oski | 2de955e75c95085725bbd85c135b41e5678517da8fb9ba7db6d35749f63b7636

General

Target

4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe
Size

388KB
MD5

0e3b92ef55843eb0d93da30658bac843
SHA1

857182cc43c7aebd753dbf770ae5c2fa8c8e3500
SHA256

4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6
SHA512

adb128804806daa4a63daf477c2fb275af60b63c0a0cdb25f6c85f0565ee26d55b2595638d433a96ea483121893aa86c1a0cdadfa244ac4dad5137349049f241

Score

10^/10

oski infostealer

Malware Config

Extracted

Family

oski

C2

postalresolve.com

Signatures

Oski
Oski is an infostealer targeting browser data, crypto wallets.
infostealer oski

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe

description	pid	process	target process
PID 2408 set thread context of 3644	2408	4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe	4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

powershell.exe4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe

pid	process
716	powershell.exe
716	powershell.exe
2408	4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe
2408	4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exe4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe

description	pid	process
Token: SeDebugPrivilege	716	powershell.exe
Token: SeDebugPrivilege	2408	4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe

description	pid	process	target process
PID 2408 wrote to memory of 716	2408	4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe	powershell.exe
PID 2408 wrote to memory of 716	2408	4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe	powershell.exe
PID 2408 wrote to memory of 716	2408	4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe	powershell.exe
PID 2408 wrote to memory of 3644	2408	4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe	4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe
PID 2408 wrote to memory of 3644	2408	4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe	4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe
PID 2408 wrote to memory of 3644	2408	4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe	4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe
PID 2408 wrote to memory of 3644	2408	4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe	4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe
PID 2408 wrote to memory of 3644	2408	4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe	4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe
PID 2408 wrote to memory of 3644	2408	4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe	4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe
PID 2408 wrote to memory of 3644	2408	4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe	4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe
PID 2408 wrote to memory of 3644	2408	4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe	4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe
PID 2408 wrote to memory of 3644	2408	4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe	4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe

C:\Users\Admin\AppData\Local\Temp\4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe
"C:\Users\Admin\AppData\Local\Temp\4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2408

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwAzAA==
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:716

C:\Users\Admin\AppData\Local\Temp\4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe
C:\Users\Admin\AppData\Local\Temp\4db9628c253be13ee838313ce4aba48da07bd2f1e73cb630a59a59b44587efd6.exe
2⤵
PID:3644

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/716-136-0x0000000005A10000-0x0000000005A76000-memory.dmp

Filesize
408KB

Download
memory/716-138-0x0000000007970000-0x0000000007FEA000-memory.dmp

Filesize
6.5MB

Download
memory/716-132-0x0000000002A80000-0x0000000002AB6000-memory.dmp

Filesize
216KB

Download
memory/716-133-0x0000000005150000-0x0000000005778000-memory.dmp

Filesize
6.2MB

Download
memory/716-134-0x00000000057D0000-0x00000000057F2000-memory.dmp

Filesize
136KB

Download
memory/716-135-0x00000000058F0000-0x0000000005956000-memory.dmp

Filesize
408KB

Download
memory/716-131-0x0000000000000000-mapping.dmp

Download
memory/716-137-0x0000000004DE0000-0x0000000004DFE000-memory.dmp

Filesize
120KB

Download
memory/716-139-0x00000000065E0000-0x00000000065FA000-memory.dmp

Filesize
104KB

Download
memory/2408-130-0x0000000000810000-0x0000000000876000-memory.dmp

Filesize
408KB

Download
memory/3644-140-0x0000000000000000-mapping.dmp

Download
memory/3644-141-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3644-142-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3644-143-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3644-144-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads