osiris | 01d5f1b32235b5d5ba5970d56639d82aa3d83b57ec08c79b3580fd0c88ef1c29

Target

osiris.exe
Size

434KB
MD5

64876d5de7061e925e29f6a0c87cea9b
SHA1

51d6ed277b85b07974d450a9b3441c780467613f
SHA256

01d5f1b32235b5d5ba5970d56639d82aa3d83b57ec08c79b3580fd0c88ef1c29
SHA512

2dfe245cd058d10ac35c441238c52dcb08db8c565786d5824baf9cbd2846f2a4803709d4e9850add7f4c8e6ea5f37c23c66423820a9d6af2b7da8ddf74b6cb1b

Score

10^/10

Malware Config

Osiris
banker botnet osiris
Executes dropped EXE 1 IoCs

Processes:

GetX64BTIT.exe

pid process

3424 GetX64BTIT.exe
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

15 api.ipify.org
16 api.ipify.org
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.

Connection Proxy
T1090

pid	process
3424	GetX64BTIT.exe

flow	ioc
15	api.ipify.org
16	api.ipify.org

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

osiris.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

osiris.exe

pid process

4808 osiris.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

osiris.exe

description	pid	process	target process
PID 4808 wrote to memory of 3424	4808	osiris.exe	GetX64BTIT.exe
PID 4808 wrote to memory of 3424	4808	osiris.exe	GetX64BTIT.exe

C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe
"C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"
2⤵
- Executes dropped EXE
PID:3424

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Connection Proxy

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Connection Proxy

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe
MD5
b4cd27f2b37665f51eb9fe685ec1d373

SHA1
7f08febf0fdb7fc9f8bf35a10fb11e7de431abe0

SHA256
91f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581

SHA512
e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe
MD5
b4cd27f2b37665f51eb9fe685ec1d373

SHA1
7f08febf0fdb7fc9f8bf35a10fb11e7de431abe0

SHA256
91f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581

SHA512
e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\x64btit.txt
MD5
86b4b4bb58e9b33f53de7ae2260835c3

SHA1
55e17d13537076d5c267dc3c6572ff653e0591e2

SHA256
8826ea90454c3a3c566c243fcc2ce5e528006c7cbc925a4fc79cc8c7f9327630

SHA512
79103136af90443917f2666920c08aceffe52730b9da2a98514f8296a0a296ea081fdefd34d4aa3ccdec68e2d2256cb26160639e7d0091af289044dd84b08d9c

Download Submit
memory/3424-2-0x0000000000000000-mapping.dmp

Download