osiris | 821f5310b1730641b6578ac9ce0173802db407192afdb30039f941df1ff8f1c2

General

Target

Data Analytics Services Consulting Pte. Ltd.exe
Size

1.5MB
MD5

53a9319f71e5c132dc2ec045908f627d
SHA1

a5a3904a9e99bb8a1d637a4d60163ebedcc85ffc
SHA256

821f5310b1730641b6578ac9ce0173802db407192afdb30039f941df1ff8f1c2
SHA512

8f26e1ac756f4c67db83228b7a9647b7edd3d9614a45829e1a413603758e5272dca861af616397be2b737085c694d88ad729dc7ab3f512c138f70d15ee36e30f

Score

10^/10

banker botnet osiris

Malware Config

Signatures

Osiris
banker botnet osiris
Executes dropped EXE 2 IoCs

Processes:

cmd.exeGetX64BTIT.exe

pid process

1960 cmd.exe
2636 GetX64BTIT.exe
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

18 api.ipify.org
17 api.ipify.org
Drops file in Windows directory 1 IoCs

Processes:

cmd.exe

description ioc process

File created C:\Windows\Tasks\svm.job cmd.exe
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command-Line Interface
T1059

Processes:

ipconfig.exe

pid process

204 ipconfig.exe

pid	process
1960	cmd.exe
2636	GetX64BTIT.exe

flow	ioc
18	api.ipify.org
17	api.ipify.org

description	ioc	process
File created	C:\Windows\Tasks\svm.job	cmd.exe

pid	process
204	ipconfig.exe

Suspicious behavior: EnumeratesProcesses 6936 IoCs

Processes:

Data Analytics Services Consulting Pte. Ltd.exeipconfig.execmd.exe

pid	process
1756	Data Analytics Services Consulting Pte. Ltd.exe
204	ipconfig.exe
1960	cmd.exe
1960	cmd.exe
1960	cmd.exe
1960	cmd.exe
1960	cmd.exe
1960	cmd.exe
1960	cmd.exe
1960	cmd.exe
1960	cmd.exe
1960	cmd.exe
1960	cmd.exe
1960	cmd.exe
1960	cmd.exe
1960	cmd.exe
1960	cmd.exe
1960	cmd.exe
1960	cmd.exe
1960	cmd.exe
1960	cmd.exe
1960	cmd.exe
1960	cmd.exe
1960	cmd.exe
1960	cmd.exe
1960	cmd.exe
1960	cmd.exe
1960	cmd.exe
1960	cmd.exe
1960	cmd.exe
1960	cmd.exe
1960	cmd.exe
1960	cmd.exe
1960	cmd.exe
1960	cmd.exe
1960	cmd.exe
1960	cmd.exe
1960	cmd.exe
1960	cmd.exe
1960	cmd.exe
1960	cmd.exe
1960	cmd.exe
1960	cmd.exe
1960	cmd.exe
1960	cmd.exe
1960	cmd.exe
1960	cmd.exe
1960	cmd.exe
1960	cmd.exe
1960	cmd.exe
1960	cmd.exe
1960	cmd.exe
1960	cmd.exe
1960	cmd.exe
1960	cmd.exe
1960	cmd.exe
1960	cmd.exe
1960	cmd.exe
1960	cmd.exe
1960	cmd.exe
1960	cmd.exe
1960	cmd.exe
1960	cmd.exe
1960	cmd.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

ipconfig.exe

pid process

204 ipconfig.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

cmd.exe

pid process

1960 cmd.exe

pid	process
204	ipconfig.exe

pid	process
1960	cmd.exe

Suspicious use of WriteProcessMemory 161 IoCs

Processes:

Data Analytics Services Consulting Pte. Ltd.exe

description	pid	process	target process
PID 1756 wrote to memory of 204	1756	Data Analytics Services Consulting Pte. Ltd.exe	ipconfig.exe
PID 1756 wrote to memory of 204	1756	Data Analytics Services Consulting Pte. Ltd.exe	ipconfig.exe
PID 1756 wrote to memory of 204	1756	Data Analytics Services Consulting Pte. Ltd.exe	ipconfig.exe
PID 1756 wrote to memory of 204	1756	Data Analytics Services Consulting Pte. Ltd.exe	ipconfig.exe
PID 1756 wrote to memory of 204	1756	Data Analytics Services Consulting Pte. Ltd.exe	ipconfig.exe
PID 1756 wrote to memory of 204	1756	Data Analytics Services Consulting Pte. Ltd.exe	ipconfig.exe
PID 1756 wrote to memory of 204	1756	Data Analytics Services Consulting Pte. Ltd.exe	ipconfig.exe
PID 1756 wrote to memory of 204	1756	Data Analytics Services Consulting Pte. Ltd.exe	ipconfig.exe
PID 1756 wrote to memory of 204	1756	Data Analytics Services Consulting Pte. Ltd.exe	ipconfig.exe
PID 1756 wrote to memory of 204	1756	Data Analytics Services Consulting Pte. Ltd.exe	ipconfig.exe
PID 1756 wrote to memory of 204	1756	Data Analytics Services Consulting Pte. Ltd.exe	ipconfig.exe
PID 1756 wrote to memory of 204	1756	Data Analytics Services Consulting Pte. Ltd.exe	ipconfig.exe
PID 1756 wrote to memory of 204	1756	Data Analytics Services Consulting Pte. Ltd.exe	ipconfig.exe
PID 1756 wrote to memory of 204	1756	Data Analytics Services Consulting Pte. Ltd.exe	ipconfig.exe
PID 1756 wrote to memory of 204	1756	Data Analytics Services Consulting Pte. Ltd.exe	ipconfig.exe
PID 1756 wrote to memory of 204	1756	Data Analytics Services Consulting Pte. Ltd.exe	ipconfig.exe
PID 1756 wrote to memory of 204	1756	Data Analytics Services Consulting Pte. Ltd.exe	ipconfig.exe
PID 1756 wrote to memory of 204	1756	Data Analytics Services Consulting Pte. Ltd.exe	ipconfig.exe
PID 1756 wrote to memory of 204	1756	Data Analytics Services Consulting Pte. Ltd.exe	ipconfig.exe
PID 1756 wrote to memory of 204	1756	Data Analytics Services Consulting Pte. Ltd.exe	ipconfig.exe
PID 1756 wrote to memory of 204	1756	Data Analytics Services Consulting Pte. Ltd.exe	ipconfig.exe
PID 1756 wrote to memory of 204	1756	Data Analytics Services Consulting Pte. Ltd.exe	ipconfig.exe
PID 1756 wrote to memory of 204	1756	Data Analytics Services Consulting Pte. Ltd.exe	ipconfig.exe
PID 1756 wrote to memory of 204	1756	Data Analytics Services Consulting Pte. Ltd.exe	ipconfig.exe
PID 1756 wrote to memory of 204	1756	Data Analytics Services Consulting Pte. Ltd.exe	ipconfig.exe
PID 1756 wrote to memory of 204	1756	Data Analytics Services Consulting Pte. Ltd.exe	ipconfig.exe
PID 1756 wrote to memory of 204	1756	Data Analytics Services Consulting Pte. Ltd.exe	ipconfig.exe
PID 1756 wrote to memory of 204	1756	Data Analytics Services Consulting Pte. Ltd.exe	ipconfig.exe
PID 1756 wrote to memory of 204	1756	Data Analytics Services Consulting Pte. Ltd.exe	ipconfig.exe
PID 1756 wrote to memory of 204	1756	Data Analytics Services Consulting Pte. Ltd.exe	ipconfig.exe
PID 1756 wrote to memory of 204	1756	Data Analytics Services Consulting Pte. Ltd.exe	ipconfig.exe
PID 1756 wrote to memory of 204	1756	Data Analytics Services Consulting Pte. Ltd.exe	ipconfig.exe
PID 1756 wrote to memory of 204	1756	Data Analytics Services Consulting Pte. Ltd.exe	ipconfig.exe
PID 1756 wrote to memory of 204	1756	Data Analytics Services Consulting Pte. Ltd.exe	ipconfig.exe
PID 1756 wrote to memory of 204	1756	Data Analytics Services Consulting Pte. Ltd.exe	ipconfig.exe
PID 1756 wrote to memory of 204	1756	Data Analytics Services Consulting Pte. Ltd.exe	ipconfig.exe
PID 1756 wrote to memory of 204	1756	Data Analytics Services Consulting Pte. Ltd.exe	ipconfig.exe
PID 1756 wrote to memory of 204	1756	Data Analytics Services Consulting Pte. Ltd.exe	ipconfig.exe
PID 1756 wrote to memory of 204	1756	Data Analytics Services Consulting Pte. Ltd.exe	ipconfig.exe
PID 1756 wrote to memory of 204	1756	Data Analytics Services Consulting Pte. Ltd.exe	ipconfig.exe
PID 1756 wrote to memory of 204	1756	Data Analytics Services Consulting Pte. Ltd.exe	ipconfig.exe
PID 1756 wrote to memory of 204	1756	Data Analytics Services Consulting Pte. Ltd.exe	ipconfig.exe
PID 1756 wrote to memory of 204	1756	Data Analytics Services Consulting Pte. Ltd.exe	ipconfig.exe
PID 1756 wrote to memory of 204	1756	Data Analytics Services Consulting Pte. Ltd.exe	ipconfig.exe
PID 1756 wrote to memory of 204	1756	Data Analytics Services Consulting Pte. Ltd.exe	ipconfig.exe
PID 1756 wrote to memory of 204	1756	Data Analytics Services Consulting Pte. Ltd.exe	ipconfig.exe
PID 1756 wrote to memory of 204	1756	Data Analytics Services Consulting Pte. Ltd.exe	ipconfig.exe
PID 1756 wrote to memory of 204	1756	Data Analytics Services Consulting Pte. Ltd.exe	ipconfig.exe
PID 1756 wrote to memory of 204	1756	Data Analytics Services Consulting Pte. Ltd.exe	ipconfig.exe
PID 1756 wrote to memory of 204	1756	Data Analytics Services Consulting Pte. Ltd.exe	ipconfig.exe
PID 1756 wrote to memory of 204	1756	Data Analytics Services Consulting Pte. Ltd.exe	ipconfig.exe
PID 1756 wrote to memory of 204	1756	Data Analytics Services Consulting Pte. Ltd.exe	ipconfig.exe
PID 1756 wrote to memory of 204	1756	Data Analytics Services Consulting Pte. Ltd.exe	ipconfig.exe
PID 1756 wrote to memory of 204	1756	Data Analytics Services Consulting Pte. Ltd.exe	ipconfig.exe
PID 1756 wrote to memory of 204	1756	Data Analytics Services Consulting Pte. Ltd.exe	ipconfig.exe
PID 1756 wrote to memory of 204	1756	Data Analytics Services Consulting Pte. Ltd.exe	ipconfig.exe
PID 1756 wrote to memory of 204	1756	Data Analytics Services Consulting Pte. Ltd.exe	ipconfig.exe
PID 1756 wrote to memory of 204	1756	Data Analytics Services Consulting Pte. Ltd.exe	ipconfig.exe
PID 1756 wrote to memory of 204	1756	Data Analytics Services Consulting Pte. Ltd.exe	ipconfig.exe
PID 1756 wrote to memory of 204	1756	Data Analytics Services Consulting Pte. Ltd.exe	ipconfig.exe
PID 1756 wrote to memory of 204	1756	Data Analytics Services Consulting Pte. Ltd.exe	ipconfig.exe
PID 1756 wrote to memory of 204	1756	Data Analytics Services Consulting Pte. Ltd.exe	ipconfig.exe
PID 1756 wrote to memory of 204	1756	Data Analytics Services Consulting Pte. Ltd.exe	ipconfig.exe
PID 1756 wrote to memory of 204	1756	Data Analytics Services Consulting Pte. Ltd.exe	ipconfig.exe

C:\Users\Admin\AppData\Local\Temp\Data Analytics Services Consulting Pte. Ltd.exe
"C:\Users\Admin\AppData\Local\Temp\Data Analytics Services Consulting Pte. Ltd.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1756

C:\Windows\SysWOW64\ipconfig.exe
"C:\Windows\system32\ipconfig.exe"
2⤵
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:204

C:\Users\Admin\AppData\Local\Temp\cmd.exe
"C:\Users\Admin\AppData\Local\Temp\cmd.exe"
3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1960

C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe
"C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"
4⤵
- Executes dropped EXE
PID:2636

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\cmd.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\x64btit.txt

Download Submit
memory/204-0-0x0000000000000000-mapping.dmp

Download
memory/204-1-0x0000000006840000-0x00000000068C2000-memory.dmp

Filesize
520KB

Download
memory/204-2-0x0000000006EA0000-0x0000000006F3F000-memory.dmp

Filesize
636KB

Download
memory/1960-3-0x0000000000000000-mapping.dmp

Download
memory/1960-5-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/2636-6-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing