oski | d94c8028fa7fd7062dc2cd8c78b458d68bc7c8e8e260afc827bef217aeeac693

General

Target

e4086615e3011d916a50689cef433c77.exe
Size

5.4MB
MD5

e4086615e3011d916a50689cef433c77
SHA1

24c38d07046c2781f01d98ae3d7b1d9a80ea69e0
SHA256

d94c8028fa7fd7062dc2cd8c78b458d68bc7c8e8e260afc827bef217aeeac693
SHA512

06ed1a259f5d6f668508399e61a4465eabd642f966ea0903746ac6b4981f5df7bdaef2de231d1b50f5d271b357435aed21b81b66ed2fca78e219ea72d8db7966
SSDEEP

98304:3EAKCzqdfS72BW2WLASB3MgsESIXaM3dm8j6o8DQDvALRmn6BKVq:0LNS7tASVMgdR3sWx5LALonQK4

Score

10^/10

oski stormkitty infostealer spyware stealer

Malware Config

Extracted

Family

oski

C2

web24host.com/a/a/www/

Signatures

Oski
Oski is an infostealer targeting browser data, crypto wallets.
infostealer oski
StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 5 IoCs

resource	yara_rule
behavioral1/files/0x000b000000012248-4.dat	family_stormkitty
behavioral1/memory/2460-25-0x000000013FA90000-0x000000013FAE0000-memory.dmp	family_stormkitty
behavioral1/memory/2460-29-0x0000000002230000-0x00000000022A4000-memory.dmp	family_stormkitty
behavioral1/memory/2460-32-0x000000001BA90000-0x000000001BB10000-memory.dmp	family_stormkitty
behavioral1/memory/2460-48-0x000000001BA90000-0x000000001BB10000-memory.dmp	family_stormkitty

Executes dropped EXE 4 IoCs

pid	Process
2460	Microsoft Update.exe
2708	Cliper.exe
2136	MACGen.v1.7.exe
1224	Process not Found

Loads dropped DLL 12 IoCs

pid	Process
2456	e4086615e3011d916a50689cef433c77.exe
2456	e4086615e3011d916a50689cef433c77.exe
2456	e4086615e3011d916a50689cef433c77.exe
2708	Cliper.exe
2708	Cliper.exe
2708	Cliper.exe
2456	e4086615e3011d916a50689cef433c77.exe
2136	MACGen.v1.7.exe
2136	MACGen.v1.7.exe
2880	WerFault.exe
2880	WerFault.exe
2880	WerFault.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
7	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2880	2708	WerFault.exe	29

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	Microsoft Update.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	Microsoft Update.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2460	Microsoft Update.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2460	Microsoft Update.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2136	MACGen.v1.7.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2456 wrote to memory of 2460	2456	e4086615e3011d916a50689cef433c77.exe	28
PID 2456 wrote to memory of 2460	2456	e4086615e3011d916a50689cef433c77.exe	28
PID 2456 wrote to memory of 2460	2456	e4086615e3011d916a50689cef433c77.exe	28
PID 2456 wrote to memory of 2460	2456	e4086615e3011d916a50689cef433c77.exe	28
PID 2456 wrote to memory of 2708	2456	e4086615e3011d916a50689cef433c77.exe	29
PID 2456 wrote to memory of 2708	2456	e4086615e3011d916a50689cef433c77.exe	29
PID 2456 wrote to memory of 2708	2456	e4086615e3011d916a50689cef433c77.exe	29
PID 2456 wrote to memory of 2708	2456	e4086615e3011d916a50689cef433c77.exe	29
PID 2456 wrote to memory of 2708	2456	e4086615e3011d916a50689cef433c77.exe	29
PID 2456 wrote to memory of 2708	2456	e4086615e3011d916a50689cef433c77.exe	29
PID 2456 wrote to memory of 2708	2456	e4086615e3011d916a50689cef433c77.exe	29
PID 2456 wrote to memory of 2136	2456	e4086615e3011d916a50689cef433c77.exe	30
PID 2456 wrote to memory of 2136	2456	e4086615e3011d916a50689cef433c77.exe	30
PID 2456 wrote to memory of 2136	2456	e4086615e3011d916a50689cef433c77.exe	30
PID 2456 wrote to memory of 2136	2456	e4086615e3011d916a50689cef433c77.exe	30
PID 2456 wrote to memory of 2136	2456	e4086615e3011d916a50689cef433c77.exe	30
PID 2456 wrote to memory of 2136	2456	e4086615e3011d916a50689cef433c77.exe	30
PID 2456 wrote to memory of 2136	2456	e4086615e3011d916a50689cef433c77.exe	30
PID 2708 wrote to memory of 2880	2708	Cliper.exe	34
PID 2708 wrote to memory of 2880	2708	Cliper.exe	34
PID 2708 wrote to memory of 2880	2708	Cliper.exe	34
PID 2708 wrote to memory of 2880	2708	Cliper.exe	34
PID 2708 wrote to memory of 2880	2708	Cliper.exe	34
PID 2708 wrote to memory of 2880	2708	Cliper.exe	34
PID 2708 wrote to memory of 2880	2708	Cliper.exe	34

C:\Users\Admin\AppData\Local\Temp\e4086615e3011d916a50689cef433c77.exe
"C:\Users\Admin\AppData\Local\Temp\e4086615e3011d916a50689cef433c77.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Users\Admin\AppData\Local\Temp\Microsoft Update.exe
  "C:\Users\Admin\AppData\Local\Temp\Microsoft Update.exe"
  2⤵
  - Executes dropped EXE
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2460
- C:\Users\Admin\AppData\Local\Temp\Cliper.exe
  "C:\Users\Admin\AppData\Local\Temp\Cliper.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2708
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2708 -s 864
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2880
- C:\Users\Admin\AppData\Local\Temp\MACGen.v1.7.exe
  "C:\Users\Admin\AppData\Local\Temp\MACGen.v1.7.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MACGen.v1.7.exe

Filesize
5.8MB

MD5
fa89ca4c9bbe10b067cdf7e56c06e8d1

SHA1
e7eb7bb5621dc9d9905eccee2ce001b449be41ba

SHA256
9e4d47f86e69f7f49a21221e097c89a53bc896b5b27c94f14fc9ef3e191246c7

SHA512
1e5f5d8ab2a5d04231213bb6b255b2422b07a352f1e3101fcb50cd8eebdd0d408c8512cfa63cc45d95302f9bcfe87494ffd0360106a77829a8721988e64be887

Download Submit
\Users\Admin\AppData\Local\Temp\Cliper.exe

Filesize
200KB

MD5
94835b6d4af91fc977e840d64adaa485

SHA1
77635f373780022f21f74ade8ee80d0e652248ed

SHA256
9e2455642e046af82e21bdc6bc8659a5acc10796e383dcd7064227b0e8c6675b

SHA512
c1ff6e810d1f3476e635a206ef7b9e762230e29a0608cb961df6931d415315e1661277f2cebb2bdd15ef8291c5adae7311f97f0690aefea8fc4a3af1665d779a

Download Submit
\Users\Admin\AppData\Local\Temp\MACGen.v1.7.exe

Filesize
4.4MB

MD5
94ab407864cf0de749406e66282fcde1

SHA1
df68255f990be4fa96f924a0c1e0e2cd7ef74a80

SHA256
db653971f582af1046270bec3283ca377182d17f9e7aebf58999f53e066bcf81

SHA512
cfbb841e2d348886934df50f2ec4506f58ca3ee59783b154048487409ce469d9ba4eb52e082e746a844264894e28fa44d91be1a1edfb8874adf1c95c06b45fe8

Download Submit
\Users\Admin\AppData\Local\Temp\MACGen.v1.7.exe

Filesize
16.0MB

MD5
b9811425b010c92811573d4a1b94e90f

SHA1
a10a1b1b7d762fcc28b1ca16a09684305b0e8666

SHA256
8fb5143ef3cb8d3e8a83a42c90a74d68d7b9c4d56cfd2caa93f8bd575e7c04a7

SHA512
8c0d4cdad37f82c6fdad3aaee35fa4048e6f3a1f94d81fd8f40800173e3dc893c3f93b29de4d55923b5ff6d1d31c19b10ac58b017c5f34501f44f4598494fb08

Download Submit
\Users\Admin\AppData\Local\Temp\Microsoft Update.exe

Filesize
310KB

MD5
56b988f42827cff418d61f5738beb321

SHA1
d1440332895941edfa037d425eff00c109cfc15a

SHA256
43f322f83191d6990afee7dc4b5528e217e162b434afe06478f191d76b64d939

SHA512
2792bd3e0a1750fce7f33a06f78bb23df20ab6c841b5228d0cd3709afe578fc0af0596e9e9d7ec958a3a3b103df014b7db8fd7fe323e993e32971b3460af1506

Download Submit
memory/2136-36-0x0000000000400000-0x0000000001415000-memory.dmp

Filesize
16.1MB

Download
memory/2136-42-0x0000000000400000-0x0000000001415000-memory.dmp

Filesize
16.1MB

Download
memory/2460-29-0x0000000002230000-0x00000000022A4000-memory.dmp

Filesize
464KB

Download
memory/2460-31-0x0000000000150000-0x0000000000156000-memory.dmp

Filesize
24KB

Download
memory/2460-32-0x000000001BA90000-0x000000001BB10000-memory.dmp

Filesize
512KB

Download
memory/2460-30-0x000007FEF5A30000-0x000007FEF641C000-memory.dmp

Filesize
9.9MB

Download
memory/2460-25-0x000000013FA90000-0x000000013FAE0000-memory.dmp

Filesize
320KB

Download
memory/2460-45-0x000007FEF5A30000-0x000007FEF641C000-memory.dmp

Filesize
9.9MB

Download
memory/2460-48-0x000000001BA90000-0x000000001BB10000-memory.dmp

Filesize
512KB

Download

Analysis

Sharing