oski | 44aa270e4c081241057bad8c1d0ea5864087325f8e3209aa10747f108123f718

General

Target

452e6c334e555629c538c4aa6b2adc26_JaffaCakes118.exe
Size

792KB
MD5

452e6c334e555629c538c4aa6b2adc26
SHA1

f24a31707b2b0037adcc712b0d83541074f909d2
SHA256

44aa270e4c081241057bad8c1d0ea5864087325f8e3209aa10747f108123f718
SHA512

1412c3682f9c0e239743450d7ce86b37e726101f5f1786fe215dfd18c61911f31f13533549c3af2033ce6dbf47dc638466283dca62fd8df062ea2a65e3fd811a
SSDEEP

12288:YcaQxt8LiULbgDPwFVt2NjFhslyAz1+LC6oSU4Acp82cz8/mNMgMRyLcvyQQGSI:NGb0wFVMNjTsl9zwLCZGAa8mqaQeW

Score

10^/10

oski discovery infostealer

Malware Config

Extracted

Family

oski

C2

185.212.131.198/ww/

Signatures

Oski
Oski is an infostealer targeting browser data, crypto wallets.
infostealer oski

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1288 set thread context of 2452	1288	452e6c334e555629c538c4aa6b2adc26_JaffaCakes118.exe	32

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	452e6c334e555629c538c4aa6b2adc26_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	452e6c334e555629c538c4aa6b2adc26_JaffaCakes118.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2664	schtasks.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1288 wrote to memory of 2664	1288	452e6c334e555629c538c4aa6b2adc26_JaffaCakes118.exe	30
PID 1288 wrote to memory of 2664	1288	452e6c334e555629c538c4aa6b2adc26_JaffaCakes118.exe	30
PID 1288 wrote to memory of 2664	1288	452e6c334e555629c538c4aa6b2adc26_JaffaCakes118.exe	30
PID 1288 wrote to memory of 2664	1288	452e6c334e555629c538c4aa6b2adc26_JaffaCakes118.exe	30
PID 1288 wrote to memory of 2452	1288	452e6c334e555629c538c4aa6b2adc26_JaffaCakes118.exe	32
PID 1288 wrote to memory of 2452	1288	452e6c334e555629c538c4aa6b2adc26_JaffaCakes118.exe	32
PID 1288 wrote to memory of 2452	1288	452e6c334e555629c538c4aa6b2adc26_JaffaCakes118.exe	32
PID 1288 wrote to memory of 2452	1288	452e6c334e555629c538c4aa6b2adc26_JaffaCakes118.exe	32
PID 1288 wrote to memory of 2452	1288	452e6c334e555629c538c4aa6b2adc26_JaffaCakes118.exe	32
PID 1288 wrote to memory of 2452	1288	452e6c334e555629c538c4aa6b2adc26_JaffaCakes118.exe	32
PID 1288 wrote to memory of 2452	1288	452e6c334e555629c538c4aa6b2adc26_JaffaCakes118.exe	32
PID 1288 wrote to memory of 2452	1288	452e6c334e555629c538c4aa6b2adc26_JaffaCakes118.exe	32
PID 1288 wrote to memory of 2452	1288	452e6c334e555629c538c4aa6b2adc26_JaffaCakes118.exe	32
PID 1288 wrote to memory of 2452	1288	452e6c334e555629c538c4aa6b2adc26_JaffaCakes118.exe	32

C:\Users\Admin\AppData\Local\Temp\452e6c334e555629c538c4aa6b2adc26_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\452e6c334e555629c538c4aa6b2adc26_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1288
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BqppCjWADhQ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA63E.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2664
- C:\Users\Admin\AppData\Local\Temp\452e6c334e555629c538c4aa6b2adc26_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\452e6c334e555629c538c4aa6b2adc26_JaffaCakes118.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpA63E.tmp

Filesize
1KB

MD5
34cec15823d7c4801bb78580298e521e

SHA1
bf4269beabb67898f3105f262ad39c3e55d8fbe0

SHA256
22f590c88d8d8f63b4e5058b8318d2da292e351cfe8ccdd84b33e4db47c1def9

SHA512
f89fe47288268a60ea18961eb25059da42c330a1386cb47bfed43fdcde24921ca7443f04918fec2fef68694702854cba24d3413de2620dbdb2c8cdca751a81e4

Download Submit
memory/1288-4-0x0000000073F7E000-0x0000000073F7F000-memory.dmp

Filesize
4KB

Download
memory/1288-3-0x00000000004E0000-0x00000000004FA000-memory.dmp

Filesize
104KB

Download
memory/1288-28-0x0000000073F70000-0x000000007465E000-memory.dmp

Filesize
6.9MB

Download
memory/1288-0-0x0000000073F7E000-0x0000000073F7F000-memory.dmp

Filesize
4KB

Download
memory/1288-5-0x0000000073F70000-0x000000007465E000-memory.dmp

Filesize
6.9MB

Download
memory/1288-6-0x00000000084C0000-0x0000000008558000-memory.dmp

Filesize
608KB

Download
memory/1288-7-0x0000000000E10000-0x0000000000E48000-memory.dmp

Filesize
224KB

Download
memory/1288-1-0x0000000001090000-0x000000000115C000-memory.dmp

Filesize
816KB

Download
memory/1288-2-0x0000000073F70000-0x000000007465E000-memory.dmp

Filesize
6.9MB

Download
memory/2452-29-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2452-21-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2452-19-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2452-17-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2452-15-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2452-23-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2452-27-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2452-25-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2452-13-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads