oski | 0b776bb3bc48dcdb0e99b045ce4ce4488b307732b903aeb54c85d8c88d565f80

Analysis

max time kernel
182s
max time network
192s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
01-01-2024 17:11

Target

3d69a438d2ad0aad062f2e9506f35dfe.ps1
Size

485KB
MD5

3d69a438d2ad0aad062f2e9506f35dfe
SHA1

1f4b12cff09ecf10cb0f391acb5134afbc8552d7
SHA256

0b776bb3bc48dcdb0e99b045ce4ce4488b307732b903aeb54c85d8c88d565f80
SHA512

de2d95eca57695a9454d62a9d2dc9aa2f4eb3ea60b8f2544a99285bb0e137bd4879c83f921727ab71513cbbc0c207db2ed09e8097256c00b6ed1821b1a6422db
SSDEEP

12288:+Zjw0RJ9u5ILYDxD3fxYehza/tw64digu:q3au

Score

10^/10

oski infostealer

Family

oski

/103.114.107.28/l27/

Oski
Oski is an infostealer targeting browser data, crypto wallets.
infostealer oski

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4012 set thread context of 4156	4012	powershell.exe	94

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3568	4156	WerFault.exe	94

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4012	powershell.exe
4012	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4012	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4012 wrote to memory of 4156	4012	powershell.exe	94
PID 4012 wrote to memory of 4156	4012	powershell.exe	94
PID 4012 wrote to memory of 4156	4012	powershell.exe	94
PID 4012 wrote to memory of 4156	4012	powershell.exe	94
PID 4012 wrote to memory of 4156	4012	powershell.exe	94
PID 4012 wrote to memory of 4156	4012	powershell.exe	94
PID 4012 wrote to memory of 4156	4012	powershell.exe	94
PID 4012 wrote to memory of 4156	4012	powershell.exe	94
PID 4012 wrote to memory of 4156	4012	powershell.exe	94

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4156 -ip 4156
1⤵
PID:344

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vtfoga4k.1bz.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/4012-9-0x0000022D67D10000-0x0000022D67D32000-memory.dmp

Filesize
136KB

Download
memory/4012-10-0x0000022D67D00000-0x0000022D67D12000-memory.dmp

Filesize
72KB

Download
memory/4012-15-0x00007FFD48A60000-0x00007FFD49521000-memory.dmp

Filesize
10.8MB

Download
memory/4012-21-0x00007FFD48A60000-0x00007FFD49521000-memory.dmp

Filesize
10.8MB

Download
memory/4156-11-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4156-12-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4156-16-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4156-17-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4156-20-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download