Malware Analysis Report

2025-01-22 13:32

Sample ID 210311-aaatl3tt96
Target Secure_Viewer.exe_
SHA256 4807f8fce08612cc316476fe34aa497188810fc10102c6c07bf18142655eb252
Tags
osiris banker botnet spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

4807f8fce08612cc316476fe34aa497188810fc10102c6c07bf18142655eb252

Threat Level: Known bad

The file Secure_Viewer.exe_ was found to be: Known bad.

Malicious Activity Summary

osiris banker botnet spyware stealer

Osiris

Nirsoft

Executes dropped EXE

Reads user/profile data of web browsers

Loads dropped DLL

Looks up external IP address via web service

Uses Tor communications

Drops file in Windows directory

Suspicious use of SetWindowsHookEx

Modifies Internet Explorer settings

Suspicious behavior: MapViewOfSection

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2021-03-11 18:26

Signatures

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2021-03-11 18:26

Reported

2021-03-11 18:29

Platform

win10v20201028

Max time kernel

150s

Max time network

112s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe"

Signatures

Osiris

banker botnet osiris

Nirsoft

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

Looks up external IP address via web service

Description Indicator Process Target
N/A api.ipify.org N/A N/A
N/A api.ipify.org N/A N/A

Uses Tor communications

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\Secure_Viewer.exe_.job C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\IntelliForms\Storage2 C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe N/A
N/A N/A C:\Windows\SysWOW64\notepad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\notepad.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4764 wrote to memory of 3652 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 4764 wrote to memory of 3652 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 4764 wrote to memory of 3652 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 4764 wrote to memory of 3652 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 4764 wrote to memory of 3652 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 4764 wrote to memory of 3652 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 4764 wrote to memory of 3652 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 4764 wrote to memory of 3652 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 4764 wrote to memory of 3652 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 4764 wrote to memory of 3652 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 4764 wrote to memory of 3652 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 4764 wrote to memory of 3652 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 4764 wrote to memory of 3652 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 4764 wrote to memory of 3652 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 4764 wrote to memory of 3652 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 4764 wrote to memory of 3652 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 4764 wrote to memory of 3652 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 4764 wrote to memory of 3652 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 4764 wrote to memory of 3652 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 4764 wrote to memory of 3652 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 4764 wrote to memory of 3652 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 4764 wrote to memory of 3652 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 4764 wrote to memory of 3652 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 4764 wrote to memory of 3652 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 4764 wrote to memory of 3652 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 4764 wrote to memory of 3652 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 4764 wrote to memory of 3652 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 4764 wrote to memory of 3652 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 4764 wrote to memory of 3652 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 4764 wrote to memory of 3652 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 4764 wrote to memory of 3652 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 4764 wrote to memory of 3652 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 4764 wrote to memory of 3652 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 4764 wrote to memory of 3652 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 4764 wrote to memory of 3652 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 4764 wrote to memory of 3652 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 4764 wrote to memory of 3652 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 4764 wrote to memory of 3652 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 4764 wrote to memory of 3652 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 4764 wrote to memory of 3652 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 4764 wrote to memory of 3652 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 4764 wrote to memory of 3652 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 4764 wrote to memory of 3652 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 4764 wrote to memory of 3652 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 4764 wrote to memory of 3652 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 4764 wrote to memory of 3652 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 4764 wrote to memory of 3652 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 4764 wrote to memory of 3652 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 4764 wrote to memory of 3652 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 4764 wrote to memory of 3652 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 4764 wrote to memory of 3652 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 4764 wrote to memory of 3652 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 4764 wrote to memory of 3652 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 4764 wrote to memory of 3652 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 4764 wrote to memory of 3652 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 4764 wrote to memory of 3652 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 4764 wrote to memory of 3652 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 4764 wrote to memory of 3652 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 4764 wrote to memory of 3652 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 4764 wrote to memory of 3652 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 4764 wrote to memory of 3652 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 4764 wrote to memory of 3652 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 4764 wrote to memory of 3652 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 4764 wrote to memory of 3652 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe

"C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe"

C:\Windows\SysWOW64\notepad.exe

"C:\Windows\system32\notepad.exe"

C:\Users\Admin\AppData\Local\Temp\cmd.exe

"C:\Users\Admin\AppData\Local\Temp\cmd.exe"

C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe

"C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"

C:\Users\Admin\AppData\Local\Temp\{0E0AC68D-208E-475C-A5B4-70D93319FB56}\921031860.exe

C:\Users\Admin\AppData\Local\Temp\{0E0AC68D-208E-475C-A5B4-70D93319FB56}\921031860.exe /sjson C:\Users\Admin\AppData\Local\Temp\{0E0AC68D-208E-475C-A5B4-70D93319FB56}\book.json

C:\Users\Admin\AppData\Local\Temp\{0E0AC68D-208E-475C-A5B4-70D93319FB56}\350986977.exe

"350986977.exe"

C:\ProgramData\Oracle\Java\javapath\java.exe

java.exe -jar C:\Users\Admin\AppData\Local\Temp\{0E0AC68D-208E-475C-A5B4-70D93319FB56}\HTVwHo.jar

Network

Country Destination Domain Proto
N/A 8.8.8.8:53 i.imgur.com udp
N/A 151.101.36.193:443 i.imgur.com tcp
N/A 199.58.81.140:80 199.58.81.140 tcp
N/A 8.8.8.8:53 api.ipify.org udp
N/A 50.19.242.215:443 api.ipify.org tcp
N/A 155.98.5.5:80 155.98.5.5 tcp
N/A 23.237.34.138:443 tcp
N/A 8.8.8.8:53 time-a.nist.gov udp
N/A 129.6.15.28:13 time-a.nist.gov tcp
N/A 172.105.242.117:80 172.105.242.117 tcp
N/A 51.161.43.236:80 51.161.43.236 tcp
N/A 147.135.115.212:80 147.135.115.212 tcp
N/A 93.174.93.133:80 93.174.93.133 tcp
N/A 109.166.39.80:80 109.166.39.80 tcp
N/A 45.137.155.114:80 tcp
N/A 135.148.33.134:80 135.148.33.134 tcp
N/A 91.132.60.9:80 91.132.60.9 tcp
N/A 207.244.70.35:80 207.244.70.35 tcp
N/A 139.28.38.223:443 tcp
N/A 185.125.206.186:80 185.125.206.186 tcp
N/A 127.0.0.1:32767 tcp
N/A 185.77.129.35:80 185.77.129.35 tcp
N/A 91.192.103.9:80 91.192.103.9 tcp
N/A 188.34.201.69:443 tcp
N/A 195.37.209.9:80 195.37.209.9 tcp
N/A 37.120.146.42:80 37.120.146.42 tcp
N/A 185.118.164.41:80 185.118.164.41 tcp
N/A 23.129.64.221:443 tcp
N/A 204.8.156.142:80 204.8.156.142 tcp
N/A 185.63.253.130:80 185.63.253.130 tcp
N/A 8.8.8.8:53 imagenesfacturacion.xyz udp
N/A 172.67.193.184:443 imagenesfacturacion.xyz tcp
N/A 172.67.193.184:443 imagenesfacturacion.xyz tcp
N/A 172.67.193.184:443 imagenesfacturacion.xyz tcp
N/A 172.67.193.184:443 imagenesfacturacion.xyz tcp
N/A 172.67.193.184:443 imagenesfacturacion.xyz tcp
N/A 172.67.193.184:443 imagenesfacturacion.xyz tcp

Files

memory/4764-2-0x0000000000720000-0x0000000000721000-memory.dmp

memory/3652-3-0x0000000000000000-mapping.dmp

memory/4764-4-0x0000000002310000-0x000000000231B000-memory.dmp

memory/3652-5-0x00000000027D0000-0x00000000027D2000-memory.dmp

memory/3652-6-0x0000000002E10000-0x0000000002E18000-memory.dmp

memory/3324-7-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\cmd.exe

MD5 50b930137463b14f73186c7c6767a2aa
SHA1 574f512a44097275658f9c304ef0b74029e9ea46
SHA256 eb51a0c96f7de6ce8bb0386429fff83bf95cb23fa61efe499b416f1cb0fc71c9
SHA512 7f09ca777189d95d7ca0665a29c800a5228a93437b1067d7276e05d6da07bc6adc9644f545dc35ea0267dd8e7e312b414c9a613001e4f1d600bb481d4cbff872

memory/3324-9-0x0000000001120000-0x0000000001128000-memory.dmp

memory/836-10-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe

MD5 b4cd27f2b37665f51eb9fe685ec1d373
SHA1 7f08febf0fdb7fc9f8bf35a10fb11e7de431abe0
SHA256 91f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581
SHA512 e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e

C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe

MD5 b4cd27f2b37665f51eb9fe685ec1d373
SHA1 7f08febf0fdb7fc9f8bf35a10fb11e7de431abe0
SHA256 91f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581
SHA512 e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e

memory/3324-13-0x0000000000400000-0x000000000049F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\x64btit.txt

MD5 9b005ad3011ef6da6bc6c2117f5c1bb5
SHA1 9a5782b5a4f7773888d5cd949df32a16854df217
SHA256 af8071297ee2f51875d5b5de2f3cc63c0832bc82894e6c7f3f350fa43b4b94af
SHA512 db80a2705a1e46de0e9cc9cf51cbbb9a5698ad867448544a29d333e1bfe2dcaac27d9c439450f0fb825a583567b52a6abd623561829ade8018fb43f3bead13b2

memory/1084-15-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\{0E0AC68D-208E-475C-A5B4-70D93319FB56}\921031860.exe

MD5 b94350c5a57401721ce013c1a76c2727
SHA1 f0e946cf41e3c11d7f84736a365ec3d0b173fef4
SHA256 e6f88219fde1d526253de53f06fdb95ad08704c4dedbcdcf062d09db69754a58
SHA512 0b3622a799f46bf3023a7ff0afde855261f2cc1a42b19c625f17333b480bd90eddb20f61a436724065c9b5372c4beee66366bfd6f3dd5aacfb5bbaa73a022193

C:\Users\Admin\AppData\Local\Temp\{0E0AC68D-208E-475C-A5B4-70D93319FB56}\921031860.exe

MD5 b94350c5a57401721ce013c1a76c2727
SHA1 f0e946cf41e3c11d7f84736a365ec3d0b173fef4
SHA256 e6f88219fde1d526253de53f06fdb95ad08704c4dedbcdcf062d09db69754a58
SHA512 0b3622a799f46bf3023a7ff0afde855261f2cc1a42b19c625f17333b480bd90eddb20f61a436724065c9b5372c4beee66366bfd6f3dd5aacfb5bbaa73a022193

memory/1400-18-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\{0E0AC68D-208E-475C-A5B4-70D93319FB56}\350986977.exe

MD5 9f385a9a69a4d9e18055743f0694976b
SHA1 2c2385ea964a33f803e96e364d4a05771c733921
SHA256 45f175bc165a3f8d9a05da48bdc4c1f234386588e0d003df094f72d019ae6216
SHA512 e9e78eb02bad22815648723138a7443da527779644ad9f9e776f91ba796b255c7556c5fe82ea526825c23ea376ed90d4dd5f31b026d2ff00605d8db9b0729c3c

C:\Users\Admin\AppData\Local\Temp\{0E0AC68D-208E-475C-A5B4-70D93319FB56}\350986977.exe

MD5 9f385a9a69a4d9e18055743f0694976b
SHA1 2c2385ea964a33f803e96e364d4a05771c733921
SHA256 45f175bc165a3f8d9a05da48bdc4c1f234386588e0d003df094f72d019ae6216
SHA512 e9e78eb02bad22815648723138a7443da527779644ad9f9e776f91ba796b255c7556c5fe82ea526825c23ea376ed90d4dd5f31b026d2ff00605d8db9b0729c3c

memory/1580-21-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\{0E0AC68D-208E-475C-A5B4-70D93319FB56}\HTVwHo.jar

MD5 0f396a296d86da86087aa504eed4172b
SHA1 404ab46569e2838357ab3247a16f89d27c25eb9a
SHA256 ab172b437844a469c70adec06b6ea087dc8091bc37f7e02b1b42863c27f5911c
SHA512 8cf92909873213e4e35c019ca53752f2e202064d0d30ab3e706618f42ee77ef9c6373042522dccd73e603a3e350936d4e517c81a04c030876aed5a5f9977fa08

memory/1580-23-0x0000000002900000-0x0000000002B70000-memory.dmp

memory/1580-24-0x0000000002B70000-0x0000000002B80000-memory.dmp

memory/1580-25-0x0000000002B80000-0x0000000002B90000-memory.dmp

memory/1580-26-0x0000000002B90000-0x0000000002BA0000-memory.dmp

memory/1580-27-0x0000000002BA0000-0x0000000002BB0000-memory.dmp

memory/1580-28-0x0000000002BB0000-0x0000000002BC0000-memory.dmp

memory/1580-29-0x0000000002BC0000-0x0000000002BD0000-memory.dmp

memory/1580-30-0x0000000002BD0000-0x0000000002BE0000-memory.dmp

memory/1580-31-0x0000000002BE0000-0x0000000002BF0000-memory.dmp

memory/1580-32-0x0000000002BF0000-0x0000000002C00000-memory.dmp

memory/1580-33-0x0000000002C00000-0x0000000002C10000-memory.dmp

memory/1580-34-0x0000000002C10000-0x0000000002C20000-memory.dmp

memory/1580-36-0x0000000002C30000-0x0000000002C40000-memory.dmp

memory/1580-35-0x0000000002C20000-0x0000000002C30000-memory.dmp

memory/1580-37-0x0000000002C40000-0x0000000002C50000-memory.dmp

memory/1580-38-0x0000000002C50000-0x0000000002C60000-memory.dmp

memory/1580-39-0x0000000002C60000-0x0000000002C70000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2021-03-11 18:26

Reported

2021-03-11 18:29

Platform

win7v20201028

Max time kernel

151s

Max time network

130s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe"

Signatures

Osiris

banker botnet osiris

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\notepad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.ipify.org N/A N/A
N/A api.ipify.org N/A N/A

Uses Tor communications

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\Secure_Viewer.exe_.job C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe N/A
N/A N/A C:\Windows\SysWOW64\notepad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\notepad.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\cmd.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1044 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 1044 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 1044 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 1044 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 1044 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 1044 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 1044 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 1044 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 1044 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 1044 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 1044 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 1044 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 1044 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 1044 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 1044 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 1044 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 1044 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 1044 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 1044 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 1044 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 1044 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 1044 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 1044 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 1044 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 1044 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 1044 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 1044 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 1044 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 1044 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 1044 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 1044 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 1044 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 1044 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 1044 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 1044 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe C:\Windows\SysWOW64\notepad.exe
PID 2016 wrote to memory of 1936 N/A C:\Windows\SysWOW64\notepad.exe C:\Users\Admin\AppData\Local\Temp\cmd.exe
PID 2016 wrote to memory of 1936 N/A C:\Windows\SysWOW64\notepad.exe C:\Users\Admin\AppData\Local\Temp\cmd.exe
PID 2016 wrote to memory of 1936 N/A C:\Windows\SysWOW64\notepad.exe C:\Users\Admin\AppData\Local\Temp\cmd.exe
PID 2016 wrote to memory of 1936 N/A C:\Windows\SysWOW64\notepad.exe C:\Users\Admin\AppData\Local\Temp\cmd.exe
PID 2016 wrote to memory of 1936 N/A C:\Windows\SysWOW64\notepad.exe C:\Users\Admin\AppData\Local\Temp\cmd.exe
PID 2016 wrote to memory of 1936 N/A C:\Windows\SysWOW64\notepad.exe C:\Users\Admin\AppData\Local\Temp\cmd.exe
PID 2016 wrote to memory of 1936 N/A C:\Windows\SysWOW64\notepad.exe C:\Users\Admin\AppData\Local\Temp\cmd.exe
PID 2016 wrote to memory of 1936 N/A C:\Windows\SysWOW64\notepad.exe C:\Users\Admin\AppData\Local\Temp\cmd.exe
PID 2016 wrote to memory of 1936 N/A C:\Windows\SysWOW64\notepad.exe C:\Users\Admin\AppData\Local\Temp\cmd.exe
PID 2016 wrote to memory of 1936 N/A C:\Windows\SysWOW64\notepad.exe C:\Users\Admin\AppData\Local\Temp\cmd.exe
PID 2016 wrote to memory of 1936 N/A C:\Windows\SysWOW64\notepad.exe C:\Users\Admin\AppData\Local\Temp\cmd.exe
PID 2016 wrote to memory of 1936 N/A C:\Windows\SysWOW64\notepad.exe C:\Users\Admin\AppData\Local\Temp\cmd.exe
PID 2016 wrote to memory of 1936 N/A C:\Windows\SysWOW64\notepad.exe C:\Users\Admin\AppData\Local\Temp\cmd.exe
PID 2016 wrote to memory of 1936 N/A C:\Windows\SysWOW64\notepad.exe C:\Users\Admin\AppData\Local\Temp\cmd.exe
PID 2016 wrote to memory of 1936 N/A C:\Windows\SysWOW64\notepad.exe C:\Users\Admin\AppData\Local\Temp\cmd.exe
PID 2016 wrote to memory of 1936 N/A C:\Windows\SysWOW64\notepad.exe C:\Users\Admin\AppData\Local\Temp\cmd.exe
PID 2016 wrote to memory of 1936 N/A C:\Windows\SysWOW64\notepad.exe C:\Users\Admin\AppData\Local\Temp\cmd.exe
PID 2016 wrote to memory of 1936 N/A C:\Windows\SysWOW64\notepad.exe C:\Users\Admin\AppData\Local\Temp\cmd.exe
PID 2016 wrote to memory of 1936 N/A C:\Windows\SysWOW64\notepad.exe C:\Users\Admin\AppData\Local\Temp\cmd.exe
PID 2016 wrote to memory of 1936 N/A C:\Windows\SysWOW64\notepad.exe C:\Users\Admin\AppData\Local\Temp\cmd.exe
PID 2016 wrote to memory of 1936 N/A C:\Windows\SysWOW64\notepad.exe C:\Users\Admin\AppData\Local\Temp\cmd.exe
PID 2016 wrote to memory of 1936 N/A C:\Windows\SysWOW64\notepad.exe C:\Users\Admin\AppData\Local\Temp\cmd.exe
PID 2016 wrote to memory of 1936 N/A C:\Windows\SysWOW64\notepad.exe C:\Users\Admin\AppData\Local\Temp\cmd.exe
PID 2016 wrote to memory of 1936 N/A C:\Windows\SysWOW64\notepad.exe C:\Users\Admin\AppData\Local\Temp\cmd.exe
PID 2016 wrote to memory of 1936 N/A C:\Windows\SysWOW64\notepad.exe C:\Users\Admin\AppData\Local\Temp\cmd.exe
PID 2016 wrote to memory of 1936 N/A C:\Windows\SysWOW64\notepad.exe C:\Users\Admin\AppData\Local\Temp\cmd.exe
PID 2016 wrote to memory of 1936 N/A C:\Windows\SysWOW64\notepad.exe C:\Users\Admin\AppData\Local\Temp\cmd.exe
PID 2016 wrote to memory of 1936 N/A C:\Windows\SysWOW64\notepad.exe C:\Users\Admin\AppData\Local\Temp\cmd.exe
PID 2016 wrote to memory of 1936 N/A C:\Windows\SysWOW64\notepad.exe C:\Users\Admin\AppData\Local\Temp\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe

"C:\Users\Admin\AppData\Local\Temp\Secure_Viewer.exe_.exe"

C:\Windows\SysWOW64\notepad.exe

"C:\Windows\system32\notepad.exe"

C:\Users\Admin\AppData\Local\Temp\cmd.exe

"C:\Users\Admin\AppData\Local\Temp\cmd.exe"

C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe

"C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"

Network

Country Destination Domain Proto
N/A 8.8.8.8:53 i.imgur.com udp
N/A 151.101.36.193:443 i.imgur.com tcp
N/A 199.58.81.140:80 199.58.81.140 tcp
N/A 8.8.8.8:53 api.ipify.org udp
N/A 54.235.189.250:443 api.ipify.org tcp
N/A 135.148.33.59:80 135.148.33.59 tcp
N/A 71.19.252.25:443 tcp
N/A 8.8.8.8:53 time-a.nist.gov udp
N/A 129.6.15.28:13 time-a.nist.gov tcp
N/A 213.164.204.160:80 213.164.204.160 tcp
N/A 23.129.64.210:443 tcp
N/A 116.203.245.170:80 116.203.245.170 tcp
N/A 194.88.143.66:80 194.88.143.66 tcp
N/A 51.81.87.40:80 51.81.87.40 tcp
N/A 185.220.102.252:80 185.220.102.252 tcp
N/A 199.249.230.68:80 199.249.230.68 tcp
N/A 192.42.116.20:443 tcp
N/A 185.217.0.96:80 185.217.0.96 tcp
N/A 195.154.156.5:80 195.154.156.5 tcp
N/A 66.206.0.138:80 66.206.0.138 tcp
N/A 127.0.0.1:32767 tcp
N/A 192.42.113.102:80 192.42.113.102 tcp
N/A 51.158.147.142:443 tcp
N/A 93.115.95.38:80 93.115.95.38 tcp
N/A 45.66.156.196:443 tcp

Files

memory/1044-2-0x0000000000220000-0x0000000000221000-memory.dmp

memory/2016-3-0x0000000000000000-mapping.dmp

memory/2016-4-0x00000000760A1000-0x00000000760A3000-memory.dmp

memory/1044-5-0x0000000000270000-0x000000000027B000-memory.dmp

memory/2016-6-0x00000000000D0000-0x00000000000D2000-memory.dmp

memory/2016-7-0x00000000001A0000-0x00000000001A8000-memory.dmp

\Users\Admin\AppData\Local\Temp\cmd.exe

MD5 ad7b9c14083b52bc532fba5948342b98
SHA1 ee8cbf12d87c4d388f09b4f69bed2e91682920b5
SHA256 17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae
SHA512 e12aad20c824187b39edb3c7943709290b5ddbf1b4032988db46f2e86da3cf7e7783f78c82e4dc5da232f666b8f9799a260a1f8e2694eb4d0cdaf78da710fde1

memory/1936-9-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\cmd.exe

MD5 ad7b9c14083b52bc532fba5948342b98
SHA1 ee8cbf12d87c4d388f09b4f69bed2e91682920b5
SHA256 17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae
SHA512 e12aad20c824187b39edb3c7943709290b5ddbf1b4032988db46f2e86da3cf7e7783f78c82e4dc5da232f666b8f9799a260a1f8e2694eb4d0cdaf78da710fde1

memory/1936-12-0x00000000001D0000-0x00000000001D8000-memory.dmp

memory/1936-13-0x0000000000400000-0x000000000049F000-memory.dmp

\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe

MD5 b4cd27f2b37665f51eb9fe685ec1d373
SHA1 7f08febf0fdb7fc9f8bf35a10fb11e7de431abe0
SHA256 91f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581
SHA512 e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e

memory/1248-15-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe

MD5 b4cd27f2b37665f51eb9fe685ec1d373
SHA1 7f08febf0fdb7fc9f8bf35a10fb11e7de431abe0
SHA256 91f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581
SHA512 e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e

C:\Users\Admin\AppData\Local\Temp\x64btit.txt

MD5 8e02df4b54e4444e9812ead4fabe7a28
SHA1 a7715b3098c2fa02adaced93a613963c39bb1d5d
SHA256 d52167b633008ec6311264c9e0c0bc93c91640e503d37b695db4177e4e1bcd2b
SHA512 2b4c0d7f3e3457ec90a3e1a87e3e6747f9b26692875b587485f012d411d5865b10d4a4265d5285e46bf38bc1a236b7a0fc73fe1273982e864022c8b4840b2fe6