oski | 59da2850cf792098c077c2a35e0da9116680a7f839e177a7bf13b883c68fe2af

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22-12-2023 15:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d2b540b79ab88215e0feea2f14d8fdad.ps1
Size

421KB
MD5

d2b540b79ab88215e0feea2f14d8fdad
SHA1

b291407a69c015600aae5d7a443abb4b7ed450ca
SHA256

59da2850cf792098c077c2a35e0da9116680a7f839e177a7bf13b883c68fe2af
SHA512

a180787cefb7c9b9d6f693ece008fec6d30e41288f1e6e9f435c0a7a2b0015a8069fbc0a2f5ada8786f43b144a6ee58289e85c2b5da348a5524d745b7f5f4d4b
SSDEEP

12288:+Zjw0RJ9u5ILYDxD3fxYehza/tw64mL68:q3Z

Score

10^/10

oski infostealer

Malware Config

Extracted

Family

oski

103.114.107.28/l13/

Signatures

Oski
Oski is an infostealer targeting browser data, crypto wallets.
infostealer oski

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2020 set thread context of 2440	2020	powershell.exe	29

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2020	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2020	powershell.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 2440	2020	powershell.exe	29
PID 2020 wrote to memory of 2440	2020	powershell.exe	29
PID 2020 wrote to memory of 2440	2020	powershell.exe	29
PID 2020 wrote to memory of 2440	2020	powershell.exe	29
PID 2020 wrote to memory of 2440	2020	powershell.exe	29
PID 2020 wrote to memory of 2440	2020	powershell.exe	29
PID 2020 wrote to memory of 2440	2020	powershell.exe	29
PID 2020 wrote to memory of 2440	2020	powershell.exe	29
PID 2020 wrote to memory of 2440	2020	powershell.exe	29
PID 2020 wrote to memory of 2440	2020	powershell.exe	29

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\d2b540b79ab88215e0feea2f14d8fdad.ps1
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "{path}"
  2⤵
  PID:2440

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2020-21-0x000007FEF5DE0000-0x000007FEF677D000-memory.dmp

Filesize
9.6MB

Download
memory/2020-5-0x0000000001F00000-0x0000000001F08000-memory.dmp

Filesize
32KB

Download
memory/2020-7-0x0000000002ED0000-0x0000000002F50000-memory.dmp

Filesize
512KB

Download
memory/2020-9-0x0000000002ED0000-0x0000000002F50000-memory.dmp

Filesize
512KB

Download
memory/2020-8-0x000007FEF5DE0000-0x000007FEF677D000-memory.dmp

Filesize
9.6MB

Download
memory/2020-10-0x0000000002ED0000-0x0000000002F50000-memory.dmp

Filesize
512KB

Download
memory/2020-6-0x000007FEF5DE0000-0x000007FEF677D000-memory.dmp

Filesize
9.6MB

Download
memory/2020-11-0x0000000002BA0000-0x0000000002BAA000-memory.dmp

Filesize
40KB

Download
memory/2020-4-0x000000001B720000-0x000000001BA02000-memory.dmp

Filesize
2.9MB

Download
memory/2440-17-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2440-22-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2440-20-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2440-16-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2440-15-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2440-14-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2440-13-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2440-12-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2440-18-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2440-23-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download