000000794000-memory.dmp

Filesize
272KB

Download
memory/1432-56-0x0000000076031000-0x0000000076033000-memory.dmp

Filesize
8KB

Download
memory/1432-55-0x0000000000880000-0x00000000008E4000-memory.dmp

Filesize
400KB

Download
memory/1756-64-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1756-67-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1756-65-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1756-69-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1756-71-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1756-73-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1756-76-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1756-78-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download

Analysis

Sharing