oski | 572c0ed2674a63ce3e58d42a019cdaca9cce57398636a07432da48f4920421c7

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
22-12-2023 04:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

691bcebe74dfe8204bb6eb1ca4f37f6b.ps1
Size

421KB
MD5

691bcebe74dfe8204bb6eb1ca4f37f6b
SHA1

de511e989219a1d93d778c448d28e2c585acc113
SHA256

572c0ed2674a63ce3e58d42a019cdaca9cce57398636a07432da48f4920421c7
SHA512

8b4d64c8c725cb8b464eb1ea85a4321ab1d3732f9b21eb7c4b6d2111b0643358b24d03777d806f858f8ccefab7e4693f29e74e64099792357abbc3a6f8263375
SSDEEP

12288:+Zjw0RJ9u5ILYDxD3fxYehza/tw64oL68:q3r

Score

10^/10

oski infostealer

Malware Config

Extracted

Family

oski

/103.114.107.28/l33/

Signatures

Oski
Oski is an infostealer targeting browser data, crypto wallets.
infostealer oski

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2220 set thread context of 2600	2220	powershell.exe	30

Program crash 1 IoCs

pid	pid_target	Process
2772	2600	WerFault.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2220	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2220	powershell.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2600	2220	powershell.exe	30
PID 2220 wrote to memory of 2600	2220	powershell.exe	30
PID 2220 wrote to memory of 2600	2220	powershell.exe	30
PID 2220 wrote to memory of 2600	2220	powershell.exe	30
PID 2220 wrote to memory of 2600	2220	powershell.exe	30
PID 2220 wrote to memory of 2600	2220	powershell.exe	30
PID 2220 wrote to memory of 2600	2220	powershell.exe	30
PID 2220 wrote to memory of 2600	2220	powershell.exe	30
PID 2220 wrote to memory of 2600	2220	powershell.exe	30
PID 2220 wrote to memory of 2600	2220	powershell.exe	30
PID 2600 wrote to memory of 2772	2600	MSBuild.exe	29
PID 2600 wrote to memory of 2772	2600	MSBuild.exe	29
PID 2600 wrote to memory of 2772	2600	MSBuild.exe	29
PID 2600 wrote to memory of 2772	2600	MSBuild.exe	29

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\691bcebe74dfe8204bb6eb1ca4f37f6b.ps1
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "{path}"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2600 -s 504
1⤵
- Program crash
PID:2772

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2220-26-0x000007FEF52A0000-0x000007FEF5C3D000-memory.dmp

Filesize
9.6MB

Download
memory/2220-4-0x000000001B750000-0x000000001BA32000-memory.dmp

Filesize
2.9MB

Download
memory/2220-5-0x0000000001EB0000-0x0000000001EB8000-memory.dmp

Filesize
32KB

Download
memory/2220-6-0x000007FEF52A0000-0x000007FEF5C3D000-memory.dmp

Filesize
9.6MB

Download
memory/2220-8-0x000007FEF52A0000-0x000007FEF5C3D000-memory.dmp

Filesize
9.6MB

Download
memory/2220-9-0x0000000002AB0000-0x0000000002B30000-memory.dmp

Filesize
512KB

Download
memory/2220-10-0x0000000002AB0000-0x0000000002B30000-memory.dmp

Filesize
512KB

Download
memory/2220-11-0x00000000020C0000-0x00000000020CA000-memory.dmp

Filesize
40KB

Download
memory/2220-7-0x0000000002AB0000-0x0000000002B30000-memory.dmp

Filesize
512KB

Download
memory/2600-29-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2600-22-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2600-27-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2600-20-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2600-18-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2600-16-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2600-14-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2600-12-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2600-23-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2600-25-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download