Malware Analysis Report

2025-01-22 13:34

Sample ID 210913-g5gq6sdac8
Target 577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764
SHA256 577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764
Tags
osiris banker botnet persistence
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764

Threat Level: Known bad

The file 577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764 was found to be: Known bad.

Malicious Activity Summary

osiris banker botnet persistence

Osiris

Executes dropped EXE

Loads dropped DLL

Looks up external IP address via web service

Adds Run key to start application

Uses Tor communications

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2021-09-13 06:23

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2021-09-13 06:23

Reported

2021-09-13 06:25

Platform

win7v20210408

Max time kernel

158s

Max time network

136s

Command Line

"C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe"

Signatures

Osiris

banker botnet osiris

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe" C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.ipify.org N/A N/A
N/A api.ipify.org N/A N/A

Uses Tor communications

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe

"C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe"

C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe

"C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"

Network

Country Destination Domain Proto
SE 171.25.193.9:443 171.25.193.9 tcp
US 8.8.8.8:53 api.ipify.org udp
US 50.17.226.156:443 api.ipify.org tcp
LT 193.106.31.2:80 193.106.31.2 tcp
SE 153.92.126.234:443 tcp
US 8.8.8.8:53 time-a.nist.gov udp
US 129.6.15.28:13 time-a.nist.gov tcp
US 8.8.8.8:53 time-a-g.nist.gov udp
US 129.6.15.28:13 time-a-g.nist.gov tcp
US 8.8.8.8:53 time.nist.gov udp
US 128.138.140.44:13 time.nist.gov tcp
FI 185.204.1.239:80 185.204.1.239 tcp
NL 185.142.236.199:80 185.142.236.199 tcp
AT 109.70.100.78:80 109.70.100.78 tcp
US 209.250.2.254:80 209.250.2.254 tcp
HU 91.219.238.221:80 91.219.238.221 tcp
BE 193.105.73.80:443 193.105.73.80 tcp
FR 51.254.136.195:80 51.254.136.195 tcp
CA 158.69.187.63:80 158.69.187.63 tcp
US 185.220.103.117:80 185.220.103.117 tcp
DK 152.115.46.132:443 tcp
GB 217.155.40.118:80 217.155.40.118 tcp
AT 192.36.38.33:80 192.36.38.33 tcp
HU 91.219.237.117:80 91.219.237.117 tcp
GR 185.4.135.157:443 tcp
NL 51.15.54.117:80 51.15.54.117 tcp
RO 37.221.66.250:443 tcp
DE 136.243.176.148:80 136.243.176.148 tcp
US 104.149.156.187:80 tcp
MD 176.123.7.102:80 176.123.7.102 tcp
US 199.249.230.104:80 199.249.230.104 tcp
SG 209.58.180.90:80 209.58.180.90 tcp
LU 104.244.75.53:443 tcp
GB 51.89.143.153:80 51.89.143.153 tcp
DE 37.157.254.37:443 tcp

Files

memory/1080-60-0x0000000075801000-0x0000000075803000-memory.dmp

memory/1080-62-0x0000000000400000-0x0000000000490000-memory.dmp

memory/1080-61-0x0000000000350000-0x00000000003A8000-memory.dmp

memory/1080-63-0x00000000004F0000-0x0000000000599000-memory.dmp

\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe

MD5 b4cd27f2b37665f51eb9fe685ec1d373
SHA1 7f08febf0fdb7fc9f8bf35a10fb11e7de431abe0
SHA256 91f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581
SHA512 e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e

memory/1940-65-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe

MD5 b4cd27f2b37665f51eb9fe685ec1d373
SHA1 7f08febf0fdb7fc9f8bf35a10fb11e7de431abe0
SHA256 91f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581
SHA512 e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e

C:\Users\Admin\AppData\Local\Temp\x64btit.txt

MD5 e5366a5ead8bf0ec08f9e3f4438eaff2
SHA1 ce3c49a04fea3c359481e28e6a0b19b3da8c7a43
SHA256 479c23364dc24b0896cad7371b3fb35e6d167a38a0f1d567659210364f8ca2b9
SHA512 bd6aa869e7f2dd2a8f8bd73bece7d03c810a65af6addef1bc97a8b7f5d8972575b3e870499f52cbc30d1c7d05170ffbd2227d09f17d440d21bfaf694c27ee24a

Analysis: behavioral2

Detonation Overview

Submitted

2021-09-13 06:23

Reported

2021-09-13 06:26

Platform

win10-en

Max time kernel

153s

Max time network

157s

Command Line

"C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe"

Signatures

Osiris

banker botnet osiris

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe" C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.ipify.org N/A N/A
N/A api.ipify.org N/A N/A

Uses Tor communications

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe

"C:\Users\Admin\AppData\Local\Temp\577357bf7d715950aa9401b25029926f052c742ffd558ddc44853629245eb764.exe"

C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe

"C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"

Network

Country Destination Domain Proto
US 154.35.175.225:80 154.35.175.225 tcp
US 8.8.8.8:53 api.ipify.org udp
US 50.19.119.155:443 api.ipify.org tcp
GB 51.38.69.210:80 51.38.69.210 tcp
LU 104.244.79.187:443 tcp
US 8.8.8.8:53 time-a.nist.gov udp
US 129.6.15.28:13 time-a.nist.gov tcp
MD 178.17.174.196:80 178.17.174.196 tcp
BG 31.13.195.248:80 31.13.195.248 tcp
FR 51.255.106.85:80 51.255.106.85 tcp
ZA 160.119.249.223:80 160.119.249.223 tcp
LU 107.189.7.156:80 107.189.7.156 tcp
US 23.160.193.176:80 23.160.193.176 tcp
IL 194.62.42.161:80 194.62.42.161 tcp
PL 192.166.245.238:80 192.166.245.238 tcp
US 40.122.165.48:80 40.122.165.48 tcp
DE 116.203.117.220:443 tcp
DE 91.143.87.51:443 91.143.87.51 tcp
DE 88.198.91.74:80 88.198.91.74 tcp
DE 185.220.102.254:80 185.220.102.254 tcp
NL 212.129.49.135:443 tcp
NL 51.15.118.10:80 51.15.118.10 tcp
US 199.249.230.151:80 199.249.230.151 tcp
CA 198.50.238.128:80 198.50.238.128 tcp
SG 68.183.230.130:443 tcp
EE 5.253.176.99:80 5.253.176.99 tcp
CA 192.160.102.170:80 192.160.102.170 tcp
ZA 102.130.112.81:80 102.130.112.81 tcp
FR 158.255.215.193:443 tcp
DE 167.86.94.107:80 167.86.94.107 tcp
US 199.249.230.156:80 199.249.230.156 tcp
GB 217.155.40.118:80 217.155.40.118 tcp
US 51.81.93.162:443 tcp
US 85.202.80.35:80 85.202.80.35 tcp
DE 193.31.24.154:80 193.31.24.154 tcp

Files

memory/780-115-0x00000000004F0000-0x000000000063A000-memory.dmp

memory/780-116-0x0000000000400000-0x0000000000490000-memory.dmp

memory/780-117-0x0000000002270000-0x0000000002319000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe

MD5 b4cd27f2b37665f51eb9fe685ec1d373
SHA1 7f08febf0fdb7fc9f8bf35a10fb11e7de431abe0
SHA256 91f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581
SHA512 e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e

C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe

MD5 b4cd27f2b37665f51eb9fe685ec1d373
SHA1 7f08febf0fdb7fc9f8bf35a10fb11e7de431abe0
SHA256 91f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581
SHA512 e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e

memory/812-118-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\x64btit.txt

MD5 b77479560562312abcfa521e87fdaaa5
SHA1 f6515c1b8dfc82a01fdf150cf17c223b32d579a8
SHA256 9ba4497b0955e58e08afe6295dd0d1cec6ebd0e1fe6e60acc6a99a975143d837
SHA512 6649e7ef66bddcc7b294efe5aa255d8d09a0c9dd9e69492ea84a91c427af9cabbbbe1f4db1fb517d6fa30293b870af7baa3778dacc2f9348cfe517f4ddda61b8