Malware Analysis Report

2025-01-22 13:35

Sample ID 210922-qkjvgacgd2
Target 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb
SHA256 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb
Tags
osiris banker botnet
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb

Threat Level: Known bad

The file 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb was found to be: Known bad.

Malicious Activity Summary

osiris banker botnet

Osiris

Executes dropped EXE

Loads dropped DLL

Looks up external IP address via web service

Uses Tor communications

Enumerates physical storage devices

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2021-09-22 13:19

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2021-09-22 13:19

Reported

2021-09-22 13:22

Platform

win7-en-20210920

Max time kernel

152s

Max time network

135s

Command Line

"C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe"

Signatures

Osiris

banker botnet osiris

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.ipify.org N/A N/A
N/A api.ipify.org N/A N/A

Uses Tor communications

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe

"C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe"

C:\windows\hh.exe

"C:\windows\hh.exe"

C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe

"C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"

Network

Country Destination Domain Proto
SE 171.25.193.9:443 171.25.193.9 tcp
US 8.8.8.8:53 api.ipify.org udp
US 54.243.51.135:443 api.ipify.org tcp
NL 51.158.146.152:80 51.158.146.152 tcp
SE 81.225.229.60:443 tcp
US 8.8.8.8:53 time-a.nist.gov udp
US 129.6.15.28:13 time-a.nist.gov tcp
HU 217.112.131.98:80 217.112.131.98 tcp
SE 153.92.126.234:80 153.92.126.234 tcp
NL 212.32.250.205:443 tcp
MD 185.163.45.212:80 185.163.45.212 tcp
DE 116.203.117.220:443 tcp
SE 185.239.222.249:80 185.239.222.249 tcp
US 208.68.7.129:80 208.68.7.129 tcp
US 23.129.64.137:80 23.129.64.137 tcp
CH 45.90.59.60:80 45.90.59.60 tcp
BE 45.128.133.206:80 45.128.133.206 tcp
DE 45.14.233.159:80 45.14.233.159 tcp
US 199.249.230.143:80 199.249.230.143 tcp
US 136.55.39.48:80 136.55.39.48 tcp
RO 93.115.86.8:80 93.115.86.8 tcp
KR 114.108.58.201:443 tcp
HU 217.112.131.98:80 217.112.131.98 tcp
US 199.249.230.77:80 199.249.230.77 tcp
DE 88.198.207.48:80 88.198.207.48 tcp
LV 94.100.6.72:80 94.100.6.72 tcp
RO 185.100.87.41:443 tcp
NL 51.15.118.10:80 51.15.118.10 tcp
DE 78.47.117.140:443 tcp

Files

memory/1364-54-0x0000000075651000-0x0000000075653000-memory.dmp

memory/1364-55-0x00000000001B0000-0x00000000001B1000-memory.dmp

memory/948-56-0x0000000000000000-mapping.dmp

memory/1364-57-0x0000000002000000-0x00000000020E2000-memory.dmp

memory/1364-59-0x00000000020F0000-0x000000000218F000-memory.dmp

memory/1364-58-0x0000000000400000-0x0000000000545000-memory.dmp

\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe

MD5 b4cd27f2b37665f51eb9fe685ec1d373
SHA1 7f08febf0fdb7fc9f8bf35a10fb11e7de431abe0
SHA256 91f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581
SHA512 e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e

memory/1800-61-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe

MD5 b4cd27f2b37665f51eb9fe685ec1d373
SHA1 7f08febf0fdb7fc9f8bf35a10fb11e7de431abe0
SHA256 91f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581
SHA512 e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e

C:\Users\Admin\AppData\Local\Temp\x64btit.txt

MD5 6336cc7a895e6bbbaf9518a698def76c
SHA1 4d362c334fac2f0c353d8689e55dd87aa37436ce
SHA256 80287144ec7070f19bacf26d6e6d8b0e8fc330cf0acd753edf1854be0f90764e
SHA512 af94f07fe246ccc7128c3d5be31593a63d9e59e9ca165c3b38b948808f24e83dba99e6d1455145f78ff984cd12b88baf1af6c2ee78eda9e8e773d69e868f81d1

Analysis: behavioral2

Detonation Overview

Submitted

2021-09-22 13:19

Reported

2021-09-22 13:22

Platform

win10-en-20210920

Max time kernel

159s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe"

Signatures

Osiris

banker botnet osiris

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.ipify.org N/A N/A
N/A api.ipify.org N/A N/A

Uses Tor communications

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe

"C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe"

C:\windows\hh.exe

"C:\windows\hh.exe"

C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe

"C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"

Network

Country Destination Domain Proto
DE 131.188.40.189:80 131.188.40.189 tcp
US 8.8.8.8:53 api.ipify.org udp
US 50.17.226.156:443 api.ipify.org tcp
SG 103.102.46.57:80 103.102.46.57 tcp
US 209.51.188.48:443 tcp
US 8.8.8.8:53 time-a.nist.gov udp
US 129.6.15.28:13 time-a.nist.gov tcp
US 23.129.64.149:80 23.129.64.149 tcp
FR 195.154.41.53:80 195.154.41.53 tcp
DE 185.220.101.62:80 185.220.101.62 tcp
FR 163.172.24.57:80 163.172.24.57 tcp
CR 138.59.17.40:80 138.59.17.40 tcp
CH 141.255.165.102:80 141.255.165.102 tcp
LU 104.244.77.73:80 104.244.77.73 tcp
DE 5.9.121.207:80 5.9.121.207 tcp
DE 136.243.149.82:80 136.243.149.82 tcp
PL 151.115.38.229:443 tcp
DE 94.16.122.65:443 94.16.122.65 tcp
DE 157.90.235.119:80 157.90.235.119 tcp
NL 62.212.95.196:80 62.212.95.196 tcp
CH 195.176.3.20:443 tcp
LU 104.244.79.187:80 104.244.79.187 tcp
NL 109.201.133.100:80 109.201.133.100 tcp
US 199.249.230.162:80 199.249.230.162 tcp
US 209.141.34.176:443 tcp
IL 194.62.42.161:80 194.62.42.161 tcp
UA 91.203.145.114:80 91.203.145.114 tcp
US 52.109.12.20:443 tcp
BG 94.155.49.47:80 94.155.49.47 tcp
BG 82.118.254.226:443 tcp
GB 140.238.68.92:80 140.238.68.92 tcp
AT 109.70.100.76:80 109.70.100.76 tcp
US 199.249.230.78:80 199.249.230.78 tcp
AU 139.99.172.11:80 139.99.172.11 tcp
DE 46.232.249.188:443 tcp
LU 104.244.73.43:80 104.244.73.43 tcp
NL 81.4.109.63:80 81.4.109.63 tcp
CA 71.19.252.26:443 tcp
RO 37.221.66.253:80 37.221.66.253 tcp
AU 139.99.238.17:80 139.99.238.17 tcp

Files

memory/2284-115-0x00000000007A0000-0x00000000007A1000-memory.dmp

memory/2616-116-0x0000000000000000-mapping.dmp

memory/2284-117-0x0000000002830000-0x0000000002912000-memory.dmp

memory/2284-118-0x0000000000400000-0x0000000000545000-memory.dmp

memory/2284-119-0x0000000002980000-0x0000000002A1F000-memory.dmp

memory/3044-120-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe

MD5 b4cd27f2b37665f51eb9fe685ec1d373
SHA1 7f08febf0fdb7fc9f8bf35a10fb11e7de431abe0
SHA256 91f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581
SHA512 e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e

C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe

MD5 b4cd27f2b37665f51eb9fe685ec1d373
SHA1 7f08febf0fdb7fc9f8bf35a10fb11e7de431abe0
SHA256 91f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581
SHA512 e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e

C:\Users\Admin\AppData\Local\Temp\x64btit.txt

MD5 cf5f182f89056dd1ba2bbf755903a1e7
SHA1 90cf9be08fbf71f96464fef521cfe81c035a6a16
SHA256 50c0c491d6e9a023fc22e184f2b40c0b6bea9eedff34570bec3d20e92d8293a7
SHA512 d65f7a8c6e888261ad28b521740ca9e69e8757cda49595fd7ea7df6704c157a9088e6292de051f9e910b473e8f63319edaf4595ec01eb73df5bd96e8dafd89de