oski | d02672efdf8edc3a02c71889fc5f04ffd4d469de77cca44764edee4592b89ce2

Analysis

max time kernel
142s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
21-03-2024 05:18

Target

dac9484cbfa5767670567eec53d8979b.ps1
Size

421KB
MD5

dac9484cbfa5767670567eec53d8979b
SHA1

e920708eb445d8f822d5a85d726bfddaa27dd00f
SHA256

d02672efdf8edc3a02c71889fc5f04ffd4d469de77cca44764edee4592b89ce2
SHA512

cde490119de920287b6d6e7ba84820690b553976b4afe013c53565088383e53a3dfd84bab3808d79a6ba6b4459a9abdd6dd8feda89d6a90f6dc5b6d8997d276f
SSDEEP

12288:+Zjw0RJ9u5ILYDxD3fxYehza/tw644L68:q3j

Score

10^/10

oski infostealer

Family

oski

/103.114.107.28/l22/

Oski
Oski is an infostealer targeting browser data, crypto wallets.
infostealer oski

Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.exe

description	pid	Process	procid_target
PID 2332 set thread context of 316	2332	powershell.exe	98

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
212	316	WerFault.exe	98

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description	pid	Process
Token: SeDebugPrivilege	2332	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

powershell.exe

description	pid	Process	procid_target
PID 2332 wrote to memory of 316	2332	powershell.exe	98
PID 2332 wrote to memory of 316	2332	powershell.exe	98
PID 2332 wrote to memory of 316	2332	powershell.exe	98
PID 2332 wrote to memory of 316	2332	powershell.exe	98
PID 2332 wrote to memory of 316	2332	powershell.exe	98
PID 2332 wrote to memory of 316	2332	powershell.exe	98
PID 2332 wrote to memory of 316	2332	powershell.exe	98
PID 2332 wrote to memory of 316	2332	powershell.exe	98
PID 2332 wrote to memory of 316	2332	powershell.exe	98

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 316 -ip 316
1⤵
PID:4484

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3940 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:8
1⤵
PID:964

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3yuhc2n3.vse.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/316-14-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/316-18-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/316-19-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/316-20-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/316-23-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2332-5-0x000001CEA3F10000-0x000001CEA3F32000-memory.dmp

Filesize
136KB

Download
memory/2332-10-0x00007FF983DE0000-0x00007FF9848A1000-memory.dmp

Filesize
10.8MB

Download
memory/2332-11-0x000001CE88190000-0x000001CE881A0000-memory.dmp

Filesize
64KB

Download
memory/2332-12-0x000001CE88190000-0x000001CE881A0000-memory.dmp

Filesize
64KB

Download
memory/2332-13-0x000001CEA3F00000-0x000001CEA3F0A000-memory.dmp

Filesize
40KB

Download
memory/2332-17-0x00007FF983DE0000-0x00007FF9848A1000-memory.dmp

Filesize
10.8MB

Download