oski | 10410848d808e42758883ff2045ac5b10d16ad3d4155771483f0aba1f245a6e4

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05-03-2024 18:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b556492c8d162c4180c0c6a5c07e6abb.exe
Size

678KB
MD5

b556492c8d162c4180c0c6a5c07e6abb
SHA1

eb369158b45401422f550ca727c2b5a610bc7ab8
SHA256

10410848d808e42758883ff2045ac5b10d16ad3d4155771483f0aba1f245a6e4
SHA512

58ba5e137396a6c285033af96c01aae61983bed7cd9bb62047c554bcd63f8305f6725242851ff673d0861fe1f8a56ed8129189c652ef48799b51529dff289fec
SSDEEP

12288:NXJNqcCx+8+/iMuzbe3hO2dVy3whNMgfTNBnefBgyC5+Wyco3zzpUdv5ho:N+e/UzbEhOqVqwzxQfWcw

Score

10^/10

oski infostealer

Malware Config

Extracted

Family

oski

zzz.divendesign.in

Signatures

Oski
Oski is an infostealer targeting browser data, crypto wallets.
infostealer oski

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2100 set thread context of 2416	2100	b556492c8d162c4180c0c6a5c07e6abb.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2512	2416	WerFault.exe	29

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2100	b556492c8d162c4180c0c6a5c07e6abb.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2100	b556492c8d162c4180c0c6a5c07e6abb.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 2536	2100	b556492c8d162c4180c0c6a5c07e6abb.exe	28
PID 2100 wrote to memory of 2536	2100	b556492c8d162c4180c0c6a5c07e6abb.exe	28
PID 2100 wrote to memory of 2536	2100	b556492c8d162c4180c0c6a5c07e6abb.exe	28
PID 2100 wrote to memory of 2536	2100	b556492c8d162c4180c0c6a5c07e6abb.exe	28
PID 2100 wrote to memory of 2416	2100	b556492c8d162c4180c0c6a5c07e6abb.exe	29
PID 2100 wrote to memory of 2416	2100	b556492c8d162c4180c0c6a5c07e6abb.exe	29
PID 2100 wrote to memory of 2416	2100	b556492c8d162c4180c0c6a5c07e6abb.exe	29
PID 2100 wrote to memory of 2416	2100	b556492c8d162c4180c0c6a5c07e6abb.exe	29
PID 2100 wrote to memory of 2416	2100	b556492c8d162c4180c0c6a5c07e6abb.exe	29
PID 2100 wrote to memory of 2416	2100	b556492c8d162c4180c0c6a5c07e6abb.exe	29
PID 2100 wrote to memory of 2416	2100	b556492c8d162c4180c0c6a5c07e6abb.exe	29
PID 2100 wrote to memory of 2416	2100	b556492c8d162c4180c0c6a5c07e6abb.exe	29
PID 2100 wrote to memory of 2416	2100	b556492c8d162c4180c0c6a5c07e6abb.exe	29
PID 2100 wrote to memory of 2416	2100	b556492c8d162c4180c0c6a5c07e6abb.exe	29
PID 2416 wrote to memory of 2512	2416	b556492c8d162c4180c0c6a5c07e6abb.exe	30
PID 2416 wrote to memory of 2512	2416	b556492c8d162c4180c0c6a5c07e6abb.exe	30
PID 2416 wrote to memory of 2512	2416	b556492c8d162c4180c0c6a5c07e6abb.exe	30
PID 2416 wrote to memory of 2512	2416	b556492c8d162c4180c0c6a5c07e6abb.exe	30

C:\Users\Admin\AppData\Local\Temp\b556492c8d162c4180c0c6a5c07e6abb.exe
"C:\Users\Admin\AppData\Local\Temp\b556492c8d162c4180c0c6a5c07e6abb.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Users\Admin\AppData\Local\Temp\b556492c8d162c4180c0c6a5c07e6abb.exe
  "{path}"
  2⤵
  PID:2536
- C:\Users\Admin\AppData\Local\Temp\b556492c8d162c4180c0c6a5c07e6abb.exe
  "{path}"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2416
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2416 -s 112
    3⤵
    - Program crash
    PID:2512

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2100-19-0x00000000745F0000-0x0000000074CDE000-memory.dmp

Filesize
6.9MB

Download
memory/2100-1-0x00000000745F0000-0x0000000074CDE000-memory.dmp

Filesize
6.9MB

Download
memory/2100-2-0x0000000000E30000-0x0000000000E70000-memory.dmp

Filesize
256KB

Download
memory/2100-3-0x0000000000550000-0x0000000000558000-memory.dmp

Filesize
32KB

Download
memory/2100-4-0x00000000745F0000-0x0000000074CDE000-memory.dmp

Filesize
6.9MB

Download
memory/2100-5-0x0000000000E30000-0x0000000000E70000-memory.dmp

Filesize
256KB

Download
memory/2100-6-0x0000000005D90000-0x0000000005E12000-memory.dmp

Filesize
520KB

Download
memory/2100-7-0x0000000000D90000-0x0000000000DCA000-memory.dmp

Filesize
232KB

Download
memory/2100-0-0x0000000001360000-0x0000000001410000-memory.dmp

Filesize
704KB

Download
memory/2416-8-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2416-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2416-16-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2416-12-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2416-10-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2416-9-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2416-18-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2416-11-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download