oski | 59da2850cf792098c077c2a35e0da9116680a7f839e177a7bf13b883c68fe2af

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2023 15:09

Target

d2b540b79ab88215e0feea2f14d8fdad.ps1
Size

421KB
MD5

d2b540b79ab88215e0feea2f14d8fdad
SHA1

b291407a69c015600aae5d7a443abb4b7ed450ca
SHA256

59da2850cf792098c077c2a35e0da9116680a7f839e177a7bf13b883c68fe2af
SHA512

a180787cefb7c9b9d6f693ece008fec6d30e41288f1e6e9f435c0a7a2b0015a8069fbc0a2f5ada8786f43b144a6ee58289e85c2b5da348a5524d745b7f5f4d4b
SSDEEP

12288:+Zjw0RJ9u5ILYDxD3fxYehza/tw64mL68:q3Z

Score

10^/10

oski infostealer

Family

oski

103.114.107.28/l13/

Oski
Oski is an infostealer targeting browser data, crypto wallets.
infostealer oski

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3880 set thread context of 1612	3880	powershell.exe	20

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1368	1612	WerFault.exe	20

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3880	powershell.exe
3880	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3880	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3880 wrote to memory of 1612	3880	powershell.exe	20
PID 3880 wrote to memory of 1612	3880	powershell.exe	20
PID 3880 wrote to memory of 1612	3880	powershell.exe	20
PID 3880 wrote to memory of 1612	3880	powershell.exe	20
PID 3880 wrote to memory of 1612	3880	powershell.exe	20
PID 3880 wrote to memory of 1612	3880	powershell.exe	20
PID 3880 wrote to memory of 1612	3880	powershell.exe	20
PID 3880 wrote to memory of 1612	3880	powershell.exe	20
PID 3880 wrote to memory of 1612	3880	powershell.exe	20

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1612 -ip 1612
1⤵
PID:4912

memory/1612-14-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1612-20-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1612-19-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1612-17-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1612-21-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1612-24-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3880-0-0x00000297FFDD0000-0x00000297FFDF2000-memory.dmp

Filesize
136KB

Download
memory/3880-12-0x00000297985E0000-0x00000297985F0000-memory.dmp

Filesize
64KB

Download
memory/3880-11-0x00000297985E0000-0x00000297985F0000-memory.dmp

Filesize
64KB

Download
memory/3880-10-0x00007FFA76D40000-0x00007FFA77801000-memory.dmp

Filesize
10.8MB

Download
memory/3880-18-0x00007FFA76D40000-0x00007FFA77801000-memory.dmp

Filesize
10.8MB

Download
memory/3880-13-0x0000029799350000-0x000002979935A000-memory.dmp

Filesize
40KB

Download