oski | bbe006688e5f74473a5e248bc83651cbb7e9efbe8410abb8d8b84b4a59ed7750

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01-02-2024 08:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8663ed0caec9adcb980a4a7ea23e7984.exe
Size

1.3MB
MD5

8663ed0caec9adcb980a4a7ea23e7984
SHA1

e6dcb19362e88b50ab1990e7032437072f104e98
SHA256

bbe006688e5f74473a5e248bc83651cbb7e9efbe8410abb8d8b84b4a59ed7750
SHA512

fd75e6bde035e103e84322411ca7b4107f1673d03170b940af3066f9f4eb58b063ec244302c8dccab87f5816e2b55a177dc1c1d7f498742fd8e0f24fb64317a9
SSDEEP

24576:0+Mt76DOkfx8Dgyfx8DgYd6ph9Jxg6AQ9l3zIiLsLznD9IzlTwDZYLL:Ot76B58Dgy58DgYd6XbxglkDIiLsLzng

Score

10^/10

oski infostealer

Malware Config

Extracted

Family

oski

fine.le-pearl.com

Signatures

Oski
Oski is an infostealer targeting browser data, crypto wallets.
infostealer oski

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2064 set thread context of 2944	2064	8663ed0caec9adcb980a4a7ea23e7984.exe	39

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
268	2944	WerFault.exe	39

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2292	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2064	8663ed0caec9adcb980a4a7ea23e7984.exe
2064	8663ed0caec9adcb980a4a7ea23e7984.exe
2064	8663ed0caec9adcb980a4a7ea23e7984.exe
2908	powershell.exe
1152	powershell.exe
2588	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2064	8663ed0caec9adcb980a4a7ea23e7984.exe
Token: SeDebugPrivilege	2908	powershell.exe
Token: SeDebugPrivilege	1152	powershell.exe
Token: SeDebugPrivilege	2588	powershell.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 2588	2064	8663ed0caec9adcb980a4a7ea23e7984.exe	30
PID 2064 wrote to memory of 2588	2064	8663ed0caec9adcb980a4a7ea23e7984.exe	30
PID 2064 wrote to memory of 2588	2064	8663ed0caec9adcb980a4a7ea23e7984.exe	30
PID 2064 wrote to memory of 2588	2064	8663ed0caec9adcb980a4a7ea23e7984.exe	30
PID 2064 wrote to memory of 1152	2064	8663ed0caec9adcb980a4a7ea23e7984.exe	32
PID 2064 wrote to memory of 1152	2064	8663ed0caec9adcb980a4a7ea23e7984.exe	32
PID 2064 wrote to memory of 1152	2064	8663ed0caec9adcb980a4a7ea23e7984.exe	32
PID 2064 wrote to memory of 1152	2064	8663ed0caec9adcb980a4a7ea23e7984.exe	32
PID 2064 wrote to memory of 2292	2064	8663ed0caec9adcb980a4a7ea23e7984.exe	34
PID 2064 wrote to memory of 2292	2064	8663ed0caec9adcb980a4a7ea23e7984.exe	34
PID 2064 wrote to memory of 2292	2064	8663ed0caec9adcb980a4a7ea23e7984.exe	34
PID 2064 wrote to memory of 2292	2064	8663ed0caec9adcb980a4a7ea23e7984.exe	34
PID 2064 wrote to memory of 2908	2064	8663ed0caec9adcb980a4a7ea23e7984.exe	36
PID 2064 wrote to memory of 2908	2064	8663ed0caec9adcb980a4a7ea23e7984.exe	36
PID 2064 wrote to memory of 2908	2064	8663ed0caec9adcb980a4a7ea23e7984.exe	36
PID 2064 wrote to memory of 2908	2064	8663ed0caec9adcb980a4a7ea23e7984.exe	36
PID 2064 wrote to memory of 2920	2064	8663ed0caec9adcb980a4a7ea23e7984.exe	38
PID 2064 wrote to memory of 2920	2064	8663ed0caec9adcb980a4a7ea23e7984.exe	38
PID 2064 wrote to memory of 2920	2064	8663ed0caec9adcb980a4a7ea23e7984.exe	38
PID 2064 wrote to memory of 2920	2064	8663ed0caec9adcb980a4a7ea23e7984.exe	38
PID 2064 wrote to memory of 2944	2064	8663ed0caec9adcb980a4a7ea23e7984.exe	39
PID 2064 wrote to memory of 2944	2064	8663ed0caec9adcb980a4a7ea23e7984.exe	39
PID 2064 wrote to memory of 2944	2064	8663ed0caec9adcb980a4a7ea23e7984.exe	39
PID 2064 wrote to memory of 2944	2064	8663ed0caec9adcb980a4a7ea23e7984.exe	39
PID 2064 wrote to memory of 2944	2064	8663ed0caec9adcb980a4a7ea23e7984.exe	39
PID 2064 wrote to memory of 2944	2064	8663ed0caec9adcb980a4a7ea23e7984.exe	39
PID 2064 wrote to memory of 2944	2064	8663ed0caec9adcb980a4a7ea23e7984.exe	39
PID 2064 wrote to memory of 2944	2064	8663ed0caec9adcb980a4a7ea23e7984.exe	39
PID 2064 wrote to memory of 2944	2064	8663ed0caec9adcb980a4a7ea23e7984.exe	39
PID 2064 wrote to memory of 2944	2064	8663ed0caec9adcb980a4a7ea23e7984.exe	39
PID 2944 wrote to memory of 268	2944	8663ed0caec9adcb980a4a7ea23e7984.exe	40
PID 2944 wrote to memory of 268	2944	8663ed0caec9adcb980a4a7ea23e7984.exe	40
PID 2944 wrote to memory of 268	2944	8663ed0caec9adcb980a4a7ea23e7984.exe	40
PID 2944 wrote to memory of 268	2944	8663ed0caec9adcb980a4a7ea23e7984.exe	40

C:\Users\Admin\AppData\Local\Temp\8663ed0caec9adcb980a4a7ea23e7984.exe
"C:\Users\Admin\AppData\Local\Temp\8663ed0caec9adcb980a4a7ea23e7984.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\8663ed0caec9adcb980a4a7ea23e7984.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2588
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ImauUieIe.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1152
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ImauUieIe" /XML "C:\Users\Admin\AppData\Local\Temp\tmp11A.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2292
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ImauUieIe.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2908
- C:\Users\Admin\AppData\Local\Temp\8663ed0caec9adcb980a4a7ea23e7984.exe
  "C:\Users\Admin\AppData\Local\Temp\8663ed0caec9adcb980a4a7ea23e7984.exe"
  2⤵
  PID:2920
- C:\Users\Admin\AppData\Local\Temp\8663ed0caec9adcb980a4a7ea23e7984.exe
  "C:\Users\Admin\AppData\Local\Temp\8663ed0caec9adcb980a4a7ea23e7984.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2944
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2944 -s 112
    3⤵
    - Program crash
    PID:268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp11A.tmp

Filesize
1KB

MD5
54fa8bc5bbafc3584dbfa158d162cd17

SHA1
f821b3a2bc1eca5d0b168a0adb74ccb4ab91647c

SHA256
98cfd9fea95710566df443a797c3b2194c2ba2bb3538993bc655aaf7737d5eca

SHA512
74ee2b117a814ea4b75bee425a9c6cb9d894c3831584c9625c5a4e7ea936444f4b40114a3317384e3c7f85feaad39e3e9e20804674cef42b50e2988f0cba4b18

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\1F5MMQFBI360BKZ38KLI.temp

Filesize
7KB

MD5
4f1ce12a4b1dafd88533a8e9ff43a54b

SHA1
4e026cbc27aa930e04e8f0393802959b79e4341d

SHA256
cbfadc2117af87deca05322c52a9e0a0537a0b3c2c739f98feb2de88fb6e9850

SHA512
48dc884b1dc9691d9a0affbe2e5976ebf61d6d4012ac34d5af716e932dd7bcd1fef2a32498d75a7667d6c1a355bd968423221201e44569a6799a7650c593027c

Download Submit
memory/1152-49-0x00000000025E0000-0x0000000002620000-memory.dmp

Filesize
256KB

Download
memory/1152-38-0x000000006FC30000-0x00000000701DB000-memory.dmp

Filesize
5.7MB

Download
memory/1152-51-0x000000006FC30000-0x00000000701DB000-memory.dmp

Filesize
5.7MB

Download
memory/1152-46-0x00000000025E0000-0x0000000002620000-memory.dmp

Filesize
256KB

Download
memory/1152-47-0x00000000025E0000-0x0000000002620000-memory.dmp

Filesize
256KB

Download
memory/1152-40-0x000000006FC30000-0x00000000701DB000-memory.dmp

Filesize
5.7MB

Download
memory/2064-0-0x0000000000830000-0x0000000000982000-memory.dmp

Filesize
1.3MB

Download
memory/2064-6-0x0000000007320000-0x00000000073C0000-memory.dmp

Filesize
640KB

Download
memory/2064-4-0x0000000074DA0000-0x000000007548E000-memory.dmp

Filesize
6.9MB

Download
memory/2064-2-0x0000000004D80000-0x0000000004DC0000-memory.dmp

Filesize
256KB

Download
memory/2064-5-0x0000000004D80000-0x0000000004DC0000-memory.dmp

Filesize
256KB

Download
memory/2064-36-0x0000000074DA0000-0x000000007548E000-memory.dmp

Filesize
6.9MB

Download
memory/2064-1-0x0000000074DA0000-0x000000007548E000-memory.dmp

Filesize
6.9MB

Download
memory/2064-7-0x00000000005B0000-0x00000000005E8000-memory.dmp

Filesize
224KB

Download
memory/2064-3-0x0000000000350000-0x0000000000362000-memory.dmp

Filesize
72KB

Download
memory/2588-39-0x00000000023C0000-0x0000000002400000-memory.dmp

Filesize
256KB

Download
memory/2588-48-0x00000000023C0000-0x0000000002400000-memory.dmp

Filesize
256KB

Download
memory/2588-53-0x000000006FC30000-0x00000000701DB000-memory.dmp

Filesize
5.7MB

Download
memory/2588-37-0x000000006FC30000-0x00000000701DB000-memory.dmp

Filesize
5.7MB

Download
memory/2588-45-0x00000000023C0000-0x0000000002400000-memory.dmp

Filesize
256KB

Download
memory/2588-41-0x000000006FC30000-0x00000000701DB000-memory.dmp

Filesize
5.7MB

Download
memory/2908-52-0x000000006FC30000-0x00000000701DB000-memory.dmp

Filesize
5.7MB

Download
memory/2908-42-0x000000006FC30000-0x00000000701DB000-memory.dmp

Filesize
5.7MB

Download
memory/2908-43-0x000000006FC30000-0x00000000701DB000-memory.dmp

Filesize
5.7MB

Download
memory/2908-44-0x0000000002590000-0x00000000025D0000-memory.dmp

Filesize
256KB

Download
memory/2908-50-0x0000000002590000-0x00000000025D0000-memory.dmp

Filesize
256KB

Download
memory/2944-31-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2944-26-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2944-25-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2944-24-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2944-35-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2944-23-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2944-33-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2944-20-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download