oski | 2672e663c20a2695b2b4dadb2162bb7fe8c037d34eaa9660181dd529fa0c04d0

General

Target

c5e62282e79fc994c3eea5ab5669a671_JaffaCakes118.exe
Size

458KB
MD5

c5e62282e79fc994c3eea5ab5669a671
SHA1

b3324b6272dc54ac34989d7af595064286c6870f
SHA256

2672e663c20a2695b2b4dadb2162bb7fe8c037d34eaa9660181dd529fa0c04d0
SHA512

32ef996dc8223ca0fd25c14fb6a6298295ee5ea9d56483e201c1d86497c76ed6fefe3154607847e0ffa0fed3306c9d5b0ffa9caabc3e243438639eb311e0974d
SSDEEP

12288:XQblpwnI74DSDRBvGHyNpFk11f/xTsCoE1Z8XrvFFF4lYu3:XUpizDXykYu

Score

10^/10

oski discovery infostealer

Malware Config

Extracted

Family

oski

C2

45.8.228.100

Signatures

Oski
Oski is an infostealer targeting browser data, crypto wallets.
infostealer oski
Suspicious use of SetThreadContext 1 IoCs

Processes:

c5e62282e79fc994c3eea5ab5669a671_JaffaCakes118.exe

description pid process target process

PID 1752 set thread context of 2420 1752 c5e62282e79fc994c3eea5ab5669a671_JaffaCakes118.exe RegSvcs.exe

description	pid	process	target process
PID 1752 set thread context of 2420	1752	c5e62282e79fc994c3eea5ab5669a671_JaffaCakes118.exe	RegSvcs.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

c5e62282e79fc994c3eea5ab5669a671_JaffaCakes118.exeRegSvcs.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c5e62282e79fc994c3eea5ab5669a671_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

c5e62282e79fc994c3eea5ab5669a671_JaffaCakes118.exe

description	pid	process	target process
PID 1752 wrote to memory of 2420	1752	c5e62282e79fc994c3eea5ab5669a671_JaffaCakes118.exe	RegSvcs.exe
PID 1752 wrote to memory of 2420	1752	c5e62282e79fc994c3eea5ab5669a671_JaffaCakes118.exe	RegSvcs.exe
PID 1752 wrote to memory of 2420	1752	c5e62282e79fc994c3eea5ab5669a671_JaffaCakes118.exe	RegSvcs.exe
PID 1752 wrote to memory of 2420	1752	c5e62282e79fc994c3eea5ab5669a671_JaffaCakes118.exe	RegSvcs.exe
PID 1752 wrote to memory of 2420	1752	c5e62282e79fc994c3eea5ab5669a671_JaffaCakes118.exe	RegSvcs.exe
PID 1752 wrote to memory of 2420	1752	c5e62282e79fc994c3eea5ab5669a671_JaffaCakes118.exe	RegSvcs.exe
PID 1752 wrote to memory of 2420	1752	c5e62282e79fc994c3eea5ab5669a671_JaffaCakes118.exe	RegSvcs.exe
PID 1752 wrote to memory of 2420	1752	c5e62282e79fc994c3eea5ab5669a671_JaffaCakes118.exe	RegSvcs.exe
PID 1752 wrote to memory of 2420	1752	c5e62282e79fc994c3eea5ab5669a671_JaffaCakes118.exe	RegSvcs.exe
PID 1752 wrote to memory of 2420	1752	c5e62282e79fc994c3eea5ab5669a671_JaffaCakes118.exe	RegSvcs.exe
PID 1752 wrote to memory of 2420	1752	c5e62282e79fc994c3eea5ab5669a671_JaffaCakes118.exe	RegSvcs.exe
PID 1752 wrote to memory of 2420	1752	c5e62282e79fc994c3eea5ab5669a671_JaffaCakes118.exe	RegSvcs.exe
PID 1752 wrote to memory of 2420	1752	c5e62282e79fc994c3eea5ab5669a671_JaffaCakes118.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\c5e62282e79fc994c3eea5ab5669a671_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c5e62282e79fc994c3eea5ab5669a671_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1752-24-0x00000000743E0000-0x0000000074ACE000-memory.dmp

Filesize
6.9MB

Download
memory/1752-1-0x0000000000B20000-0x0000000000B98000-memory.dmp

Filesize
480KB

Download
memory/1752-2-0x0000000000230000-0x0000000000236000-memory.dmp

Filesize
24KB

Download
memory/1752-3-0x00000000743E0000-0x0000000074ACE000-memory.dmp

Filesize
6.9MB

Download
memory/1752-4-0x00000000743EE000-0x00000000743EF000-memory.dmp

Filesize
4KB

Download
memory/1752-5-0x00000000743E0000-0x0000000074ACE000-memory.dmp

Filesize
6.9MB

Download
memory/1752-6-0x0000000000410000-0x0000000000444000-memory.dmp

Filesize
208KB

Download
memory/1752-7-0x0000000000450000-0x0000000000464000-memory.dmp

Filesize
80KB

Download
memory/1752-0-0x00000000743EE000-0x00000000743EF000-memory.dmp

Filesize
4KB

Download
memory/2420-8-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2420-20-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2420-23-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2420-18-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2420-16-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2420-14-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2420-12-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2420-10-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2420-22-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download

Analysis

Sharing