oski | e423ba7a079fb14c18abd0592a0278db38d71aa3dd70730f557a9036bedd31c5

General

Target

e423ba7a079fb14c18abd0592a0278db38d71aa3dd70730f557a9036bedd31c5.exe
Size

412KB
MD5

e1f89a0e2ec8b806a92ff573d6e305ab
SHA1

e8183cf8dd1c7cb56e02296f116b65c40270489a
SHA256

e423ba7a079fb14c18abd0592a0278db38d71aa3dd70730f557a9036bedd31c5
SHA512

b9231220b1be9c2c8bf8bdb88049b60c4634d1c02bc13b05c4f845d7b0436445ab006023bcc74066c89c0f07f8ad179b80e5fa666c3f81583ec482cdc946cf64
SSDEEP

12288:D4osTQRZUG+KAqdKrvOTnZtVj2Pg8zs2:D4J9311Rs2

Score

10^/10

oski infostealer spyware stealer

Malware Config

Extracted

Family

oski

C2

timecforgoodnes.ml

Signatures

Oski
Oski is an infostealer targeting browser data, crypto wallets.
infostealer oski
Executes dropped EXE 1 IoCs

Processes:

e423ba7a079fb14c18abd0592a0278db38d71aa3dd70730f557a9036bedd31c5.exe

pid process

4460 e423ba7a079fb14c18abd0592a0278db38d71aa3dd70730f557a9036bedd31c5.exe

pid	process
4460	e423ba7a079fb14c18abd0592a0278db38d71aa3dd70730f557a9036bedd31c5.exe

Drops startup file 1 IoCs

Processes:

e423ba7a079fb14c18abd0592a0278db38d71aa3dd70730f557a9036bedd31c5.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.js	e423ba7a079fb14c18abd0592a0278db38d71aa3dd70730f557a9036bedd31c5.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

Processes:

e423ba7a079fb14c18abd0592a0278db38d71aa3dd70730f557a9036bedd31c5.exe

description	pid	process	target process
PID 5020 set thread context of 4460	5020	e423ba7a079fb14c18abd0592a0278db38d71aa3dd70730f557a9036bedd31c5.exe	e423ba7a079fb14c18abd0592a0278db38d71aa3dd70730f557a9036bedd31c5.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4428 4460 WerFault.exe e423ba7a079fb14c18abd0592a0278db38d71aa3dd70730f557a9036bedd31c5.exe

pid	pid_target	process	target process
4428	4460	WerFault.exe	e423ba7a079fb14c18abd0592a0278db38d71aa3dd70730f557a9036bedd31c5.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

e423ba7a079fb14c18abd0592a0278db38d71aa3dd70730f557a9036bedd31c5.exe

pid	process
5020	e423ba7a079fb14c18abd0592a0278db38d71aa3dd70730f557a9036bedd31c5.exe
5020	e423ba7a079fb14c18abd0592a0278db38d71aa3dd70730f557a9036bedd31c5.exe
5020	e423ba7a079fb14c18abd0592a0278db38d71aa3dd70730f557a9036bedd31c5.exe
5020	e423ba7a079fb14c18abd0592a0278db38d71aa3dd70730f557a9036bedd31c5.exe
5020	e423ba7a079fb14c18abd0592a0278db38d71aa3dd70730f557a9036bedd31c5.exe
5020	e423ba7a079fb14c18abd0592a0278db38d71aa3dd70730f557a9036bedd31c5.exe
5020	e423ba7a079fb14c18abd0592a0278db38d71aa3dd70730f557a9036bedd31c5.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

e423ba7a079fb14c18abd0592a0278db38d71aa3dd70730f557a9036bedd31c5.exe

description pid process

Token: SeDebugPrivilege 5020 e423ba7a079fb14c18abd0592a0278db38d71aa3dd70730f557a9036bedd31c5.exe

description	pid	process
Token: SeDebugPrivilege	5020	e423ba7a079fb14c18abd0592a0278db38d71aa3dd70730f557a9036bedd31c5.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

e423ba7a079fb14c18abd0592a0278db38d71aa3dd70730f557a9036bedd31c5.exe

description	pid	process	target process
PID 5020 wrote to memory of 4460	5020	e423ba7a079fb14c18abd0592a0278db38d71aa3dd70730f557a9036bedd31c5.exe	e423ba7a079fb14c18abd0592a0278db38d71aa3dd70730f557a9036bedd31c5.exe
PID 5020 wrote to memory of 4460	5020	e423ba7a079fb14c18abd0592a0278db38d71aa3dd70730f557a9036bedd31c5.exe	e423ba7a079fb14c18abd0592a0278db38d71aa3dd70730f557a9036bedd31c5.exe
PID 5020 wrote to memory of 4460	5020	e423ba7a079fb14c18abd0592a0278db38d71aa3dd70730f557a9036bedd31c5.exe	e423ba7a079fb14c18abd0592a0278db38d71aa3dd70730f557a9036bedd31c5.exe
PID 5020 wrote to memory of 4460	5020	e423ba7a079fb14c18abd0592a0278db38d71aa3dd70730f557a9036bedd31c5.exe	e423ba7a079fb14c18abd0592a0278db38d71aa3dd70730f557a9036bedd31c5.exe
PID 5020 wrote to memory of 4460	5020	e423ba7a079fb14c18abd0592a0278db38d71aa3dd70730f557a9036bedd31c5.exe	e423ba7a079fb14c18abd0592a0278db38d71aa3dd70730f557a9036bedd31c5.exe
PID 5020 wrote to memory of 4460	5020	e423ba7a079fb14c18abd0592a0278db38d71aa3dd70730f557a9036bedd31c5.exe	e423ba7a079fb14c18abd0592a0278db38d71aa3dd70730f557a9036bedd31c5.exe
PID 5020 wrote to memory of 4460	5020	e423ba7a079fb14c18abd0592a0278db38d71aa3dd70730f557a9036bedd31c5.exe	e423ba7a079fb14c18abd0592a0278db38d71aa3dd70730f557a9036bedd31c5.exe
PID 5020 wrote to memory of 4460	5020	e423ba7a079fb14c18abd0592a0278db38d71aa3dd70730f557a9036bedd31c5.exe	e423ba7a079fb14c18abd0592a0278db38d71aa3dd70730f557a9036bedd31c5.exe
PID 5020 wrote to memory of 4460	5020	e423ba7a079fb14c18abd0592a0278db38d71aa3dd70730f557a9036bedd31c5.exe	e423ba7a079fb14c18abd0592a0278db38d71aa3dd70730f557a9036bedd31c5.exe

C:\Users\Admin\AppData\Local\Temp\e423ba7a079fb14c18abd0592a0278db38d71aa3dd70730f557a9036bedd31c5.exe
"C:\Users\Admin\AppData\Local\Temp\e423ba7a079fb14c18abd0592a0278db38d71aa3dd70730f557a9036bedd31c5.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5020

C:\Users\Admin\AppData\Local\Temp\e423ba7a079fb14c18abd0592a0278db38d71aa3dd70730f557a9036bedd31c5.exe
"C:\Users\Admin\AppData\Local\Temp\e423ba7a079fb14c18abd0592a0278db38d71aa3dd70730f557a9036bedd31c5.exe"
2⤵
- Executes dropped EXE
PID:4460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4460 -s 1324
3⤵
- Program crash
PID:4428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4460 -ip 4460
1⤵
PID:3880

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\e423ba7a079fb14c18abd0592a0278db38d71aa3dd70730f557a9036bedd31c5.exe
Filesize
412KB

MD5
e1f89a0e2ec8b806a92ff573d6e305ab

SHA1
e8183cf8dd1c7cb56e02296f116b65c40270489a

SHA256
e423ba7a079fb14c18abd0592a0278db38d71aa3dd70730f557a9036bedd31c5

SHA512
b9231220b1be9c2c8bf8bdb88049b60c4634d1c02bc13b05c4f845d7b0436445ab006023bcc74066c89c0f07f8ad179b80e5fa666c3f81583ec482cdc946cf64

Download Submit
memory/4460-134-0x0000000000000000-mapping.dmp

Download
memory/4460-135-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4460-137-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4460-138-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4460-140-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4460-141-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/5020-132-0x0000000075490000-0x0000000075A41000-memory.dmp

Filesize
5.7MB

Download
memory/5020-133-0x0000000075490000-0x0000000075A41000-memory.dmp

Filesize
5.7MB

Download
memory/5020-139-0x0000000075490000-0x0000000075A41000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads