Overview

overview

10

Static

static

dfb2cb14a2...5f.exe

windows7_x64

10

dfb2cb14a2...5f.exe

windows10_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    124s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    05-11-2020 16:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    dfb2cb14a2f6a3281514226cec06bb2bb99e9ebbeb583a9b6f80ec8b4d6fe15f.exe

  • Size

    484KB

  • MD5

    b988afbb1df5f268d64a2ef604c92cdf

  • SHA1

    b9320b32b14219e2829eaa6a69b046e6d68b39dd

  • SHA256

    dfb2cb14a2f6a3281514226cec06bb2bb99e9ebbeb583a9b6f80ec8b4d6fe15f

  • SHA512

    ff4d78db6deac88a8094e4921bc4c8bf8a245b97e4e7c2e3c6f9855b900f4f667980e4543ebb53842778405841e2b575d414c05bc893211c1555cc0cd64e51f5

Score
10/10
osirisbankerbotnetspyware

Malware Config

Signatures

  • Osiris
    bankerbotnetosiris
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 5728 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dfb2cb14a2f6a3281514226cec06bb2bb99e9ebbeb583a9b6f80ec8b4d6fe15f.exe
    "C:\Users\Admin\AppData\Local\Temp\dfb2cb14a2f6a3281514226cec06bb2bb99e9ebbeb583a9b6f80ec8b4d6fe15f.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:540
    • C:\Users\Admin\AppData\Local\Temp\dfb2cb14a2f6a3281514226cec06bb2bb99e9ebbeb583a9b6f80ec8b4d6fe15f.exe
      "C:\Users\Admin\AppData\Local\Temp\dfb2cb14a2f6a3281514226cec06bb2bb99e9ebbeb583a9b6f80ec8b4d6fe15f.exe"
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3076
      • C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe
        "C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"
        3⤵
        • Executes dropped EXE
        PID:692
      • C:\Users\Admin\AppData\Local\Temp\{2E4E3A8B-1D26-4A81-B402-E98EF35A58B1}\89477942.exe
        "89477942.exe"
        3⤵
        • Executes dropped EXE
        PID:2076
      • C:\Users\Admin\AppData\Local\Temp\{2E4E3A8B-1D26-4A81-B402-E98EF35A58B1}\421950546.exe
        C:\Users\Admin\AppData\Local\Temp\{2E4E3A8B-1D26-4A81-B402-E98EF35A58B1}\421950546.exe /sjson C:\Users\Admin\AppData\Local\Temp\{2E4E3A8B-1D26-4A81-B402-E98EF35A58B1}\book.json
        3⤵
        • Executes dropped EXE
        PID:3176
      • C:\Users\Admin\AppData\Local\Temp\{2E4E3A8B-1D26-4A81-B402-E98EF35A58B1}\1066157052.exe
        C:\Users\Admin\AppData\Local\Temp\{2E4E3A8B-1D26-4A81-B402-E98EF35A58B1}\1066157052.exe /sjson C:\Users\Admin\AppData\Local\Temp\{2E4E3A8B-1D26-4A81-B402-E98EF35A58B1}\book.json
        3⤵
        • Executes dropped EXE
        PID:1188
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 540 -s 320
      2⤵
      • Program crash
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1092

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe
    MD5

    b4cd27f2b37665f51eb9fe685ec1d373

    SHA1

    7f08febf0fdb7fc9f8bf35a10fb11e7de431abe0

    SHA256

    91f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581

    SHA512

    e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe
    MD5

    b4cd27f2b37665f51eb9fe685ec1d373

    SHA1

    7f08febf0fdb7fc9f8bf35a10fb11e7de431abe0

    SHA256

    91f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581

    SHA512

    e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\x64btit.txt
    MD5

    89e91d6e494c95f36113eab5eeaf1932

    SHA1

    4bce3ab1745c2c008e29bf3d61e787d4843c2cdb

    SHA256

    512fa85a0672fbd70df03d3d3a4b2e7a753274c50ff9560420c044fffc0a742f

    SHA512

    a7b2338c664e5be0e9c0dc58cb9f4a754c81a01207d7aac853b7d9c0b5cedd822d73c5ea638ccdea04bdd38c526f977c39a2f3801ba052c9688ea676a1ff4c0c

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\{2E4E3A8B-1D26-4A81-B402-E98EF35A58B1}\1066157052.exe
    MD5

    b94350c5a57401721ce013c1a76c2727

    SHA1

    f0e946cf41e3c11d7f84736a365ec3d0b173fef4

    SHA256

    e6f88219fde1d526253de53f06fdb95ad08704c4dedbcdcf062d09db69754a58

    SHA512

    0b3622a799f46bf3023a7ff0afde855261f2cc1a42b19c625f17333b480bd90eddb20f61a436724065c9b5372c4beee66366bfd6f3dd5aacfb5bbaa73a022193

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\{2E4E3A8B-1D26-4A81-B402-E98EF35A58B1}\1066157052.exe
    MD5

    b94350c5a57401721ce013c1a76c2727

    SHA1

    f0e946cf41e3c11d7f84736a365ec3d0b173fef4

    SHA256

    e6f88219fde1d526253de53f06fdb95ad08704c4dedbcdcf062d09db69754a58

    SHA512

    0b3622a799f46bf3023a7ff0afde855261f2cc1a42b19c625f17333b480bd90eddb20f61a436724065c9b5372c4beee66366bfd6f3dd5aacfb5bbaa73a022193

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\{2E4E3A8B-1D26-4A81-B402-E98EF35A58B1}\421950546.exe
    MD5

    b94350c5a57401721ce013c1a76c2727

    SHA1

    f0e946cf41e3c11d7f84736a365ec3d0b173fef4

    SHA256

    e6f88219fde1d526253de53f06fdb95ad08704c4dedbcdcf062d09db69754a58

    SHA512

    0b3622a799f46bf3023a7ff0afde855261f2cc1a42b19c625f17333b480bd90eddb20f61a436724065c9b5372c4beee66366bfd6f3dd5aacfb5bbaa73a022193

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\{2E4E3A8B-1D26-4A81-B402-E98EF35A58B1}\421950546.exe
    MD5

    b94350c5a57401721ce013c1a76c2727

    SHA1

    f0e946cf41e3c11d7f84736a365ec3d0b173fef4

    SHA256

    e6f88219fde1d526253de53f06fdb95ad08704c4dedbcdcf062d09db69754a58

    SHA512

    0b3622a799f46bf3023a7ff0afde855261f2cc1a42b19c625f17333b480bd90eddb20f61a436724065c9b5372c4beee66366bfd6f3dd5aacfb5bbaa73a022193

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\{2E4E3A8B-1D26-4A81-B402-E98EF35A58B1}\89477942.exe
    MD5

    9f385a9a69a4d9e18055743f0694976b

    SHA1

    2c2385ea964a33f803e96e364d4a05771c733921

    SHA256

    45f175bc165a3f8d9a05da48bdc4c1f234386588e0d003df094f72d019ae6216

    SHA512

    e9e78eb02bad22815648723138a7443da527779644ad9f9e776f91ba796b255c7556c5fe82ea526825c23ea376ed90d4dd5f31b026d2ff00605d8db9b0729c3c

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\{2E4E3A8B-1D26-4A81-B402-E98EF35A58B1}\89477942.exe
    MD5

    9f385a9a69a4d9e18055743f0694976b

    SHA1

    2c2385ea964a33f803e96e364d4a05771c733921

    SHA256

    45f175bc165a3f8d9a05da48bdc4c1f234386588e0d003df094f72d019ae6216

    SHA512

    e9e78eb02bad22815648723138a7443da527779644ad9f9e776f91ba796b255c7556c5fe82ea526825c23ea376ed90d4dd5f31b026d2ff00605d8db9b0729c3c

    Download Submit
  • memory/692-4-0x0000000000000000-mapping.dmp
    Download
  • memory/1092-7-0x0000000004BA0000-0x0000000004BA1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1092-3-0x0000000004770000-0x0000000004771000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1188-23-0x0000000000000000-mapping.dmp
    Download
  • memory/2076-17-0x0000000000000000-mapping.dmp
    Download
  • memory/3076-0-0x0000000000400000-0x0000000000456000-memory.dmp
    Filesize

    344KB

    Download
  • memory/3076-2-0x0000000000400000-0x0000000000456000-memory.dmp
    Filesize

    344KB

    Download
  • memory/3076-1-0x0000000000401698-mapping.dmp
    Download
  • memory/3176-20-0x0000000000000000-mapping.dmp
    Download