oski | 67224e8f8ef3b36cf77c29b0c60a7595daa16de984f3d2b643ec885dc93b8acb

General

Target

e2bbf77bd9861f8f202a44421e66b598_JaffaCakes118.ps1
Size

656KB
MD5

e2bbf77bd9861f8f202a44421e66b598
SHA1

5bca6fe4ea19b2b29534e8e515e8bd4e86ea48b7
SHA256

67224e8f8ef3b36cf77c29b0c60a7595daa16de984f3d2b643ec885dc93b8acb
SHA512

2cb5210845220cf564c32f363fe45eeb66b9edc66a3dbd206f8341b632d3da67737442fbffbaa66436f3c0c58d2f711a8c8fd6f22669f5afabd3bcff25a0badf
SSDEEP

12288:EZjw0RJ9u5ILYDxD3fxYehza/tw64o8TVkc5A+:g30Tmr+

Score

10^/10

oski infostealer

Malware Config

Extracted

Family

oski

C2

103.114.107.28/l5/

Signatures

Oski
Oski is an infostealer targeting browser data, crypto wallets.
infostealer oski
Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.exe

description pid process target process

PID 1868 set thread context of 1828 1868 powershell.exe aspnet_compiler.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4500 1828 WerFault.exe aspnet_compiler.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

powershell.exe

pid process

1868 powershell.exe
1868 powershell.exe
1868 powershell.exe
1868 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1868 powershell.exe

description	pid	process	target process
PID 1868 set thread context of 1828	1868	powershell.exe	aspnet_compiler.exe

pid	pid_target	process	target process
4500	1828	WerFault.exe	aspnet_compiler.exe

pid	process
1868	powershell.exe
1868	powershell.exe
1868	powershell.exe
1868	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1868	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 1868 wrote to memory of 2700	1868	powershell.exe	aspnet_compiler.exe
PID 1868 wrote to memory of 2700	1868	powershell.exe	aspnet_compiler.exe
PID 1868 wrote to memory of 2700	1868	powershell.exe	aspnet_compiler.exe
PID 1868 wrote to memory of 1828	1868	powershell.exe	aspnet_compiler.exe
PID 1868 wrote to memory of 1828	1868	powershell.exe	aspnet_compiler.exe
PID 1868 wrote to memory of 1828	1868	powershell.exe	aspnet_compiler.exe
PID 1868 wrote to memory of 1828	1868	powershell.exe	aspnet_compiler.exe
PID 1868 wrote to memory of 1828	1868	powershell.exe	aspnet_compiler.exe
PID 1868 wrote to memory of 1828	1868	powershell.exe	aspnet_compiler.exe
PID 1868 wrote to memory of 1828	1868	powershell.exe	aspnet_compiler.exe
PID 1868 wrote to memory of 1828	1868	powershell.exe	aspnet_compiler.exe
PID 1868 wrote to memory of 1828	1868	powershell.exe	aspnet_compiler.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\e2bbf77bd9861f8f202a44421e66b598_JaffaCakes118.ps1
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1868

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
#cmd
2⤵
PID:2700

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
#cmd
2⤵
PID:1828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1828 -s 1232
3⤵
- Program crash
PID:4500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 1828 -ip 1828
1⤵
PID:1124

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vzlv4phr.5al.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/1828-56-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1828-66-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1828-63-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1828-62-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1828-61-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1828-59-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1868-38-0x0000026F7EB60000-0x0000026F7EB80000-memory.dmp

Filesize
128KB

Download
memory/1868-44-0x0000026F7EB60000-0x0000026F7EB80000-memory.dmp

Filesize
128KB

Download
memory/1868-18-0x0000026F7EB60000-0x0000026F7EB80000-memory.dmp

Filesize
128KB

Download
memory/1868-20-0x0000026F7EB60000-0x0000026F7EB80000-memory.dmp

Filesize
128KB

Download
memory/1868-22-0x0000026F7EB60000-0x0000026F7EB80000-memory.dmp

Filesize
128KB

Download
memory/1868-24-0x0000026F7EB60000-0x0000026F7EB80000-memory.dmp

Filesize
128KB

Download
memory/1868-26-0x0000026F7EB60000-0x0000026F7EB80000-memory.dmp

Filesize
128KB

Download
memory/1868-28-0x0000026F7EB60000-0x0000026F7EB80000-memory.dmp

Filesize
128KB

Download
memory/1868-30-0x0000026F7EB60000-0x0000026F7EB80000-memory.dmp

Filesize
128KB

Download
memory/1868-32-0x0000026F7EB60000-0x0000026F7EB80000-memory.dmp

Filesize
128KB

Download
memory/1868-34-0x0000026F7EB60000-0x0000026F7EB80000-memory.dmp

Filesize
128KB

Download
memory/1868-9-0x00007FFB02160000-0x00007FFB02C21000-memory.dmp

Filesize
10.8MB

Download
memory/1868-36-0x0000026F7EB60000-0x0000026F7EB80000-memory.dmp

Filesize
128KB

Download
memory/1868-40-0x0000026F7EB60000-0x0000026F7EB80000-memory.dmp

Filesize
128KB

Download
memory/1868-42-0x0000026F7EB60000-0x0000026F7EB80000-memory.dmp

Filesize
128KB

Download
memory/1868-16-0x0000026F7EB60000-0x0000026F7EB80000-memory.dmp

Filesize
128KB

Download
memory/1868-46-0x0000026F7EB60000-0x0000026F7EB80000-memory.dmp

Filesize
128KB

Download
memory/1868-48-0x0000026F7EB60000-0x0000026F7EB80000-memory.dmp

Filesize
128KB

Download
memory/1868-50-0x0000026F7EB60000-0x0000026F7EB80000-memory.dmp

Filesize
128KB

Download
memory/1868-52-0x0000026F7EB60000-0x0000026F7EB80000-memory.dmp

Filesize
128KB

Download
memory/1868-54-0x0000026F7EB60000-0x0000026F7EB80000-memory.dmp

Filesize
128KB

Download
memory/1868-55-0x0000026F64160000-0x0000026F64161000-memory.dmp

Filesize
4KB

Download
memory/1868-15-0x0000026F7EB60000-0x0000026F7EB80000-memory.dmp

Filesize
128KB

Download
memory/1868-14-0x0000026F7EB60000-0x0000026F7EB86000-memory.dmp

Filesize
152KB

Download
memory/1868-60-0x00007FFB02160000-0x00007FFB02C21000-memory.dmp

Filesize
10.8MB

Download
memory/1868-13-0x0000026F64180000-0x0000026F64190000-memory.dmp

Filesize
64KB

Download
memory/1868-12-0x0000026F64180000-0x0000026F64190000-memory.dmp

Filesize
64KB

Download
memory/1868-11-0x0000026F64180000-0x0000026F64190000-memory.dmp

Filesize
64KB

Download
memory/1868-10-0x0000026F7E8D0000-0x0000026F7E8F2000-memory.dmp

Filesize
136KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads