oski | hxxps://www[.]upload[.]ee/files/14365900/Oski_Stealer[.]rar[.]html

Analysis

max time kernel
657s
max time network
659s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
16-09-2022 16:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.upload.ee/files/14365900/Oski_Stealer.rar.html

Score

10^/10

oski infostealer spyware stealer

Malware Config

Extracted

Family

oski

62.77.159.212

panel.com

Signatures

Oski
Oski is an infostealer targeting browser data, crypto wallets.
infostealer oski

Executes dropped EXE 6 IoCs

pid	Process
3340	Oski_Stealer.exe
1108	Oski_Stealer.exe
508	crack.exe
3608	Oski Cracked.exe
4888	Oski_Cracked_panel.com.exe
4944	Oski_Cracked_panel.com.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Control Panel\International\Geo\Nation	Oski Cracked.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\crack.exe	crack.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\crack.exe	crack.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	Oski Cracked.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
32	4888	WerFault.exe	86
3104	4944	WerFault.exe	90

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming\ChangeUnitGenerationNeeded = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	Oski Cracked.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\EnableNegotiate = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Oski Cracked.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\FirstRecoveryTime = d581f14b6daed801	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	Oski Cracked.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\Extension = "5"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B7216 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	Oski Cracked.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	Oski Cracked.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\DOMStorage	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{ED0D9DD2-EE8C-46CF-9E0C-7A13C509F32D} = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	Oski Cracked.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingDelete	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url3 = "https://signin.ebay.com/ws/ebayisapi.dll"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\ManagerHistoryComplete = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	Oski Cracked.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 0100000051661cc9d1eff1626b0f74eaca7cd54261d029639501336306eab467aabc4695b8a07a409ae092b3e35cde8ab3334d8722cba78fa8b0afb05cfc87c35726a6775584726562d64ac7ad9b570ebc7431af046fdf4a4f8599c1642b	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance	Oski Cracked.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\AllComplete = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites\Order = 0c0000000a000000000000000c0000000100000000000000	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	Oski Cracked.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Oski Cracked.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Oski Cracked.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url2 = "https://login.aliexpress.com/"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\AllComplete = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory\UUID = "{DB879C6A-E5B5-4311-ACE3-348E304B740F}"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}"	Oski Cracked.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PageSetup	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 010000009ffd9f92e7e181c0951054e490efe5da1710c751887a4f1b24d7623a1aed9217bc26448858065fb54ac3a4a41d78e1538895b1edd68970903acaa6ecb1b4720ed8f02dbb9047be1da01e5c9e6606ff394e0cb98aabc59177c435b6f2a610e2d855fcf2943bc62d7908c38014e8b8e5720b14415fa24eca77ddba8e852c22b9443fe8983a06a2cda6b1500c7db0b0fa58b34c3116aa44af63acf8f7a81308bcd666558d87c0fa62f46267055d4e0d074d6856c314f7c7ad749e8fa47ef8e38dbdb8e391163bf079ffb6a6768626ef389d42d101cafcf75850b81f803035d4cd288632a05ddca23965abae1f284d76fdb6ea5c5015c2f438e37d48bd654cf9b3dfdfe22ad726320f435120273da4c1b5ad2399bfb3f0de5c094aaa2147e373e32e2994ba3dc7be6d8ade9ae59cfbf2680f962668c7a1d5f9052ce5e319bf62282410e64ad60b685f1952be6c9901289f05c0a550668ef901ca47998e6057e7b11d7179d7c9f14ee0b3c42a092e538303d02eb5463f876abf126f66ad981e207ea30ced559033927abf927fdcc08d22c983f1f5e24ae448ab4a4f9b723fc35617a7f08e6449fd36	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 84c62947ffc9d801	MicrosoftEdge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Oski_Stealer.rar:Zone.Identifier	firefox.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
508	crack.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	4896	firefox.exe
Token: SeDebugPrivilege	4896	firefox.exe
Token: SeDebugPrivilege	4896	firefox.exe
Token: SeDebugPrivilege	4896	firefox.exe
Token: SeDebugPrivilege	4896	firefox.exe
Token: SeRestorePrivilege	3768	7zG.exe
Token: 35	3768	7zG.exe
Token: SeSecurityPrivilege	3768	7zG.exe
Token: SeSecurityPrivilege	3768	7zG.exe
Token: SeDebugPrivilege	4896	firefox.exe
Token: SeDebugPrivilege	4896	firefox.exe
Token: SeDebugPrivilege	4896	firefox.exe
Token: SeDebugPrivilege	2356	MicrosoftEdge.exe
Token: SeDebugPrivilege	2356	MicrosoftEdge.exe
Token: SeDebugPrivilege	2356	MicrosoftEdge.exe
Token: SeDebugPrivilege	2356	MicrosoftEdge.exe
Token: SeDebugPrivilege	1876	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1876	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1876	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1876	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2356	MicrosoftEdge.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
4896	firefox.exe
4896	firefox.exe
4896	firefox.exe
4896	firefox.exe
3768	7zG.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4896	firefox.exe
4896	firefox.exe
4896	firefox.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
4896	firefox.exe
4896	firefox.exe
4896	firefox.exe
4896	firefox.exe
3340	Oski_Stealer.exe
3340	Oski_Stealer.exe
1108	Oski_Stealer.exe
1108	Oski_Stealer.exe
2356	MicrosoftEdge.exe
3608	Oski Cracked.exe
3816	MicrosoftEdgeCP.exe
3816	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4208 wrote to memory of 4896	4208	firefox.exe	66
PID 4208 wrote to memory of 4896	4208	firefox.exe	66
PID 4208 wrote to memory of 4896	4208	firefox.exe	66
PID 4208 wrote to memory of 4896	4208	firefox.exe	66
PID 4208 wrote to memory of 4896	4208	firefox.exe	66
PID 4208 wrote to memory of 4896	4208	firefox.exe	66
PID 4208 wrote to memory of 4896	4208	firefox.exe	66
PID 4208 wrote to memory of 4896	4208	firefox.exe	66
PID 4208 wrote to memory of 4896	4208	firefox.exe	66
PID 4896 wrote to memory of 2260	4896	firefox.exe	68
PID 4896 wrote to memory of 2260	4896	firefox.exe	68
PID 4896 wrote to memory of 4240	4896	firefox.exe	70
PID 4896 wrote to memory of 4240	4896	firefox.exe	70
PID 4896 wrote to memory of 4240	4896	firefox.exe	70
PID 4896 wrote to memory of 4240	4896	firefox.exe	70
PID 4896 wrote to memory of 4240	4896	firefox.exe	70
PID 4896 wrote to memory of 4240	4896	firefox.exe	70
PID 4896 wrote to memory of 4240	4896	firefox.exe	70
PID 4896 wrote to memory of 4240	4896	firefox.exe	70
PID 4896 wrote to memory of 4240	4896	firefox.exe	70
PID 4896 wrote to memory of 4240	4896	firefox.exe	70
PID 4896 wrote to memory of 4240	4896	firefox.exe	70
PID 4896 wrote to memory of 4240	4896	firefox.exe	70
PID 4896 wrote to memory of 4240	4896	firefox.exe	70
PID 4896 wrote to memory of 4240	4896	firefox.exe	70
PID 4896 wrote to memory of 4240	4896	firefox.exe	70
PID 4896 wrote to memory of 4240	4896	firefox.exe	70
PID 4896 wrote to memory of 4240	4896	firefox.exe	70
PID 4896 wrote to memory of 4240	4896	firefox.exe	70
PID 4896 wrote to memory of 4240	4896	firefox.exe	70
PID 4896 wrote to memory of 4240	4896	firefox.exe	70
PID 4896 wrote to memory of 4240	4896	firefox.exe	70
PID 4896 wrote to memory of 4240	4896	firefox.exe	70
PID 4896 wrote to memory of 4240	4896	firefox.exe	70
PID 4896 wrote to memory of 4240	4896	firefox.exe	70
PID 4896 wrote to memory of 4240	4896	firefox.exe	70
PID 4896 wrote to memory of 4240	4896	firefox.exe	70
PID 4896 wrote to memory of 4240	4896	firefox.exe	70
PID 4896 wrote to memory of 4240	4896	firefox.exe	70
PID 4896 wrote to memory of 4240	4896	firefox.exe	70
PID 4896 wrote to memory of 4240	4896	firefox.exe	70
PID 4896 wrote to memory of 4240	4896	firefox.exe	70
PID 4896 wrote to memory of 4240	4896	firefox.exe	70
PID 4896 wrote to memory of 4240	4896	firefox.exe	70
PID 4896 wrote to memory of 4240	4896	firefox.exe	70
PID 4896 wrote to memory of 4240	4896	firefox.exe	70
PID 4896 wrote to memory of 4240	4896	firefox.exe	70
PID 4896 wrote to memory of 4240	4896	firefox.exe	70
PID 4896 wrote to memory of 4240	4896	firefox.exe	70
PID 4896 wrote to memory of 4240	4896	firefox.exe	70
PID 4896 wrote to memory of 4240	4896	firefox.exe	70
PID 4896 wrote to memory of 4240	4896	firefox.exe	70
PID 4896 wrote to memory of 4240	4896	firefox.exe	70
PID 4896 wrote to memory of 4240	4896	firefox.exe	70
PID 4896 wrote to memory of 3760	4896	firefox.exe	71
PID 4896 wrote to memory of 3760	4896	firefox.exe	71
PID 4896 wrote to memory of 3760	4896	firefox.exe	71
PID 4896 wrote to memory of 3760	4896	firefox.exe	71
PID 4896 wrote to memory of 3760	4896	firefox.exe	71
PID 4896 wrote to memory of 3760	4896	firefox.exe	71
PID 4896 wrote to memory of 3760	4896	firefox.exe	71
PID 4896 wrote to memory of 3760	4896	firefox.exe	71
PID 4896 wrote to memory of 3760	4896	firefox.exe	71
PID 4896 wrote to memory of 3760	4896	firefox.exe	71

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.upload.ee/files/14365900/Oski_Stealer.rar.html
1⤵
- Suspicious use of WriteProcessMemory
PID:4208
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.upload.ee/files/14365900/Oski_Stealer.rar.html
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4896
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4896.0.1079189740\1081613230" -parentBuildID 20200403170909 -prefsHandle 1544 -prefMapHandle 1536 -prefsLen 1 -prefMapSize 220115 -appdir "C:\Program Files\Mozilla Firefox\browser" - 4896 "\\.\pipe\gecko-crash-server-pipe.4896" 1624 gpu
    3⤵
    PID:2260
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4896.3.670438034\600102658" -childID 1 -isForBrowser -prefsHandle 2168 -prefMapHandle 2164 -prefsLen 156 -prefMapSize 220115 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 4896 "\\.\pipe\gecko-crash-server-pipe.4896" 2180 tab
    3⤵
    PID:4240
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4896.13.1128796080\1768239644" -childID 2 -isForBrowser -prefsHandle 3268 -prefMapHandle 3264 -prefsLen 6938 -prefMapSize 220115 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 4896 "\\.\pipe\gecko-crash-server-pipe.4896" 3280 tab
    3⤵
    PID:3760

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2016

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Oski_Stealer\" -spe -an -ai#7zMap25888:86:7zEvent30972
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3768

C:\Users\Admin\Downloads\Oski_Stealer\Oski_Stealer.exe
"C:\Users\Admin\Downloads\Oski_Stealer\Oski_Stealer.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3340

C:\Users\Admin\Downloads\Oski_Stealer\Oski_Stealer.exe
"C:\Users\Admin\Downloads\Oski_Stealer\Oski_Stealer.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1108
- C:\Users\Admin\Downloads\Oski_Stealer\crack.exe
  "C:\Users\Admin\Downloads\Oski_Stealer\crack.exe"
  2⤵
  - Executes dropped EXE
  - Drops startup file
  - Suspicious behavior: AddClipboardFormatListener
  PID:508

C:\Users\Admin\Downloads\Oski_Stealer\Oski Cracked.exe
"C:\Users\Admin\Downloads\Oski_Stealer\Oski Cracked.exe"
1⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3608

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2356

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:568

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:3816

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1876

C:\Users\Admin\Downloads\Oski_Stealer\Oski_Cracked_panel.com.exe
"C:\Users\Admin\Downloads\Oski_Stealer\Oski_Cracked_panel.com.exe"
1⤵
- Executes dropped EXE
PID:4888
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4888 -s 1212
  2⤵
  - Program crash
  PID:32

C:\Users\Admin\Downloads\Oski_Stealer\Oski_Cracked_panel.com.exe
"C:\Users\Admin\Downloads\Oski_Stealer\Oski_Cracked_panel.com.exe"
1⤵
- Executes dropped EXE
PID:4944
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4944 -s 1188
  2⤵
  - Program crash
  PID:3104

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\freebl3.dll

Filesize
146B

MD5
8eec510e57f5f732fd2cce73df7b73ef

SHA1
3c0af39ecb3753c5fee3b53d063c7286019eac3b

SHA256
55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0

SHA512
73bbf698482132b5fd60a0b58926fddec9055f8095a53bc52714e211e9340c3419736ceafd6b279667810114d306bfccdcfcddf51c0b67fe9e3c73c54583e574

Download Submit
C:\ProgramData\mozglue.dll

Filesize
146B

MD5
8eec510e57f5f732fd2cce73df7b73ef

SHA1
3c0af39ecb3753c5fee3b53d063c7286019eac3b

SHA256
55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0

SHA512
73bbf698482132b5fd60a0b58926fddec9055f8095a53bc52714e211e9340c3419736ceafd6b279667810114d306bfccdcfcddf51c0b67fe9e3c73c54583e574

Download Submit
C:\ProgramData\msvcp140.dll

Filesize
146B

MD5
8eec510e57f5f732fd2cce73df7b73ef

SHA1
3c0af39ecb3753c5fee3b53d063c7286019eac3b

SHA256
55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0

SHA512
73bbf698482132b5fd60a0b58926fddec9055f8095a53bc52714e211e9340c3419736ceafd6b279667810114d306bfccdcfcddf51c0b67fe9e3c73c54583e574

Download Submit
C:\ProgramData\nss3.dll

Filesize
146B

MD5
8eec510e57f5f732fd2cce73df7b73ef

SHA1
3c0af39ecb3753c5fee3b53d063c7286019eac3b

SHA256
55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0

SHA512
73bbf698482132b5fd60a0b58926fddec9055f8095a53bc52714e211e9340c3419736ceafd6b279667810114d306bfccdcfcddf51c0b67fe9e3c73c54583e574

Download Submit
C:\ProgramData\softokn3.dll

Filesize
146B

MD5
8eec510e57f5f732fd2cce73df7b73ef

SHA1
3c0af39ecb3753c5fee3b53d063c7286019eac3b

SHA256
55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0

SHA512
73bbf698482132b5fd60a0b58926fddec9055f8095a53bc52714e211e9340c3419736ceafd6b279667810114d306bfccdcfcddf51c0b67fe9e3c73c54583e574

Download Submit
C:\ProgramData\sqlite3.dll

Filesize
146B

MD5
8eec510e57f5f732fd2cce73df7b73ef

SHA1
3c0af39ecb3753c5fee3b53d063c7286019eac3b

SHA256
55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0

SHA512
73bbf698482132b5fd60a0b58926fddec9055f8095a53bc52714e211e9340c3419736ceafd6b279667810114d306bfccdcfcddf51c0b67fe9e3c73c54583e574

Download Submit
C:\ProgramData\vcruntime140.dll

Filesize
146B

MD5
8eec510e57f5f732fd2cce73df7b73ef

SHA1
3c0af39ecb3753c5fee3b53d063c7286019eac3b

SHA256
55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0

SHA512
73bbf698482132b5fd60a0b58926fddec9055f8095a53bc52714e211e9340c3419736ceafd6b279667810114d306bfccdcfcddf51c0b67fe9e3c73c54583e574

Download Submit
C:\Users\Admin\Downloads\Oski_Stealer.rar

Filesize
21.1MB

MD5
8b08722c088f4d3cd86f6febe3009218

SHA1
6f861205315deeb116e7089bdd6bf9084e5b319a

SHA256
5a98eeb8380e97436bd6d1f4a828b2e443e0020df9e8220b28a71e18b0338141

SHA512
1188110fe449c68ccd92d206dc19f759fdffe2bbe1f46c43113a23060f84a4a4254b8aa3d0b8afad5a052dfc14df580dd841ef80b850652b82a9feeb4672f08f

Download Submit
C:\Users\Admin\Downloads\Oski_Stealer\Oski Cracked.exe

Filesize
3.9MB

MD5
2bd0e61c45d352697c5e16437d8055b0

SHA1
0b9b24d396a50c2dc13d73e1f2d57c1891de3f31

SHA256
71efc8fc1dede4f96e837043ad3cbd38a65bd530ce71ae4d44ddc29843fab70b

SHA512
80044d4ece73637328e9b456c3127be02ecc9cea4b12fee65a884fed0266187aec58e6906c652face3b6125d59b9fa10303f02e1d8bfa33dbccb62fd2bc2b73d

Download Submit
C:\Users\Admin\Downloads\Oski_Stealer\Oski Cracked.exe

Filesize
3.9MB

MD5
2bd0e61c45d352697c5e16437d8055b0

SHA1
0b9b24d396a50c2dc13d73e1f2d57c1891de3f31

SHA256
71efc8fc1dede4f96e837043ad3cbd38a65bd530ce71ae4d44ddc29843fab70b

SHA512
80044d4ece73637328e9b456c3127be02ecc9cea4b12fee65a884fed0266187aec58e6906c652face3b6125d59b9fa10303f02e1d8bfa33dbccb62fd2bc2b73d

Download Submit
C:\Users\Admin\Downloads\Oski_Stealer\Oski_Cracked_panel.com.exe

Filesize
200KB

MD5
6a24d4e31d46c2f602996981fe525fb6

SHA1
4134cbbdfec13e772a5d4b7af79159248781ef04

SHA256
b1a5d1029b72e65e2063bbdfff90d6e6c9ce98863859ddfa0c5f38f7afa7b770

SHA512
338f1252beb06140b4ac07087b38cfa9cc6b8a116e42c448ba2a489daf5ed039d6715c2e7f2288e71d94e964eae0fae1387a00264251043ec69bb170a62f8cfe

Download Submit
C:\Users\Admin\Downloads\Oski_Stealer\Oski_Cracked_panel.com.exe

Filesize
200KB

MD5
6a24d4e31d46c2f602996981fe525fb6

SHA1
4134cbbdfec13e772a5d4b7af79159248781ef04

SHA256
b1a5d1029b72e65e2063bbdfff90d6e6c9ce98863859ddfa0c5f38f7afa7b770

SHA512
338f1252beb06140b4ac07087b38cfa9cc6b8a116e42c448ba2a489daf5ed039d6715c2e7f2288e71d94e964eae0fae1387a00264251043ec69bb170a62f8cfe

Download Submit
C:\Users\Admin\Downloads\Oski_Stealer\Oski_Cracked_panel.com.exe

Filesize
200KB

MD5
6a24d4e31d46c2f602996981fe525fb6

SHA1
4134cbbdfec13e772a5d4b7af79159248781ef04

SHA256
b1a5d1029b72e65e2063bbdfff90d6e6c9ce98863859ddfa0c5f38f7afa7b770

SHA512
338f1252beb06140b4ac07087b38cfa9cc6b8a116e42c448ba2a489daf5ed039d6715c2e7f2288e71d94e964eae0fae1387a00264251043ec69bb170a62f8cfe

Download Submit
C:\Users\Admin\Downloads\Oski_Stealer\Oski_Stealer.exe

Filesize
20.8MB

MD5
e805420c064b84ae287b068f14ffb2e8

SHA1
bbd5cf53618c2cdf47464d6c688d7baa433747c3

SHA256
d727c2ed17780b47f2c8661cf896d434d2a1946a30888245dd1d47e7e7fdcbbf

SHA512
0881d0023d54581a723f4523be720b42f8417cc9c0ad057fdc235ed90e246643034471300ec4fd6e5cb8d97d33ce136f9edabab5141f4af23fa27ec4dbd61e33

Download Submit
C:\Users\Admin\Downloads\Oski_Stealer\Oski_Stealer.exe

Filesize
20.8MB

MD5
e805420c064b84ae287b068f14ffb2e8

SHA1
bbd5cf53618c2cdf47464d6c688d7baa433747c3

SHA256
d727c2ed17780b47f2c8661cf896d434d2a1946a30888245dd1d47e7e7fdcbbf

SHA512
0881d0023d54581a723f4523be720b42f8417cc9c0ad057fdc235ed90e246643034471300ec4fd6e5cb8d97d33ce136f9edabab5141f4af23fa27ec4dbd61e33

Download Submit
C:\Users\Admin\Downloads\Oski_Stealer\Oski_Stealer.exe

Filesize
20.8MB

MD5
e805420c064b84ae287b068f14ffb2e8

SHA1
bbd5cf53618c2cdf47464d6c688d7baa433747c3

SHA256
d727c2ed17780b47f2c8661cf896d434d2a1946a30888245dd1d47e7e7fdcbbf

SHA512
0881d0023d54581a723f4523be720b42f8417cc9c0ad057fdc235ed90e246643034471300ec4fd6e5cb8d97d33ce136f9edabab5141f4af23fa27ec4dbd61e33

Download Submit
C:\Users\Admin\Downloads\Oski_Stealer\bat.exe

Filesize
200KB

MD5
3ac80dee855e85c52c0170373af79a04

SHA1
79b6a5708b05b88847b605dfe5271073826ba5f4

SHA256
52338add561f1e396b0f8377e77bae2a05bcb8d7cc19548dbf9ff8cf0b57cc1f

SHA512
0a2eae9404bec953ba84d98c05455b0fd42500c80ab66e8c9ffb19e102a81cb98dd09b82e862dbe15fb142e39165514ff6ac12d6acf47494a73222052923eb3c

Download Submit
C:\Users\Admin\Downloads\Oski_Stealer\bot.exe

Filesize
200KB

MD5
3ac80dee855e85c52c0170373af79a04

SHA1
79b6a5708b05b88847b605dfe5271073826ba5f4

SHA256
52338add561f1e396b0f8377e77bae2a05bcb8d7cc19548dbf9ff8cf0b57cc1f

SHA512
0a2eae9404bec953ba84d98c05455b0fd42500c80ab66e8c9ffb19e102a81cb98dd09b82e862dbe15fb142e39165514ff6ac12d6acf47494a73222052923eb3c

Download Submit
C:\Users\Admin\Downloads\Oski_Stealer\crack.exe

Filesize
18KB

MD5
2a62b2d78f2c0f2efd39f07641d231e1

SHA1
30e17f27edb951a306fd907e37aacc170bf3c7be

SHA256
b4b1dd5fc206b0089ca1e7d613d6475a9a06bbcf4c207830d7c0cf02a94ae79a

SHA512
4246bb79753f803aaeef24ec6bb9f5ec23859f2cc24d3cfb58c901722cd089b98cf8a2eae6763d18f1a2a330f71887aa8dfbfbd2bb92865680c2f1135a371ca5

Download Submit
C:\Users\Admin\Downloads\Oski_Stealer\crack.exe

Filesize
18KB

MD5
2a62b2d78f2c0f2efd39f07641d231e1

SHA1
30e17f27edb951a306fd907e37aacc170bf3c7be

SHA256
b4b1dd5fc206b0089ca1e7d613d6475a9a06bbcf4c207830d7c0cf02a94ae79a

SHA512
4246bb79753f803aaeef24ec6bb9f5ec23859f2cc24d3cfb58c901722cd089b98cf8a2eae6763d18f1a2a330f71887aa8dfbfbd2bb92865680c2f1135a371ca5

Download Submit
C:\Users\Admin\Downloads\Oski_Stealer\learn all kind of hacking.url

Filesize
121B

MD5
7ade4a739cbd8f44d0ef52a2f1bc6e7b

SHA1
20753d483e1a84cb248ba2c0fb72d44137d7d73f

SHA256
cc7649ed53c65e4851ace414529564fe16801bb2bed4cb15588bfd6b4ac13616

SHA512
5850c3d064c9d616854a47b4bd398b76494f1fbe9b356ec5e15879f97dc67970168196ec6b177fa71d15d25d25757a29319cbf9697f3a80461aa62b431d53851

Download Submit
memory/508-285-0x00000000002C0000-0x00000000002CC000-memory.dmp

Filesize
48KB

Download
memory/1108-141-0x0000000077C20000-0x0000000077DAE000-memory.dmp

Filesize
1.6MB

Download
memory/1108-159-0x0000000077C20000-0x0000000077DAE000-memory.dmp

Filesize
1.6MB

Download
memory/1108-143-0x0000000077C20000-0x0000000077DAE000-memory.dmp

Filesize
1.6MB

Download
memory/1108-146-0x0000000077C20000-0x0000000077DAE000-memory.dmp

Filesize
1.6MB

Download
memory/1108-135-0x0000000077C20000-0x0000000077DAE000-memory.dmp

Filesize
1.6MB

Download
memory/1108-139-0x0000000077C20000-0x0000000077DAE000-memory.dmp

Filesize
1.6MB

Download
memory/1108-137-0x0000000077C20000-0x0000000077DAE000-memory.dmp

Filesize
1.6MB

Download
memory/1108-140-0x0000000077C20000-0x0000000077DAE000-memory.dmp

Filesize
1.6MB

Download
memory/1108-157-0x0000000077C20000-0x0000000077DAE000-memory.dmp

Filesize
1.6MB

Download
memory/1108-152-0x0000000077C20000-0x0000000077DAE000-memory.dmp

Filesize
1.6MB

Download
memory/1108-154-0x0000000077C20000-0x0000000077DAE000-memory.dmp

Filesize
1.6MB

Download
memory/1108-156-0x0000000077C20000-0x0000000077DAE000-memory.dmp

Filesize
1.6MB

Download
memory/3340-176-0x0000000077C20000-0x0000000077DAE000-memory.dmp

Filesize
1.6MB

Download
memory/3340-155-0x0000000077C20000-0x0000000077DAE000-memory.dmp

Filesize
1.6MB

Download
memory/3340-161-0x0000000077C20000-0x0000000077DAE000-memory.dmp

Filesize
1.6MB

Download
memory/3340-163-0x0000000077C20000-0x0000000077DAE000-memory.dmp

Filesize
1.6MB

Download
memory/3340-164-0x0000000077C20000-0x0000000077DAE000-memory.dmp

Filesize
1.6MB

Download
memory/3340-166-0x0000000077C20000-0x0000000077DAE000-memory.dmp

Filesize
1.6MB

Download
memory/3340-167-0x0000000077C20000-0x0000000077DAE000-memory.dmp

Filesize
1.6MB

Download
memory/3340-168-0x0000000077C20000-0x0000000077DAE000-memory.dmp

Filesize
1.6MB

Download
memory/3340-170-0x0000000077C20000-0x0000000077DAE000-memory.dmp

Filesize
1.6MB

Download
memory/3340-142-0x0000000077C20000-0x0000000077DAE000-memory.dmp

Filesize
1.6MB

Download
memory/3340-172-0x0000000077C20000-0x0000000077DAE000-memory.dmp

Filesize
1.6MB

Download
memory/3340-173-0x0000000077C20000-0x0000000077DAE000-memory.dmp

Filesize
1.6MB

Download
memory/3340-175-0x0000000077C20000-0x0000000077DAE000-memory.dmp

Filesize
1.6MB

Download
memory/3340-174-0x0000000077C20000-0x0000000077DAE000-memory.dmp

Filesize
1.6MB

Download
memory/3340-177-0x0000000077C20000-0x0000000077DAE000-memory.dmp

Filesize
1.6MB

Download
memory/3340-179-0x0000000077C20000-0x0000000077DAE000-memory.dmp

Filesize
1.6MB

Download
memory/3340-180-0x0000000077C20000-0x0000000077DAE000-memory.dmp

Filesize
1.6MB

Download
memory/3340-182-0x0000000077C20000-0x0000000077DAE000-memory.dmp

Filesize
1.6MB

Download
memory/3340-183-0x0000000077C20000-0x0000000077DAE000-memory.dmp

Filesize
1.6MB

Download
memory/3340-181-0x0000000077C20000-0x0000000077DAE000-memory.dmp

Filesize
1.6MB

Download
memory/3340-178-0x0000000077C20000-0x0000000077DAE000-memory.dmp

Filesize
1.6MB

Download
memory/3340-144-0x0000000077C20000-0x0000000077DAE000-memory.dmp

Filesize
1.6MB

Download
memory/3340-169-0x0000000077C20000-0x0000000077DAE000-memory.dmp

Filesize
1.6MB

Download
memory/3340-165-0x0000000077C20000-0x0000000077DAE000-memory.dmp

Filesize
1.6MB

Download
memory/3340-162-0x0000000077C20000-0x0000000077DAE000-memory.dmp

Filesize
1.6MB

Download
memory/3340-160-0x0000000077C20000-0x0000000077DAE000-memory.dmp

Filesize
1.6MB

Download
memory/3340-150-0x0000000077C20000-0x0000000077DAE000-memory.dmp

Filesize
1.6MB

Download
memory/3340-158-0x0000000077C20000-0x0000000077DAE000-memory.dmp

Filesize
1.6MB

Download
memory/3340-153-0x0000000077C20000-0x0000000077DAE000-memory.dmp

Filesize
1.6MB

Download
memory/3340-151-0x0000000077C20000-0x0000000077DAE000-memory.dmp

Filesize
1.6MB

Download
memory/3340-145-0x0000000077C20000-0x0000000077DAE000-memory.dmp

Filesize
1.6MB

Download
memory/3340-136-0x0000000077C20000-0x0000000077DAE000-memory.dmp

Filesize
1.6MB

Download
memory/3340-147-0x0000000077C20000-0x0000000077DAE000-memory.dmp

Filesize
1.6MB

Download
memory/3340-138-0x0000000077C20000-0x0000000077DAE000-memory.dmp

Filesize
1.6MB

Download
memory/3340-149-0x0000000077C20000-0x0000000077DAE000-memory.dmp

Filesize
1.6MB

Download
memory/3340-148-0x0000000077C20000-0x0000000077DAE000-memory.dmp

Filesize
1.6MB

Download
memory/3340-133-0x0000000077C20000-0x0000000077DAE000-memory.dmp

Filesize
1.6MB

Download
memory/3340-132-0x0000000077C20000-0x0000000077DAE000-memory.dmp

Filesize
1.6MB

Download
memory/3340-131-0x0000000077C20000-0x0000000077DAE000-memory.dmp

Filesize
1.6MB

Download
memory/3340-118-0x0000000077C20000-0x0000000077DAE000-memory.dmp

Filesize
1.6MB

Download
memory/3340-119-0x0000000077C20000-0x0000000077DAE000-memory.dmp

Filesize
1.6MB

Download
memory/3340-130-0x0000000077C20000-0x0000000077DAE000-memory.dmp

Filesize
1.6MB

Download
memory/3340-129-0x0000000077C20000-0x0000000077DAE000-memory.dmp

Filesize
1.6MB

Download
memory/3340-128-0x0000000077C20000-0x0000000077DAE000-memory.dmp

Filesize
1.6MB

Download
memory/3340-127-0x0000000077C20000-0x0000000077DAE000-memory.dmp

Filesize
1.6MB

Download
memory/3340-126-0x0000000077C20000-0x0000000077DAE000-memory.dmp

Filesize
1.6MB

Download
memory/3340-125-0x0000000077C20000-0x0000000077DAE000-memory.dmp

Filesize
1.6MB

Download
memory/3340-124-0x0000000077C20000-0x0000000077DAE000-memory.dmp

Filesize
1.6MB

Download
memory/3340-123-0x0000000077C20000-0x0000000077DAE000-memory.dmp

Filesize
1.6MB

Download
memory/3340-122-0x0000000077C20000-0x0000000077DAE000-memory.dmp

Filesize
1.6MB

Download
memory/3340-121-0x0000000077C20000-0x0000000077DAE000-memory.dmp

Filesize
1.6MB

Download
memory/3340-120-0x0000000077C20000-0x0000000077DAE000-memory.dmp

Filesize
1.6MB

Download
memory/3608-289-0x000000001B670000-0x000000001BA8C000-memory.dmp

Filesize
4.1MB

Download
memory/3608-288-0x0000000000650000-0x0000000000A46000-memory.dmp

Filesize
4.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads