osiris | e138114de7be8b668de032a3bacf123dc855eead36d2765689c990cf1951771c

Analysis

max time kernel
150s
max time network
151s
platform
windows10_x64
resource
win10
submitted
26-10-2020 07:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c3c4e97a92372bba5299301c96a20a15.exe
Size

2.0MB
MD5

c3c4e97a92372bba5299301c96a20a15
SHA1

059ce2d62526a9c4bb1ab81cacb1945fa23a4478
SHA256

e138114de7be8b668de032a3bacf123dc855eead36d2765689c990cf1951771c
SHA512

7eb8b4d87004d0edffd43ef90656d2e805befe3743a626fe60bce11b240959995ba39f5dc15a19e47f34edd9180c9d1d7547df447efaed5fbb72f30ea1007780

Score

10^/10

discovery banker botnet osiris spyware

Malware Config

Signatures

Osiris
banker botnet osiris
Executes dropped EXE 3 IoCs

Processes:

1kKgdlbttN.exe1kKgdlbttN.exeGetX64BTIT.exe

pid process

976 1kKgdlbttN.exe
400 1kKgdlbttN.exe
1868 GetX64BTIT.exe

pid	process
976	1kKgdlbttN.exe
400	1kKgdlbttN.exe
1868	GetX64BTIT.exe

Loads dropped DLL 6 IoCs

Processes:

c3c4e97a92372bba5299301c96a20a15.exe

pid	process
2472	c3c4e97a92372bba5299301c96a20a15.exe
2472	c3c4e97a92372bba5299301c96a20a15.exe
2472	c3c4e97a92372bba5299301c96a20a15.exe
2472	c3c4e97a92372bba5299301c96a20a15.exe
2472	c3c4e97a92372bba5299301c96a20a15.exe
2472	c3c4e97a92372bba5299301c96a20a15.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

JavaScript code in executable 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\LocalLow\nb98wqnehe8bw89hb\nss3.dll	js

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

28 api.ipify.org
29 api.ipify.org

flow	ioc
28	api.ipify.org
29	api.ipify.org

Suspicious use of SetThreadContext 2 IoCs

Processes:

c3c4e97a92372bba5299301c96a20a15.exe1kKgdlbttN.exe

description	pid	process	target process
PID 3980 set thread context of 2472	3980	c3c4e97a92372bba5299301c96a20a15.exe	c3c4e97a92372bba5299301c96a20a15.exe
PID 976 set thread context of 400	976	1kKgdlbttN.exe	1kKgdlbttN.exe

Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

3992 timeout.exe

pid	process
3992	timeout.exe

Suspicious behavior: EnumeratesProcesses 4158 IoCs

Processes:

c3c4e97a92372bba5299301c96a20a15.exe1kKgdlbttN.exe

pid	process
3980	c3c4e97a92372bba5299301c96a20a15.exe
3980	c3c4e97a92372bba5299301c96a20a15.exe
400	1kKgdlbttN.exe
400	1kKgdlbttN.exe
400	1kKgdlbttN.exe
400	1kKgdlbttN.exe
400	1kKgdlbttN.exe
400	1kKgdlbttN.exe
400	1kKgdlbttN.exe
400	1kKgdlbttN.exe
400	1kKgdlbttN.exe
400	1kKgdlbttN.exe
400	1kKgdlbttN.exe
400	1kKgdlbttN.exe
400	1kKgdlbttN.exe
400	1kKgdlbttN.exe
400	1kKgdlbttN.exe
400	1kKgdlbttN.exe
400	1kKgdlbttN.exe
400	1kKgdlbttN.exe
400	1kKgdlbttN.exe
400	1kKgdlbttN.exe
400	1kKgdlbttN.exe
400	1kKgdlbttN.exe
400	1kKgdlbttN.exe
400	1kKgdlbttN.exe
400	1kKgdlbttN.exe
400	1kKgdlbttN.exe
400	1kKgdlbttN.exe
400	1kKgdlbttN.exe
400	1kKgdlbttN.exe
400	1kKgdlbttN.exe
400	1kKgdlbttN.exe
400	1kKgdlbttN.exe
400	1kKgdlbttN.exe
400	1kKgdlbttN.exe
400	1kKgdlbttN.exe
400	1kKgdlbttN.exe
400	1kKgdlbttN.exe
400	1kKgdlbttN.exe
400	1kKgdlbttN.exe
400	1kKgdlbttN.exe
400	1kKgdlbttN.exe
400	1kKgdlbttN.exe
400	1kKgdlbttN.exe
400	1kKgdlbttN.exe
400	1kKgdlbttN.exe
400	1kKgdlbttN.exe
400	1kKgdlbttN.exe
400	1kKgdlbttN.exe
400	1kKgdlbttN.exe
400	1kKgdlbttN.exe
400	1kKgdlbttN.exe
400	1kKgdlbttN.exe
400	1kKgdlbttN.exe
400	1kKgdlbttN.exe
400	1kKgdlbttN.exe
400	1kKgdlbttN.exe
400	1kKgdlbttN.exe
400	1kKgdlbttN.exe
400	1kKgdlbttN.exe
400	1kKgdlbttN.exe
400	1kKgdlbttN.exe
400	1kKgdlbttN.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

c3c4e97a92372bba5299301c96a20a15.exe1kKgdlbttN.exe

description pid process

Token: SeDebugPrivilege 3980 c3c4e97a92372bba5299301c96a20a15.exe
Token: SeDebugPrivilege 976 1kKgdlbttN.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

1kKgdlbttN.exe

pid process

400 1kKgdlbttN.exe

description	pid	process
Token: SeDebugPrivilege	3980	c3c4e97a92372bba5299301c96a20a15.exe
Token: SeDebugPrivilege	976	1kKgdlbttN.exe

pid	process
400	1kKgdlbttN.exe

Suspicious use of WriteProcessMemory 33 IoCs

Processes:

c3c4e97a92372bba5299301c96a20a15.exec3c4e97a92372bba5299301c96a20a15.execmd.exe1kKgdlbttN.exe1kKgdlbttN.exe

description	pid	process	target process
PID 3980 wrote to memory of 2436	3980	c3c4e97a92372bba5299301c96a20a15.exe	c3c4e97a92372bba5299301c96a20a15.exe
PID 3980 wrote to memory of 2436	3980	c3c4e97a92372bba5299301c96a20a15.exe	c3c4e97a92372bba5299301c96a20a15.exe
PID 3980 wrote to memory of 2436	3980	c3c4e97a92372bba5299301c96a20a15.exe	c3c4e97a92372bba5299301c96a20a15.exe
PID 3980 wrote to memory of 2472	3980	c3c4e97a92372bba5299301c96a20a15.exe	c3c4e97a92372bba5299301c96a20a15.exe
PID 3980 wrote to memory of 2472	3980	c3c4e97a92372bba5299301c96a20a15.exe	c3c4e97a92372bba5299301c96a20a15.exe
PID 3980 wrote to memory of 2472	3980	c3c4e97a92372bba5299301c96a20a15.exe	c3c4e97a92372bba5299301c96a20a15.exe
PID 3980 wrote to memory of 2472	3980	c3c4e97a92372bba5299301c96a20a15.exe	c3c4e97a92372bba5299301c96a20a15.exe
PID 3980 wrote to memory of 2472	3980	c3c4e97a92372bba5299301c96a20a15.exe	c3c4e97a92372bba5299301c96a20a15.exe
PID 3980 wrote to memory of 2472	3980	c3c4e97a92372bba5299301c96a20a15.exe	c3c4e97a92372bba5299301c96a20a15.exe
PID 3980 wrote to memory of 2472	3980	c3c4e97a92372bba5299301c96a20a15.exe	c3c4e97a92372bba5299301c96a20a15.exe
PID 3980 wrote to memory of 2472	3980	c3c4e97a92372bba5299301c96a20a15.exe	c3c4e97a92372bba5299301c96a20a15.exe
PID 3980 wrote to memory of 2472	3980	c3c4e97a92372bba5299301c96a20a15.exe	c3c4e97a92372bba5299301c96a20a15.exe
PID 2472 wrote to memory of 976	2472	c3c4e97a92372bba5299301c96a20a15.exe	1kKgdlbttN.exe
PID 2472 wrote to memory of 976	2472	c3c4e97a92372bba5299301c96a20a15.exe	1kKgdlbttN.exe
PID 2472 wrote to memory of 976	2472	c3c4e97a92372bba5299301c96a20a15.exe	1kKgdlbttN.exe
PID 2472 wrote to memory of 1344	2472	c3c4e97a92372bba5299301c96a20a15.exe	cmd.exe
PID 2472 wrote to memory of 1344	2472	c3c4e97a92372bba5299301c96a20a15.exe	cmd.exe
PID 2472 wrote to memory of 1344	2472	c3c4e97a92372bba5299301c96a20a15.exe	cmd.exe
PID 1344 wrote to memory of 3992	1344	cmd.exe	timeout.exe
PID 1344 wrote to memory of 3992	1344	cmd.exe	timeout.exe
PID 1344 wrote to memory of 3992	1344	cmd.exe	timeout.exe
PID 976 wrote to memory of 400	976	1kKgdlbttN.exe	1kKgdlbttN.exe
PID 976 wrote to memory of 400	976	1kKgdlbttN.exe	1kKgdlbttN.exe
PID 976 wrote to memory of 400	976	1kKgdlbttN.exe	1kKgdlbttN.exe
PID 976 wrote to memory of 400	976	1kKgdlbttN.exe	1kKgdlbttN.exe
PID 976 wrote to memory of 400	976	1kKgdlbttN.exe	1kKgdlbttN.exe
PID 976 wrote to memory of 400	976	1kKgdlbttN.exe	1kKgdlbttN.exe
PID 976 wrote to memory of 400	976	1kKgdlbttN.exe	1kKgdlbttN.exe
PID 976 wrote to memory of 400	976	1kKgdlbttN.exe	1kKgdlbttN.exe
PID 976 wrote to memory of 400	976	1kKgdlbttN.exe	1kKgdlbttN.exe
PID 976 wrote to memory of 400	976	1kKgdlbttN.exe	1kKgdlbttN.exe
PID 400 wrote to memory of 1868	400	1kKgdlbttN.exe	GetX64BTIT.exe
PID 400 wrote to memory of 1868	400	1kKgdlbttN.exe	GetX64BTIT.exe

C:\Users\Admin\AppData\Local\Temp\c3c4e97a92372bba5299301c96a20a15.exe
"C:\Users\Admin\AppData\Local\Temp\c3c4e97a92372bba5299301c96a20a15.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3980

C:\Users\Admin\AppData\Local\Temp\c3c4e97a92372bba5299301c96a20a15.exe
"C:\Users\Admin\AppData\Local\Temp\c3c4e97a92372bba5299301c96a20a15.exe"
2⤵
PID:2436

C:\Users\Admin\AppData\Local\Temp\c3c4e97a92372bba5299301c96a20a15.exe
"C:\Users\Admin\AppData\Local\Temp\c3c4e97a92372bba5299301c96a20a15.exe"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2472

C:\Users\Admin\AppData\Local\Temp\1kKgdlbttN.exe
"C:\Users\Admin\AppData\Local\Temp\1kKgdlbttN.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:976

C:\Users\Admin\AppData\Local\Temp\1kKgdlbttN.exe
"C:\Users\Admin\AppData\Local\Temp\1kKgdlbttN.exe"
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:400

C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe
"C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"
5⤵
- Executes dropped EXE
PID:1868

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\c3c4e97a92372bba5299301c96a20a15.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:1344

C:\Windows\SysWOW64\timeout.exe
timeout /T 10 /NOBREAK
4⤵
- Delays execution with timeout.exe
PID:3992

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1kKgdlbttN.exe
MD5
99d68a607e7e290918e62a39a2c61dd4

SHA1
123d4c41034119cde4e9e9efcbe415bef60d0508

SHA256
6646f55e728910bca16b6905710282e723ad8a0b617f64a47d3acb1d23e0b36a

SHA512
c3a4fbd359d7783686972fa7c0636658c4610062c749362fab9f35a5775920b3cd7963dc8cce43bd14a2954001ca55328bc1b9ebbaf0b3333ce5a76eb1212502

Download Submit
C:\Users\Admin\AppData\Local\Temp\1kKgdlbttN.exe
MD5
99d68a607e7e290918e62a39a2c61dd4

SHA1
123d4c41034119cde4e9e9efcbe415bef60d0508

SHA256
6646f55e728910bca16b6905710282e723ad8a0b617f64a47d3acb1d23e0b36a

SHA512
c3a4fbd359d7783686972fa7c0636658c4610062c749362fab9f35a5775920b3cd7963dc8cce43bd14a2954001ca55328bc1b9ebbaf0b3333ce5a76eb1212502

Download Submit
C:\Users\Admin\AppData\Local\Temp\1kKgdlbttN.exe
MD5
99d68a607e7e290918e62a39a2c61dd4

SHA1
123d4c41034119cde4e9e9efcbe415bef60d0508

SHA256
6646f55e728910bca16b6905710282e723ad8a0b617f64a47d3acb1d23e0b36a

SHA512
c3a4fbd359d7783686972fa7c0636658c4610062c749362fab9f35a5775920b3cd7963dc8cce43bd14a2954001ca55328bc1b9ebbaf0b3333ce5a76eb1212502

Download Submit
C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe
MD5
b4cd27f2b37665f51eb9fe685ec1d373

SHA1
7f08febf0fdb7fc9f8bf35a10fb11e7de431abe0

SHA256
91f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581

SHA512
e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe
MD5
b4cd27f2b37665f51eb9fe685ec1d373

SHA1
7f08febf0fdb7fc9f8bf35a10fb11e7de431abe0

SHA256
91f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581

SHA512
e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\x64btit.txt
MD5
991b03a6f0d2865cb9bf4f0ef0f901d1

SHA1
32edc9adf12412f564b300bc7d6c880b00cc5418

SHA256
40b68130258b5502d8a01a6104d22967847903ab683a15c5a729bd795b9653fa

SHA512
ca8ba7418ec906865b84e24f75133d14306f715f65f1075de98d3e52ccf3d66e7abb88df507fbdabde9b18cb509c2f959b460820c85e126f1d3d03c4e601a61f

Download Submit
\Users\Admin\AppData\LocalLow\nb98wqnehe8bw89hb\freebl3.dll
MD5
60acd24430204ad2dc7f148b8cfe9bdc

SHA1
989f377b9117d7cb21cbe92a4117f88f9c7693d9

SHA256
9876c53134dbbec4dcca67581f53638eba3fea3a15491aa3cf2526b71032da97

SHA512
626c36e9567f57fa8ec9c36d96cbadede9c6f6734a7305ecfb9f798952bbacdfa33a1b6c4999ba5b78897dc2ec6f91870f7ec25b2ceacbaee4be942fe881db01

Download Submit
\Users\Admin\AppData\LocalLow\nb98wqnehe8bw89hb\freebl3.dll
MD5
60acd24430204ad2dc7f148b8cfe9bdc

SHA1
989f377b9117d7cb21cbe92a4117f88f9c7693d9

SHA256
9876c53134dbbec4dcca67581f53638eba3fea3a15491aa3cf2526b71032da97

SHA512
626c36e9567f57fa8ec9c36d96cbadede9c6f6734a7305ecfb9f798952bbacdfa33a1b6c4999ba5b78897dc2ec6f91870f7ec25b2ceacbaee4be942fe881db01

Download Submit
\Users\Admin\AppData\LocalLow\nb98wqnehe8bw89hb\mozglue.dll
MD5
eae9273f8cdcf9321c6c37c244773139

SHA1
8378e2a2f3635574c106eea8419b5eb00b8489b0

SHA256
a0c6630d4012ae0311ff40f4f06911bcf1a23f7a4762ce219b8dffa012d188cc

SHA512
06e43e484a89cea9ba9b9519828d38e7c64b040f44cdaeb321cbda574e7551b11fea139ce3538f387a0a39a3d8c4cba7f4cf03e4a3c98db85f8121c2212a9097

Download Submit
\Users\Admin\AppData\LocalLow\nb98wqnehe8bw89hb\nss3.dll
MD5
02cc7b8ee30056d5912de54f1bdfc219

SHA1
a6923da95705fb81e368ae48f93d28522ef552fb

SHA256
1989526553fd1e1e49b0fea8036822ca062d3d39c4cab4a37846173d0f1753d5

SHA512
0d5dfcf4fb19b27246fa799e339d67cd1b494427783f379267fb2d10d615ffb734711bab2c515062c078f990a44a36f2d15859b1dacd4143dcc35b5c0cee0ef5

Download Submit
\Users\Admin\AppData\LocalLow\nb98wqnehe8bw89hb\softokn3.dll
MD5
4e8df049f3459fa94ab6ad387f3561ac

SHA1
06ed392bc29ad9d5fc05ee254c2625fd65925114

SHA256
25a4dae37120426ab060ebb39b7030b3e7c1093cc34b0877f223b6843b651871

SHA512
3dd4a86f83465989b2b30c240a7307edd1b92d5c1d5c57d47eff287dc9daa7bace157017908d82e00be90f08ff5badb68019ffc9d881440229dcea5038f61cd6

Download Submit
\Users\Admin\AppData\LocalLow\sqlite3.dll
MD5
f964811b68f9f1487c2b41e1aef576ce

SHA1
b423959793f14b1416bc3b7051bed58a1034025f

SHA256
83bc57dcf282264f2b00c21ce0339eac20fcb7401f7c5472c0cd0c014844e5f7

SHA512
565b1a7291c6fcb63205907fcd9e72fc2e11ca945afc4468c378edba882e2f314c2ac21a7263880ff7d4b84c2a1678024c1ac9971ac1c1de2bfa4248ec0f98c4

Download Submit
memory/400-25-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/400-28-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/400-26-0x0000000000401698-mapping.dmp

Download
memory/976-23-0x0000000005420000-0x0000000005489000-memory.dmp

Filesize
420KB

Download
memory/976-19-0x0000000071B20000-0x000000007220E000-memory.dmp

Filesize
6.9MB

Download
memory/976-20-0x0000000000730000-0x0000000000731000-memory.dmp

Filesize
4KB

Download
memory/976-15-0x0000000000000000-mapping.dmp

Download
memory/1344-18-0x0000000000000000-mapping.dmp

Download
memory/1868-29-0x0000000000000000-mapping.dmp

Download
memory/2472-7-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/2472-6-0x000000000043FBEE-mapping.dmp

Download
memory/2472-5-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/3980-0-0x0000000073880000-0x0000000073F6E000-memory.dmp

Filesize
6.9MB

Download
memory/3980-4-0x0000000000BD0000-0x0000000000BDC000-memory.dmp

Filesize
48KB

Download
memory/3980-3-0x0000000004D80000-0x0000000004DDF000-memory.dmp

Filesize
380KB

Download
memory/3980-1-0x0000000000050000-0x0000000000051000-memory.dmp

Filesize
4KB

Download
memory/3992-22-0x0000000000000000-mapping.dmp

Download