oski | 50861a32d76cca863c1341825b4f4fff37904a9390e8b7f9d6abbad9c44ad201

Analysis

max time kernel
148s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13-06-2024 11:28

Target

a54aba31c6a6629b55eced33b78819b6_JaffaCakes118.exe
Size

1.2MB
MD5

a54aba31c6a6629b55eced33b78819b6
SHA1

5fc9921a3a3050395945106f30ef15e7930a6b35
SHA256

50861a32d76cca863c1341825b4f4fff37904a9390e8b7f9d6abbad9c44ad201
SHA512

5b6913cc070af44cf20e1308cf74fbe5a45aa61ed63636b527d260d6549b5ead185e7eb698b1f91034ffa4cfede195f63278d1e9b7388e51f679ce33354cbdff
SSDEEP

24576:+u6Jx3O0c+JY5UZ+XC0kGso/WaTGqYLLSK1UgTWY:QI0c++OCvkGsUWaTGOY

Score

10^/10

Oski
Oski is an infostealer targeting browser data, crypto wallets.
infostealer oski
Suspicious use of SetThreadContext 1 IoCs

Processes:

a54aba31c6a6629b55eced33b78819b6_JaffaCakes118.exe

description pid process target process

PID 3608 set thread context of 1360 3608 a54aba31c6a6629b55eced33b78819b6_JaffaCakes118.exe dllhost.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1280 1360 WerFault.exe dllhost.exe
Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

a54aba31c6a6629b55eced33b78819b6_JaffaCakes118.exe

pid process

3608 a54aba31c6a6629b55eced33b78819b6_JaffaCakes118.exe
3608 a54aba31c6a6629b55eced33b78819b6_JaffaCakes118.exe
3608 a54aba31c6a6629b55eced33b78819b6_JaffaCakes118.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

a54aba31c6a6629b55eced33b78819b6_JaffaCakes118.exe

pid process

3608 a54aba31c6a6629b55eced33b78819b6_JaffaCakes118.exe
3608 a54aba31c6a6629b55eced33b78819b6_JaffaCakes118.exe
3608 a54aba31c6a6629b55eced33b78819b6_JaffaCakes118.exe

description	pid	process	target process
PID 3608 set thread context of 1360	3608	a54aba31c6a6629b55eced33b78819b6_JaffaCakes118.exe	dllhost.exe

pid	pid_target	process	target process
1280	1360	WerFault.exe	dllhost.exe

pid	process
3608	a54aba31c6a6629b55eced33b78819b6_JaffaCakes118.exe
3608	a54aba31c6a6629b55eced33b78819b6_JaffaCakes118.exe
3608	a54aba31c6a6629b55eced33b78819b6_JaffaCakes118.exe

pid	process
3608	a54aba31c6a6629b55eced33b78819b6_JaffaCakes118.exe
3608	a54aba31c6a6629b55eced33b78819b6_JaffaCakes118.exe
3608	a54aba31c6a6629b55eced33b78819b6_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

a54aba31c6a6629b55eced33b78819b6_JaffaCakes118.exe

description	pid	process	target process
PID 3608 wrote to memory of 1360	3608	a54aba31c6a6629b55eced33b78819b6_JaffaCakes118.exe	dllhost.exe
PID 3608 wrote to memory of 1360	3608	a54aba31c6a6629b55eced33b78819b6_JaffaCakes118.exe	dllhost.exe
PID 3608 wrote to memory of 1360	3608	a54aba31c6a6629b55eced33b78819b6_JaffaCakes118.exe	dllhost.exe
PID 3608 wrote to memory of 1360	3608	a54aba31c6a6629b55eced33b78819b6_JaffaCakes118.exe	dllhost.exe
PID 3608 wrote to memory of 1360	3608	a54aba31c6a6629b55eced33b78819b6_JaffaCakes118.exe	dllhost.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1360 -s 1212
3⤵
- Program crash
PID:1280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1360 -ip 1360
1⤵
PID:4824

memory/1360-2-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1360-8-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3608-0-0x00000000042E0000-0x000000000430D000-memory.dmp

Filesize
180KB

Download
memory/3608-1-0x00000000026F0000-0x00000000026F1000-memory.dmp

Filesize
4KB

Download