oski | c74dd60489c92b69bd23792a9a2fc5bd963de6781993a66e9b519d6317c93df2

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22-12-2023 16:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f1a8247a688ebcb34d728f27ff8489dd.ps1
Size

421KB
MD5

f1a8247a688ebcb34d728f27ff8489dd
SHA1

33857481b9c0807642983896744082620efc0de7
SHA256

c74dd60489c92b69bd23792a9a2fc5bd963de6781993a66e9b519d6317c93df2
SHA512

35aee40dab7f1ec7ef5ba79feb70886518f899c8a5c2662e6e896e9c45099acf2593b9a14595bdac2132eb6d4be840b8a72176a138fe8766a555a1db9266ed0c
SSDEEP

12288:+Zjw0RJ9u5ILYDxD3fxYehza/tw64bL68:q3c

Score

10^/10

oski infostealer

Malware Config

Extracted

Family

oski

/103.114.107.28/l38/

Signatures

Oski
Oski is an infostealer targeting browser data, crypto wallets.
infostealer oski

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2080 set thread context of 2852	2080	powershell.exe	30

Program crash 1 IoCs

pid	pid_target	Process
2800	2852	WerFault.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2080	powershell.exe
2080	powershell.exe
2080	powershell.exe
2080	powershell.exe
2080	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2080	powershell.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 2292	2080	powershell.exe	32
PID 2080 wrote to memory of 2292	2080	powershell.exe	32
PID 2080 wrote to memory of 2292	2080	powershell.exe	32
PID 2080 wrote to memory of 2292	2080	powershell.exe	32
PID 2080 wrote to memory of 2836	2080	powershell.exe	31
PID 2080 wrote to memory of 2836	2080	powershell.exe	31
PID 2080 wrote to memory of 2836	2080	powershell.exe	31
PID 2080 wrote to memory of 2836	2080	powershell.exe	31
PID 2080 wrote to memory of 2852	2080	powershell.exe	30
PID 2080 wrote to memory of 2852	2080	powershell.exe	30
PID 2080 wrote to memory of 2852	2080	powershell.exe	30
PID 2080 wrote to memory of 2852	2080	powershell.exe	30
PID 2080 wrote to memory of 2852	2080	powershell.exe	30
PID 2080 wrote to memory of 2852	2080	powershell.exe	30
PID 2080 wrote to memory of 2852	2080	powershell.exe	30
PID 2080 wrote to memory of 2852	2080	powershell.exe	30
PID 2080 wrote to memory of 2852	2080	powershell.exe	30
PID 2080 wrote to memory of 2852	2080	powershell.exe	30
PID 2852 wrote to memory of 2800	2852	MSBuild.exe	29
PID 2852 wrote to memory of 2800	2852	MSBuild.exe	29
PID 2852 wrote to memory of 2800	2852	MSBuild.exe	29
PID 2852 wrote to memory of 2800	2852	MSBuild.exe	29

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\f1a8247a688ebcb34d728f27ff8489dd.ps1
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "{path}"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2852
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "{path}"
  2⤵
  PID:2836
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "{path}"
  2⤵
  PID:2292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 496
1⤵
- Program crash
PID:2800

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2080-4-0x000000001B5F0000-0x000000001B8D2000-memory.dmp

Filesize
2.9MB

Download
memory/2080-5-0x0000000002860000-0x0000000002868000-memory.dmp

Filesize
32KB

Download
memory/2080-6-0x000007FEF4850000-0x000007FEF51ED000-memory.dmp

Filesize
9.6MB

Download
memory/2080-7-0x0000000002B10000-0x0000000002B90000-memory.dmp

Filesize
512KB

Download
memory/2080-8-0x000007FEF4850000-0x000007FEF51ED000-memory.dmp

Filesize
9.6MB

Download
memory/2080-9-0x0000000002B10000-0x0000000002B90000-memory.dmp

Filesize
512KB

Download
memory/2080-11-0x0000000002B10000-0x0000000002B90000-memory.dmp

Filesize
512KB

Download
memory/2080-10-0x0000000002B10000-0x0000000002B90000-memory.dmp

Filesize
512KB

Download
memory/2080-12-0x0000000002A60000-0x0000000002A6A000-memory.dmp

Filesize
40KB

Download
memory/2080-27-0x000007FEF4850000-0x000007FEF51ED000-memory.dmp

Filesize
9.6MB

Download
memory/2852-23-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2852-21-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2852-28-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2852-24-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2852-26-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2852-19-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2852-17-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2852-15-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2852-13-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2852-30-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download