oski | e32f29fd3d764d021e15bc4d9dfa6b5eadbe466cda03b27903863e03b49efdf1

General

Target

99bbdbd8879083ba521c9198efabe4d9.exe
Size

813KB
MD5

99bbdbd8879083ba521c9198efabe4d9
SHA1

f676ffeee043f5083f946955fb99cb2eaa85ebaa
SHA256

e32f29fd3d764d021e15bc4d9dfa6b5eadbe466cda03b27903863e03b49efdf1
SHA512

5b50c9d39482eba324540dd8130bd76f863c27025600743089a7ac25c8ecd48363a02bc04d6dca357c870ad2c6cc199738a827c5a167d7546d3f6a6defe92e0a
SSDEEP

12288:BGjZ6FArZSoR65AXwgFvuSSrIRW95Qq/+TYkDYFXEqQhSjRuukMBKQ21c4N8Vo7b:ToR6qgnfRFXEVi4QkPw5

Score

10^/10

oski infostealer spyware stealer

Malware Config

Extracted

Family

oski

C2

103.199.16.91/www/

Signatures

Oski
Oski is an infostealer targeting browser data, crypto wallets.
infostealer oski
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1520 set thread context of 2780	1520	99bbdbd8879083ba521c9198efabe4d9.exe	32

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2912	2780	WerFault.exe	32

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1460	schtasks.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1520 wrote to memory of 1460	1520	99bbdbd8879083ba521c9198efabe4d9.exe	30
PID 1520 wrote to memory of 1460	1520	99bbdbd8879083ba521c9198efabe4d9.exe	30
PID 1520 wrote to memory of 1460	1520	99bbdbd8879083ba521c9198efabe4d9.exe	30
PID 1520 wrote to memory of 1460	1520	99bbdbd8879083ba521c9198efabe4d9.exe	30
PID 1520 wrote to memory of 2780	1520	99bbdbd8879083ba521c9198efabe4d9.exe	32
PID 1520 wrote to memory of 2780	1520	99bbdbd8879083ba521c9198efabe4d9.exe	32
PID 1520 wrote to memory of 2780	1520	99bbdbd8879083ba521c9198efabe4d9.exe	32
PID 1520 wrote to memory of 2780	1520	99bbdbd8879083ba521c9198efabe4d9.exe	32
PID 1520 wrote to memory of 2780	1520	99bbdbd8879083ba521c9198efabe4d9.exe	32
PID 1520 wrote to memory of 2780	1520	99bbdbd8879083ba521c9198efabe4d9.exe	32
PID 1520 wrote to memory of 2780	1520	99bbdbd8879083ba521c9198efabe4d9.exe	32
PID 1520 wrote to memory of 2780	1520	99bbdbd8879083ba521c9198efabe4d9.exe	32
PID 1520 wrote to memory of 2780	1520	99bbdbd8879083ba521c9198efabe4d9.exe	32
PID 1520 wrote to memory of 2780	1520	99bbdbd8879083ba521c9198efabe4d9.exe	32
PID 2780 wrote to memory of 2912	2780	99bbdbd8879083ba521c9198efabe4d9.exe	37
PID 2780 wrote to memory of 2912	2780	99bbdbd8879083ba521c9198efabe4d9.exe	37
PID 2780 wrote to memory of 2912	2780	99bbdbd8879083ba521c9198efabe4d9.exe	37
PID 2780 wrote to memory of 2912	2780	99bbdbd8879083ba521c9198efabe4d9.exe	37

C:\Users\Admin\AppData\Local\Temp\99bbdbd8879083ba521c9198efabe4d9.exe
"C:\Users\Admin\AppData\Local\Temp\99bbdbd8879083ba521c9198efabe4d9.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\JrkCUVwC" /XML "C:\Users\Admin\AppData\Local\Temp\tmp274F.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1460
- C:\Users\Admin\AppData\Local\Temp\99bbdbd8879083ba521c9198efabe4d9.exe
  "C:\Users\Admin\AppData\Local\Temp\99bbdbd8879083ba521c9198efabe4d9.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2780
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2780 -s 756
    3⤵
    - Program crash
    PID:2912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp274F.tmp

Filesize
1KB

MD5
40775a025ceb5429e0508864c2ec6652

SHA1
e8220cc25b1562d16d4c1ee3407dc7dccc3c3470

SHA256
72f008d8981f3e057309fddb1a52a08791727d56cfbfde9a9044fd1a02567d6d

SHA512
7600a5cdcd23e388d8b44f691bd5a7f695591efa5a32efee1cdd08b39a5bb682cc57be7b63f3cc09a1264113a6e63f4dba7a13443ca049dd68bce5718038b604

Download Submit
memory/1520-4-0x00000000741B0000-0x000000007489E000-memory.dmp

Filesize
6.9MB

Download
memory/1520-3-0x0000000000650000-0x000000000066A000-memory.dmp

Filesize
104KB

Download
memory/1520-28-0x00000000741B0000-0x000000007489E000-memory.dmp

Filesize
6.9MB

Download
memory/1520-0-0x00000000011F0000-0x00000000012C2000-memory.dmp

Filesize
840KB

Download
memory/1520-5-0x00000000011B0000-0x00000000011F0000-memory.dmp

Filesize
256KB

Download
memory/1520-6-0x0000000005980000-0x0000000005A22000-memory.dmp

Filesize
648KB

Download
memory/1520-7-0x0000000000A20000-0x0000000000A58000-memory.dmp

Filesize
224KB

Download
memory/1520-1-0x00000000741B0000-0x000000007489E000-memory.dmp

Filesize
6.9MB

Download
memory/1520-2-0x00000000011B0000-0x00000000011F0000-memory.dmp

Filesize
256KB

Download
memory/2780-29-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2780-17-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2780-19-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2780-21-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2780-23-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2780-25-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2780-15-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2780-27-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2780-13-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads