oski | e865ac29af489c45c0ff92620ffa03cbfc038cdd3eaa5f1b16c056c827c0425f

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
22-12-2023 00:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3c2582267b0fcfb137f40d2694937d5a.ps1
Size

421KB
MD5

3c2582267b0fcfb137f40d2694937d5a
SHA1

1ceccfe25d953c028ad5b4e283613f4fd8b1a169
SHA256

e865ac29af489c45c0ff92620ffa03cbfc038cdd3eaa5f1b16c056c827c0425f
SHA512

bcc47ab560366008fb0c80ac84132e14b7beecb7df3c8de4d72df07f3936ca68767091a30a3e4e98323f5f4d41fca927907545d283dbe3bd40827c0f475e7128
SSDEEP

12288:+Zjw0RJ9u5ILYDxD3fxYehza/tw64EL68:q3v

Score

10^/10

oski infostealer

Malware Config

Extracted

Family

oski

/103.114.107.28/l1616/

Signatures

Oski
Oski is an infostealer targeting browser data, crypto wallets.
infostealer oski

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2024 set thread context of 2308	2024	powershell.exe	30

Program crash 1 IoCs

pid	pid_target	Process
2872	2308	WerFault.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2024	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2024	powershell.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 2308	2024	powershell.exe	30
PID 2024 wrote to memory of 2308	2024	powershell.exe	30
PID 2024 wrote to memory of 2308	2024	powershell.exe	30
PID 2024 wrote to memory of 2308	2024	powershell.exe	30
PID 2024 wrote to memory of 2308	2024	powershell.exe	30
PID 2024 wrote to memory of 2308	2024	powershell.exe	30
PID 2024 wrote to memory of 2308	2024	powershell.exe	30
PID 2024 wrote to memory of 2308	2024	powershell.exe	30
PID 2024 wrote to memory of 2308	2024	powershell.exe	30
PID 2024 wrote to memory of 2308	2024	powershell.exe	30
PID 2308 wrote to memory of 2872	2308	MSBuild.exe	29
PID 2308 wrote to memory of 2872	2308	MSBuild.exe	29
PID 2308 wrote to memory of 2872	2308	MSBuild.exe	29
PID 2308 wrote to memory of 2872	2308	MSBuild.exe	29

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\3c2582267b0fcfb137f40d2694937d5a.ps1
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "{path}"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2308 -s 500
1⤵
- Program crash
PID:2872

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2024-21-0x000007FEF57D0000-0x000007FEF616D000-memory.dmp

Filesize
9.6MB

Download
memory/2024-7-0x0000000002910000-0x0000000002990000-memory.dmp

Filesize
512KB

Download
memory/2024-6-0x000007FEF57D0000-0x000007FEF616D000-memory.dmp

Filesize
9.6MB

Download
memory/2024-8-0x000007FEF57D0000-0x000007FEF616D000-memory.dmp

Filesize
9.6MB

Download
memory/2024-10-0x0000000002910000-0x0000000002990000-memory.dmp

Filesize
512KB

Download
memory/2024-9-0x0000000002910000-0x0000000002990000-memory.dmp

Filesize
512KB

Download
memory/2024-4-0x000000001B6F0000-0x000000001B9D2000-memory.dmp

Filesize
2.9MB

Download
memory/2024-11-0x0000000002A60000-0x0000000002A6A000-memory.dmp

Filesize
40KB

Download
memory/2024-5-0x00000000027F0000-0x00000000027F8000-memory.dmp

Filesize
32KB

Download
memory/2308-22-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2308-20-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2308-18-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2308-17-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2308-16-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2308-15-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2308-14-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2308-12-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2308-13-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2308-24-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download