oski | 59da2850cf792098c077c2a35e0da9116680a7f839e177a7bf13b883c68fe2af

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22/12/2023, 15:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d2b540b79ab88215e0feea2f14d8fdad.ps1
Size 421KB
Sample231222-sjp17shfa2
SHA256 59da2850cf792098c077c2a35e0da9116680a7f839e177a7bf13b883c68fe2af
MD5 d2b540b79ab88215e0feea2f14d8fdad
SHA1 b291407a69c015600aae5d7a443abb4b7ed450ca
SHA512 a180787cefb7c9b9d6f693ece008fec6d30e41288f1e6e9f435c0a7a2b0015a8069fbc0a2f5ada8786f43b144a6ee58289e85c2b5da348a5524d745b7f5f4d4b
SSDEEP 12288:+Zjw0RJ9u5ILYDxD3fxYehza/tw64mL68:q3Z
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

oski infostealer

Malware Config

Extracted

Family

oski

103.114.107.28/l13/

Signatures

Oski
Oski is an infostealer targeting browser data, crypto wallets.
infostealer oski

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3880 set thread context of 1612	3880	powershell.exe	20

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1368	1612	WerFault.exe	20

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3880	powershell.exe
3880	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3880	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3880 wrote to memory of 1612	3880	powershell.exe	20
PID 3880 wrote to memory of 1612	3880	powershell.exe	20
PID 3880 wrote to memory of 1612	3880	powershell.exe	20
PID 3880 wrote to memory of 1612	3880	powershell.exe	20
PID 3880 wrote to memory of 1612	3880	powershell.exe	20
PID 3880 wrote to memory of 1612	3880	powershell.exe	20
PID 3880 wrote to memory of 1612	3880	powershell.exe	20
PID 3880 wrote to memory of 1612	3880	powershell.exe	20
PID 3880 wrote to memory of 1612	3880	powershell.exe	20

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\d2b540b79ab88215e0feea2f14d8fdad.ps1
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3880
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "{path}"
  2⤵
  PID:1612
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1612 -s 1196
    3⤵
    - Program crash
    PID:1368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1612 -ip 1612
1⤵
PID:4912

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1612-14-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1612-20-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1612-19-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1612-17-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1612-21-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1612-24-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3880-0-0x00000297FFDD0000-0x00000297FFDF2000-memory.dmp

Download

memory/3880-12-0x00000297985E0000-0x00000297985F0000-memory.dmp

Download

memory/3880-11-0x00000297985E0000-0x00000297985F0000-memory.dmp

Download

memory/3880-10-0x00007FFA76D40000-0x00007FFA77801000-memory.dmp

Download

memory/3880-18-0x00007FFA76D40000-0x00007FFA77801000-memory.dmp

Download

memory/3880-13-0x0000029799350000-0x000002979935A000-memory.dmp

Download