oski | c9276a78a7dfb0c9dd3f5c19c5da3c965e0e63ab9c02b6192edb2c7dc21e7b9d

Analysis

max time kernel
125s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
14-06-2024 22:17

Target

abb7d2d64ee38fb8fb9b0191126a280c_JaffaCakes118.exe
Size

447KB
MD5

abb7d2d64ee38fb8fb9b0191126a280c
SHA1

c586ef2a76ce32d55cf213e56e377f05d8b0ab51
SHA256

c9276a78a7dfb0c9dd3f5c19c5da3c965e0e63ab9c02b6192edb2c7dc21e7b9d
SHA512

ee3d20c9db57e02d1c1ad28c960334991acf2cadb395d7de35f847c93a6f5ddb1006c929c87c7d277756c82f97efb026fbd55062cd5340ef250f10fe0211d91c
SSDEEP

12288:kywn9vaSJgiwiKzHrIbXTpLFiYhI04kMTJ:9eKIDTpLFiYO04kM1

Score

10^/10

oski infostealer

Oski
Oski is an infostealer targeting browser data, crypto wallets.
infostealer oski

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3228 set thread context of 444	3228	abb7d2d64ee38fb8fb9b0191126a280c_JaffaCakes118.exe	94

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4576	444	WerFault.exe	94

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
3228	abb7d2d64ee38fb8fb9b0191126a280c_JaffaCakes118.exe
3228	abb7d2d64ee38fb8fb9b0191126a280c_JaffaCakes118.exe
3228	abb7d2d64ee38fb8fb9b0191126a280c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3228 wrote to memory of 1956	3228	abb7d2d64ee38fb8fb9b0191126a280c_JaffaCakes118.exe	92
PID 3228 wrote to memory of 1956	3228	abb7d2d64ee38fb8fb9b0191126a280c_JaffaCakes118.exe	92
PID 3228 wrote to memory of 1956	3228	abb7d2d64ee38fb8fb9b0191126a280c_JaffaCakes118.exe	92
PID 3228 wrote to memory of 2948	3228	abb7d2d64ee38fb8fb9b0191126a280c_JaffaCakes118.exe	93
PID 3228 wrote to memory of 2948	3228	abb7d2d64ee38fb8fb9b0191126a280c_JaffaCakes118.exe	93
PID 3228 wrote to memory of 2948	3228	abb7d2d64ee38fb8fb9b0191126a280c_JaffaCakes118.exe	93
PID 3228 wrote to memory of 444	3228	abb7d2d64ee38fb8fb9b0191126a280c_JaffaCakes118.exe	94
PID 3228 wrote to memory of 444	3228	abb7d2d64ee38fb8fb9b0191126a280c_JaffaCakes118.exe	94
PID 3228 wrote to memory of 444	3228	abb7d2d64ee38fb8fb9b0191126a280c_JaffaCakes118.exe	94
PID 3228 wrote to memory of 444	3228	abb7d2d64ee38fb8fb9b0191126a280c_JaffaCakes118.exe	94

C:\Users\Admin\AppData\Local\Temp\abb7d2d64ee38fb8fb9b0191126a280c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\abb7d2d64ee38fb8fb9b0191126a280c_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3228
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\\\\Microsoft.NET\\\\Framework\\\\v4.0.30319\\\\RegSvcs.exe"
  2⤵
  PID:1956
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\\\\Microsoft.NET\\\\Framework\\\\v4.0.30319\\\\RegSvcs.exe"
  2⤵
  PID:2948
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\\\\Microsoft.NET\\\\Framework\\\\v4.0.30319\\\\RegSvcs.exe"
  2⤵
  PID:444
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 444 -s 1220
    3⤵
    - Program crash
    PID:4576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 444 -ip 444
1⤵
PID:2648

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1420,i,15316930299780304231,7592852768794498680,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:8
1⤵
PID:4428

memory/444-11-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/444-6-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/444-7-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/444-8-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/444-15-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3228-1-0x0000000000B50000-0x0000000000BC6000-memory.dmp

Filesize
472KB

Download
memory/3228-2-0x0000000005550000-0x0000000005588000-memory.dmp

Filesize
224KB

Download
memory/3228-3-0x0000000074A40000-0x00000000751F0000-memory.dmp

Filesize
7.7MB

Download
memory/3228-4-0x0000000005590000-0x00000000055C8000-memory.dmp

Filesize
224KB

Download
memory/3228-5-0x0000000005790000-0x0000000005822000-memory.dmp

Filesize
584KB

Download
memory/3228-0-0x0000000074A4E000-0x0000000074A4F000-memory.dmp

Filesize
4KB

Download
memory/3228-10-0x0000000074A40000-0x00000000751F0000-memory.dmp

Filesize
7.7MB

Download
memory/3228-12-0x0000000074A40000-0x00000000751F0000-memory.dmp

Filesize
7.7MB

Download