Malware Analysis Report

2025-01-22 13:34

Sample ID 210424-2y6ag96nv6
Target doeihdsjfnajdfuewrywuefhsdkjaf.exe
SHA256 ef8ba7d931f440b4c611a539349cdef819f9d0def97dbfbdb694209d09cef511
Tags
osiris banker botnet
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ef8ba7d931f440b4c611a539349cdef819f9d0def97dbfbdb694209d09cef511

Threat Level: Known bad

The file doeihdsjfnajdfuewrywuefhsdkjaf.exe was found to be: Known bad.

Malicious Activity Summary

osiris banker botnet

Osiris

Executes dropped EXE

Checks BIOS information in registry

Looks up external IP address via web service

Uses Tor communications

Suspicious use of SetThreadContext

Program crash

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Modifies registry class

NTFS ADS

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2021-04-24 05:54

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2021-04-24 05:54

Reported

2021-04-24 06:04

Platform

win10v20210410

Max time kernel

600s

Max time network

593s

Command Line

"C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe"

Signatures

Osiris

banker botnet osiris

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.ipify.org N/A N/A
N/A api.ipify.org N/A N/A

Uses Tor communications

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2256 set thread context of 3616 N/A C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F81F339A-9723-F9F3-8105-47DFFBB7B538}\ = "Microsoft Windows Installer Message RPC" C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F81F339A-9723-F9F3-8105-47DFFBB7B538}\DllVersion C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F81F339A-9723-F9F3-8105-47DFFBB7B538}\DllVersion\ = "5.0.15063" C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F81F339A-9723-F9F3-8105-47DFFBB7B538}\ProgId C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F81F339A-9723-F9F3-8105-47DFFBB7B538}\ProgId\ = "WindowsInstaller.Message" C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F81F339A-9723-F9F3-8105-47DFFBB7B538} C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe N/A

NTFS ADS

Description Indicator Process Target
File created C:\ProgramData\TEMP:AC6CA6CF C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe N/A
File opened for modification C:\ProgramData\TEMP:AC6CA6CF C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\WerFault.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\WerFault.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WerFault.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2256 wrote to memory of 3616 N/A C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe
PID 2256 wrote to memory of 3616 N/A C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe
PID 2256 wrote to memory of 3616 N/A C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe
PID 2256 wrote to memory of 3616 N/A C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe
PID 2256 wrote to memory of 3616 N/A C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe
PID 2256 wrote to memory of 3616 N/A C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe
PID 2256 wrote to memory of 3616 N/A C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe
PID 2256 wrote to memory of 3616 N/A C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe
PID 2256 wrote to memory of 3616 N/A C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe
PID 3616 wrote to memory of 4000 N/A C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe
PID 3616 wrote to memory of 4000 N/A C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe

Processes

C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe

"C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe"

C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe

"C:\Users\Admin\AppData\Local\Temp\doeihdsjfnajdfuewrywuefhsdkjaf.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 1000

C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe

"C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"

Network

Country Destination Domain Proto
N/A 194.109.206.212:80 194.109.206.212 tcp
N/A 8.8.8.8:53 api.ipify.org udp
N/A 50.19.96.218:443 api.ipify.org tcp
N/A 95.85.8.226:80 95.85.8.226 tcp
N/A 146.185.189.197:443 tcp
N/A 8.8.8.8:53 time-a.nist.gov udp
N/A 129.6.15.28:13 time-a.nist.gov tcp
N/A 178.63.97.34:80 178.63.97.34 tcp
N/A 185.181.60.181:80 185.181.60.181 tcp
N/A 62.102.148.68:80 62.102.148.68 tcp
N/A 109.70.100.4:80 109.70.100.4 tcp
N/A 51.178.86.137:80 51.178.86.137 tcp
N/A 172.104.79.222:80 172.104.79.222 tcp
N/A 195.144.21.219:80 195.144.21.219 tcp
N/A 199.249.230.181:80 199.249.230.181 tcp
N/A 178.17.174.232:80 178.17.174.232 tcp
N/A 62.85.69.76:443 tcp
N/A 217.12.221.131:80 217.12.221.131 tcp
N/A 51.15.81.250:80 51.15.81.250 tcp
N/A 179.43.134.188:80 179.43.134.188 tcp
N/A 142.4.213.112:443 tcp
N/A 84.19.186.117:80 84.19.186.117 tcp
N/A 80.180.174.37:80 80.180.174.37 tcp
N/A 54.36.237.163:80 54.36.237.163 tcp
N/A 86.3.170.236:443 tcp
N/A 51.68.205.181:80 51.68.205.181 tcp
N/A 45.140.170.187:80 45.140.170.187 tcp
N/A 51.15.49.143:80 51.15.49.143 tcp
N/A 112.213.37.232:443 tcp
N/A 87.118.110.27:80 87.118.110.27 tcp
N/A 104.244.73.13:80 104.244.73.13 tcp
N/A 179.43.169.20:80 179.43.169.20 tcp
N/A 185.76.191.68:443 tcp
N/A 216.24.242.34:80 216.24.242.34 tcp
N/A 104.244.77.53:80 104.244.77.53 tcp
N/A 195.154.237.147:80 195.154.237.147 tcp
N/A 103.234.220.195:443 tcp
N/A 217.170.204.126:80 217.170.204.126 tcp
N/A 185.12.6.234:80 185.12.6.234 tcp
N/A 81.174.231.18:80 81.174.231.18 tcp
N/A 31.192.107.153:443 tcp
N/A 46.72.49.203:80 46.72.49.203 tcp
N/A 91.213.233.60:80 91.213.233.60 tcp
N/A 46.101.183.160:80 46.101.183.160 tcp
N/A 51.75.23.66:443 tcp
N/A 217.182.196.68:80 217.182.196.68 tcp
N/A 108.39.229.147:80 108.39.229.147 tcp
N/A 51.79.204.46:80 51.79.204.46 tcp
N/A 51.255.150.177:443 tcp
N/A 99.149.215.67:80 99.149.215.67 tcp
N/A 178.20.55.16:80 178.20.55.16 tcp
N/A 185.165.169.222:80 185.165.169.222 tcp
N/A 188.127.69.60:443 tcp
N/A 23.129.64.240:80 23.129.64.240 tcp
N/A 198.16.92.157:80 198.16.92.157 tcp
N/A 93.115.241.194:80 93.115.241.194 tcp
N/A 51.159.59.176:443 tcp
N/A 88.115.22.244:80 88.115.22.244 tcp
N/A 193.218.118.100:80 193.218.118.100 tcp
N/A 178.162.194.210:443 178.162.194.210 tcp
N/A 185.90.61.224:443 tcp
N/A 199.249.230.67:80 199.249.230.67 tcp
N/A 185.48.248.111:80 185.48.248.111 tcp
N/A 193.29.35.205:80 193.29.35.205 tcp
N/A 178.132.78.148:443 tcp
N/A 51.161.43.237:80 51.161.43.237 tcp
N/A 51.75.169.249:80 51.75.169.249 tcp

Files

memory/2256-118-0x0000000000400000-0x0000000000655000-memory.dmp

memory/3616-120-0x0000000000401698-mapping.dmp

memory/3616-119-0x0000000000400000-0x0000000000456000-memory.dmp

memory/3616-121-0x0000000000400000-0x0000000000456000-memory.dmp

memory/4000-122-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe

MD5 b4cd27f2b37665f51eb9fe685ec1d373
SHA1 7f08febf0fdb7fc9f8bf35a10fb11e7de431abe0
SHA256 91f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581
SHA512 e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e

C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe

MD5 b4cd27f2b37665f51eb9fe685ec1d373
SHA1 7f08febf0fdb7fc9f8bf35a10fb11e7de431abe0
SHA256 91f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581
SHA512 e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e

memory/3616-125-0x00000000006B0000-0x000000000074F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\x64btit.txt

MD5 3c73d9862f52d0bfd87b1b5585b9d364
SHA1 1f54165fcc1bee95a4cbac69ffe5d57164cbd705
SHA256 7c2fee000ab933db614e0b9cceb657a5eef44068ea2f6626a087fdb19493e101
SHA512 88089adc50aaecb3ae9e33c27814fb5316da82eca5a810f5258646a42d6be29a0651891e061a789ac737fed4b21521b4d04d2803a6495b1c6bcd98f4dea34355