osiris | 4807f8fce08612cc316476fe34aa497188810fc10102c6c07bf18142655eb252

Analysis

max time kernel
150s
max time network
112s
platform
windows10_x64
resource
win10v20201028
submitted
11-03-2021 18:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Secure_Viewer.exe_.exe
Size

1.4MB
MD5

0c09489446c609ba6893455661948ac7
SHA1

46e09d46a00ea8f151b661db6332c83695b1cf90
SHA256

4807f8fce08612cc316476fe34aa497188810fc10102c6c07bf18142655eb252
SHA512

07f3211408bb75cb25bad4042e3246320b38cd1d30d77635c38f12687bd90ca5b2f8241883aae0a956a606186b3ec0945dd4ad36c3944c1126aae98f2402ae06

Score

10^/10

osiris banker botnet spyware stealer

Malware Config

Signatures

Osiris
banker botnet osiris

Nirsoft 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\{0E0AC68D-208E-475C-A5B4-70D93319FB56}\921031860.exe	Nirsoft
C:\Users\Admin\AppData\Local\Temp\{0E0AC68D-208E-475C-A5B4-70D93319FB56}\921031860.exe	Nirsoft

Executes dropped EXE 4 IoCs

Processes:

cmd.exeGetX64BTIT.exe921031860.exe350986977.exe

pid process

3324 cmd.exe
836 GetX64BTIT.exe
1084 921031860.exe
1400 350986977.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

18 api.ipify.org
19 api.ipify.org
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.

Connection Proxy
T1090
Drops file in Windows directory 1 IoCs

Processes:

cmd.exe

description ioc process

File created C:\Windows\Tasks\Secure_Viewer.exe_.job cmd.exe

pid	process
3324	cmd.exe
836	GetX64BTIT.exe
1084	921031860.exe
1400	350986977.exe

flow	ioc
18	api.ipify.org
19	api.ipify.org

description	ioc	process
File created	C:\Windows\Tasks\Secure_Viewer.exe_.job	cmd.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

cmd.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\IntelliForms\Storage2	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Secure_Viewer.exe_.exenotepad.execmd.exe

pid	process
4764	Secure_Viewer.exe_.exe
3652	notepad.exe
3324	cmd.exe
3324	cmd.exe
3324	cmd.exe
3324	cmd.exe
3324	cmd.exe
3324	cmd.exe
3324	cmd.exe
3324	cmd.exe
3324	cmd.exe
3324	cmd.exe
3324	cmd.exe
3324	cmd.exe
3324	cmd.exe
3324	cmd.exe
3324	cmd.exe
3324	cmd.exe
3324	cmd.exe
3324	cmd.exe
3324	cmd.exe
3324	cmd.exe
3324	cmd.exe
3324	cmd.exe
3324	cmd.exe
3324	cmd.exe
3324	cmd.exe
3324	cmd.exe
3324	cmd.exe
3324	cmd.exe
3324	cmd.exe
3324	cmd.exe
3324	cmd.exe
3324	cmd.exe
3324	cmd.exe
3324	cmd.exe
3324	cmd.exe
3324	cmd.exe
3324	cmd.exe
3324	cmd.exe
3324	cmd.exe
3324	cmd.exe
3324	cmd.exe
3324	cmd.exe
3324	cmd.exe
3324	cmd.exe
3324	cmd.exe
3324	cmd.exe
3324	cmd.exe
3324	cmd.exe
3324	cmd.exe
3324	cmd.exe
3324	cmd.exe
3324	cmd.exe
3324	cmd.exe
3324	cmd.exe
3324	cmd.exe
3324	cmd.exe
3324	cmd.exe
3324	cmd.exe
3324	cmd.exe
3324	cmd.exe
3324	cmd.exe
3324	cmd.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

notepad.exe

pid process

3652 notepad.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

cmd.exe

pid process

3324 cmd.exe

pid	process
3652	notepad.exe

pid	process
3324	cmd.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Secure_Viewer.exe_.exe

description	pid	process	target process
PID 4764 wrote to memory of 3652	4764	Secure_Viewer.exe_.exe	notepad.exe
PID 4764 wrote to memory of 3652	4764	Secure_Viewer.exe_.exe	notepad.exe
PID 4764 wrote to memory of 3652	4764	Secure_Viewer.exe_.exe	notepad.exe
PID 4764 wrote to memory of 3652	4764	Secure_Viewer.exe_.exe	notepad.exe
PID 4764 wrote to memory of 3652	4764	Secure_Viewer.exe_.exe	notepad.exe
PID 4764 wrote to memory of 3652	4764	Secure_Viewer.exe_.exe	notepad.exe
PID 4764 wrote to memory of 3652	4764	Secure_Viewer.exe_.exe	notepad.exe
PID 4764 wrote to memory of 3652	4764	Secure_Viewer.exe_.exe	notepad.exe
PID 4764 wrote to memory of 3652	4764	Secure_Viewer.exe_.exe	notepad.exe
PID 4764 wrote to memory of 3652	4764	Secure_Viewer.exe_.exe	notepad.exe
PID 4764 wrote to memory of 3652	4764	Secure_Viewer.exe_.exe	notepad.exe
PID 4764 wrote to memory of 3652	4764	Secure_Viewer.exe_.exe	notepad.exe
PID 4764 wrote to memory of 3652	4764	Secure_Viewer.exe_.exe	notepad.exe
PID 4764 wrote to memory of 3652	4764	Secure_Viewer.exe_.exe	notepad.exe
PID 4764 wrote to memory of 3652	4764	Secure_Viewer.exe_.exe	notepad.exe
PID 4764 wrote to memory of 3652	4764	Secure_Viewer.exe_.exe	notepad.exe
PID 4764 wrote to memory of 3652	4764	Secure_Viewer.exe_.exe	notepad.exe
PID 4764 wrote to memory of 3652	4764	Secure_Viewer.exe_.exe	notepad.exe
PID 4764 wrote to memory of 3652	4764	Secure_Viewer.exe_.exe	notepad.exe
PID 4764 wrote to memory of 3652	4764	Secure_Viewer.exe_.exe	notepad.exe
PID 4764 wrote to memory of 3652	4764	Secure_Viewer.exe_.exe	notepad.exe
PID 4764 wrote to memory of 3652	4764	Secure_Viewer.exe_.exe	notepad.exe
PID 4764 wrote to memory of 3652	4764	Secure_Viewer.exe_.exe	notepad.exe
PID 4764 wrote to memory of 3652	4764	Secure_Viewer.exe_.exe	notepad.exe
PID 4764 wrote to memory of 3652	4764	Secure_Viewer.exe_.exe	notepad.exe
PID 4764 wrote to memory of 3652	4764	Secure_Viewer.exe_.exe	notepad.exe
PID 4764 wrote to memory of 3652	4764	Secure_Viewer.exe_.exe	notepad.exe
PID 4764 wrote to memory of 3652	4764	Secure_Viewer.exe_.exe	notepad.exe
PID 4764 wrote to memory of 3652	4764	Secure_Viewer.exe_.exe	notepad.exe
PID 4764 wrote to memory of 3652	4764	Secure_Viewer.exe_.exe	notepad.exe
PID 4764 wrote to memory of 3652	4764	Secure_Viewer.exe_.exe	notepad.exe
PID 4764 wrote to memory of 3652	4764	Secure_Viewer.exe_.exe	notepad.exe
PID 4764 wrote to memory of 3652	4764	Secure_Viewer.exe_.exe	notepad.exe
PID 4764 wrote to memory of 3652	4764	Secure_Viewer.exe_.exe	notepad.exe
PID 4764 wrote to memory of 3652	4764	Secure_Viewer.exe_.exe	notepad.exe
PID 4764 wrote to memory of 3652	4764	Secure_Viewer.exe_.exe	notepad.exe
PID 4764 wrote to memory of 3652	4764	Secure_Viewer.exe_.exe	notepad.exe
PID 4764 wrote to memory of 3652	4764	Secure_Viewer.exe_.exe	notepad.exe
PID 4764 wrote to memory of 3652	4764	Secure_Viewer.exe_.exe	notepad.exe
PID 4764 wrote to memory of 3652	4764	Secure_Viewer.exe_.exe	notepad.exe
PID 4764 wrote to memory of 3652	4764	Secure_Viewer.exe_.exe	notepad.exe
PID 4764 wrote to memory of 3652	4764	Secure_Viewer.exe_.exe	notepad.exe
PID 4764 wrote to memory of 3652	4764	Secure_Viewer.exe_.exe	notepad.exe
PID 4764 wrote to memory of 3652	4764	Secure_Viewer.exe_.exe	notepad.exe
PID 4764 wrote to memory of 3652	4764	Secure_Viewer.exe_.exe	notepad.exe
PID 4764 wrote to memory of 3652	4764	Secure_Viewer.exe_.exe	notepad.exe
PID 4764 wrote to memory of 3652	4764	Secure_Viewer.exe_.exe	notepad.exe
PID 4764 wrote to memory of 3652	4764	Secure_Viewer.exe_.exe	notepad.exe
PID 4764 wrote to memory of 3652	4764	Secure_Viewer.exe_.exe	notepad.exe
PID 4764 wrote to memory of 3652	4764	Secure_Viewer.exe_.exe	notepad.exe
PID 4764 wrote to memory of 3652	4764	Secure_Viewer.exe_.exe	notepad.exe
PID 4764 wrote to memory of 3652	4764	Secure_Viewer.exe_.exe	notepad.exe
PID 4764 wrote to memory of 3652	4764	Secure_Viewer.exe_.exe	notepad.exe
PID 4764 wrote to memory of 3652	4764	Secure_Viewer.exe_.exe	notepad.exe
PID 4764 wrote to memory of 3652	4764	Secure_Viewer.exe_.exe	notepad.exe
PID 4764 wrote to memory of 3652	4764	Secure_Viewer.exe_.exe	notepad.exe
PID 4764 wrote to memory of 3652	4764	Secure_Viewer.exe_.exe	notepad.exe
PID 4764 wrote to memory of 3652	4764	Secure_Viewer.exe_.exe	notepad.exe
PID 4764 wrote to memory of 3652	4764	Secure_Viewer.exe_.exe	notepad.exe
PID 4764 wrote to memory of 3652	4764	Secure_Viewer.exe_.exe	notepad.exe
PID 4764 wrote to memory of 3652	4764	Secure_Viewer.exe_.exe	notepad.exe
PID 4764 wrote to memory of 3652	4764	Secure_Viewer.exe_.exe	notepad.exe
PID 4764 wrote to memory of 3652	4764	Secure_Viewer.exe_.exe	notepad.exe
PID 4764 wrote to memory of 3652	4764	Secure_Viewer.exe_.exe	notepad.exe

C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe
"C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4764

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3652

C:\Users\Admin\AppData\Local\Temp\cmd.exe
"C:\Users\Admin\AppData\Local\Temp\cmd.exe"
3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3324

C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe
"C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"
4⤵
- Executes dropped EXE
PID:836

C:\Users\Admin\AppData\Local\Temp\{0E0AC68D-208E-475C-A5B4-70D93319FB56}\921031860.exe
C:\Users\Admin\AppData\Local\Temp\{0E0AC68D-208E-475C-A5B4-70D93319FB56}\921031860.exe /sjson C:\Users\Admin\AppData\Local\Temp\{0E0AC68D-208E-475C-A5B4-70D93319FB56}\book.json
4⤵
- Executes dropped EXE
PID:1084

C:\Users\Admin\AppData\Local\Temp\{0E0AC68D-208E-475C-A5B4-70D93319FB56}\350986977.exe
"350986977.exe"
4⤵
- Executes dropped EXE
PID:1400

C:\ProgramData\Oracle\Java\javapath\java.exe
java.exe -jar C:\Users\Admin\AppData\Local\Temp\{0E0AC68D-208E-475C-A5B4-70D93319FB56}\HTVwHo.jar
4⤵
PID:1580

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Connection Proxy

T1090

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Connection Proxy

T1090

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe
MD5
b4cd27f2b37665f51eb9fe685ec1d373

SHA1
7f08febf0fdb7fc9f8bf35a10fb11e7de431abe0

SHA256
91f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581

SHA512
e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe
MD5
b4cd27f2b37665f51eb9fe685ec1d373

SHA1
7f08febf0fdb7fc9f8bf35a10fb11e7de431abe0

SHA256
91f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581

SHA512
e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\cmd.exe
MD5
50b930137463b14f73186c7c6767a2aa

SHA1
574f512a44097275658f9c304ef0b74029e9ea46

SHA256
eb51a0c96f7de6ce8bb0386429fff83bf95cb23fa61efe499b416f1cb0fc71c9

SHA512
7f09ca777189d95d7ca0665a29c800a5228a93437b1067d7276e05d6da07bc6adc9644f545dc35ea0267dd8e7e312b414c9a613001e4f1d600bb481d4cbff872

Download Submit
C:\Users\Admin\AppData\Local\Temp\x64btit.txt
MD5
9b005ad3011ef6da6bc6c2117f5c1bb5

SHA1
9a5782b5a4f7773888d5cd949df32a16854df217

SHA256
af8071297ee2f51875d5b5de2f3cc63c0832bc82894e6c7f3f350fa43b4b94af

SHA512
db80a2705a1e46de0e9cc9cf51cbbb9a5698ad867448544a29d333e1bfe2dcaac27d9c439450f0fb825a583567b52a6abd623561829ade8018fb43f3bead13b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\{0E0AC68D-208E-475C-A5B4-70D93319FB56}\350986977.exe
MD5
9f385a9a69a4d9e18055743f0694976b

SHA1
2c2385ea964a33f803e96e364d4a05771c733921

SHA256
45f175bc165a3f8d9a05da48bdc4c1f234386588e0d003df094f72d019ae6216

SHA512
e9e78eb02bad22815648723138a7443da527779644ad9f9e776f91ba796b255c7556c5fe82ea526825c23ea376ed90d4dd5f31b026d2ff00605d8db9b0729c3c

Download Submit
C:\Users\Admin\AppData\Local\Temp\{0E0AC68D-208E-475C-A5B4-70D93319FB56}\350986977.exe
MD5
9f385a9a69a4d9e18055743f0694976b

SHA1
2c2385ea964a33f803e96e364d4a05771c733921

SHA256
45f175bc165a3f8d9a05da48bdc4c1f234386588e0d003df094f72d019ae6216

SHA512
e9e78eb02bad22815648723138a7443da527779644ad9f9e776f91ba796b255c7556c5fe82ea526825c23ea376ed90d4dd5f31b026d2ff00605d8db9b0729c3c

Download Submit
C:\Users\Admin\AppData\Local\Temp\{0E0AC68D-208E-475C-A5B4-70D93319FB56}\921031860.exe
MD5
b94350c5a57401721ce013c1a76c2727

SHA1
f0e946cf41e3c11d7f84736a365ec3d0b173fef4

SHA256
e6f88219fde1d526253de53f06fdb95ad08704c4dedbcdcf062d09db69754a58

SHA512
0b3622a799f46bf3023a7ff0afde855261f2cc1a42b19c625f17333b480bd90eddb20f61a436724065c9b5372c4beee66366bfd6f3dd5aacfb5bbaa73a022193

Download Submit
C:\Users\Admin\AppData\Local\Temp\{0E0AC68D-208E-475C-A5B4-70D93319FB56}\921031860.exe
MD5
b94350c5a57401721ce013c1a76c2727

SHA1
f0e946cf41e3c11d7f84736a365ec3d0b173fef4

SHA256
e6f88219fde1d526253de53f06fdb95ad08704c4dedbcdcf062d09db69754a58

SHA512
0b3622a799f46bf3023a7ff0afde855261f2cc1a42b19c625f17333b480bd90eddb20f61a436724065c9b5372c4beee66366bfd6f3dd5aacfb5bbaa73a022193

Download Submit
C:\Users\Admin\AppData\Local\Temp\{0E0AC68D-208E-475C-A5B4-70D93319FB56}\HTVwHo.jar
MD5
0f396a296d86da86087aa504eed4172b

SHA1
404ab46569e2838357ab3247a16f89d27c25eb9a

SHA256
ab172b437844a469c70adec06b6ea087dc8091bc37f7e02b1b42863c27f5911c

SHA512
8cf92909873213e4e35c019ca53752f2e202064d0d30ab3e706618f42ee77ef9c6373042522dccd73e603a3e350936d4e517c81a04c030876aed5a5f9977fa08

Download Submit
memory/836-10-0x0000000000000000-mapping.dmp

Download
memory/1084-15-0x0000000000000000-mapping.dmp

Download
memory/1400-18-0x0000000000000000-mapping.dmp

Download
memory/1580-24-0x0000000002B70000-0x0000000002B80000-memory.dmp

Filesize
64KB

Download
memory/1580-27-0x0000000002BA0000-0x0000000002BB0000-memory.dmp

Filesize
64KB

Download
memory/1580-39-0x0000000002C60000-0x0000000002C70000-memory.dmp

Filesize
64KB

Download
memory/1580-38-0x0000000002C50000-0x0000000002C60000-memory.dmp

Filesize
64KB

Download
memory/1580-37-0x0000000002C40000-0x0000000002C50000-memory.dmp

Filesize
64KB

Download
memory/1580-35-0x0000000002C20000-0x0000000002C30000-memory.dmp

Filesize
64KB

Download
memory/1580-36-0x0000000002C30000-0x0000000002C40000-memory.dmp

Filesize
64KB

Download
memory/1580-21-0x0000000000000000-mapping.dmp

Download
memory/1580-34-0x0000000002C10000-0x0000000002C20000-memory.dmp

Filesize
64KB

Download
memory/1580-23-0x0000000002900000-0x0000000002B70000-memory.dmp

Filesize
2.4MB

Download
memory/1580-33-0x0000000002C00000-0x0000000002C10000-memory.dmp

Filesize
64KB

Download
memory/1580-25-0x0000000002B80000-0x0000000002B90000-memory.dmp

Filesize
64KB

Download
memory/1580-26-0x0000000002B90000-0x0000000002BA0000-memory.dmp

Filesize
64KB

Download
memory/1580-32-0x0000000002BF0000-0x0000000002C00000-memory.dmp

Filesize
64KB

Download
memory/1580-28-0x0000000002BB0000-0x0000000002BC0000-memory.dmp

Filesize
64KB

Download
memory/1580-29-0x0000000002BC0000-0x0000000002BD0000-memory.dmp

Filesize
64KB

Download
memory/1580-30-0x0000000002BD0000-0x0000000002BE0000-memory.dmp

Filesize
64KB

Download
memory/1580-31-0x0000000002BE0000-0x0000000002BF0000-memory.dmp

Filesize
64KB

Download
memory/3324-7-0x0000000000000000-mapping.dmp

Download
memory/3324-9-0x0000000001120000-0x0000000001128000-memory.dmp

Filesize
32KB

Download
memory/3324-13-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/3652-3-0x0000000000000000-mapping.dmp

Download
memory/3652-6-0x0000000002E10000-0x0000000002E18000-memory.dmp

Filesize
32KB

Download
memory/3652-5-0x00000000027D0000-0x00000000027D2000-memory.dmp

Filesize
8KB

Download
memory/4764-4-0x0000000002310000-0x000000000231B000-memory.dmp

Filesize
44KB

Download
memory/4764-2-0x0000000000720000-0x0000000000721000-memory.dmp

Filesize
4KB

Download