Malware Analysis Report

2025-01-22 13:30

Sample ID 210922-qmvprafdbk
Target 3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887
SHA256 3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887
Tags
osiris banker botnet persistence
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887

Threat Level: Known bad

The file 3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887 was found to be: Known bad.

Malicious Activity Summary

osiris banker botnet persistence

Osiris

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Looks up external IP address via web service

Uses Tor communications

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2021-09-22 13:23

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2021-09-22 13:23

Reported

2021-09-22 13:27

Platform

win7-en-20210920

Max time kernel

150s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe"

Signatures

Osiris

banker botnet osiris

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe" C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.ipify.org N/A N/A
N/A api.ipify.org N/A N/A

Uses Tor communications

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe

"C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe"

C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe

"C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"

Network

Country Destination Domain Proto
CA 199.58.81.140:80 199.58.81.140 tcp
US 8.8.8.8:53 api.ipify.org udp
US 50.16.239.65:443 api.ipify.org tcp
US 206.217.136.47:80 206.217.136.47 tcp
EE 62.65.40.250:443 tcp
US 8.8.8.8:53 time-a.nist.gov udp
US 129.6.15.28:13 time-a.nist.gov tcp
DE 144.76.143.137:80 144.76.143.137 tcp
DE 54.36.237.163:80 54.36.237.163 tcp
DE 212.83.61.218:80 212.83.61.218 tcp
GB 193.38.255.253:80 193.38.255.253 tcp
RU 77.37.140.23:443 77.37.140.23 tcp
DE 82.116.120.3:80 82.116.120.3 tcp
US 199.195.249.19:80 199.195.249.19 tcp
FR 195.154.37.123:80 195.154.37.123 tcp
CA 51.161.43.235:80 51.161.43.235 tcp
US 174.128.250.165:80 tcp
NL 95.211.136.23:80 95.211.136.23 tcp
DE 51.38.127.41:80 51.38.127.41 tcp
JP 212.102.50.33:80 212.102.50.33 tcp
RU 103.136.43.141:80 tcp
DE 93.104.209.61:80 93.104.209.61 tcp
US 199.249.230.164:80 199.249.230.164 tcp
FR 51.15.197.24:80 51.15.197.24 tcp
GB 91.244.181.85:443 tcp
DE 46.4.233.104:80 46.4.233.104 tcp
US 23.154.177.100:80 23.154.177.100 tcp
IS 82.221.131.5:80 82.221.131.5 tcp
US 104.206.237.23:443 tcp
US 23.154.177.5:80 23.154.177.5 tcp
LU 104.244.73.46:80 104.244.73.46 tcp
US 172.98.193.62:80 172.98.193.62 tcp
PL 217.182.76.127:443 tcp
NO 185.14.97.44:80 185.14.97.44 tcp
US 198.24.168.226:443 tcp

Files

memory/1544-53-0x00000000751D1000-0x00000000751D3000-memory.dmp

memory/1544-55-0x0000000000400000-0x0000000000490000-memory.dmp

memory/1544-54-0x0000000000220000-0x0000000000278000-memory.dmp

memory/1544-56-0x0000000000490000-0x0000000000539000-memory.dmp

\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe

MD5 b4cd27f2b37665f51eb9fe685ec1d373
SHA1 7f08febf0fdb7fc9f8bf35a10fb11e7de431abe0
SHA256 91f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581
SHA512 e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e

memory/984-58-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe

MD5 b4cd27f2b37665f51eb9fe685ec1d373
SHA1 7f08febf0fdb7fc9f8bf35a10fb11e7de431abe0
SHA256 91f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581
SHA512 e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e

C:\Users\Admin\AppData\Local\Temp\x64btit.txt

MD5 bba52b12c0d9934cfa9e36b902881c0d
SHA1 69fc6a7a66657c03d4127f10b446421e98c239f4
SHA256 0359b642d0e70e8e47eb73aa937c19df2fa01b11b02a3d602a63c153b0525d33
SHA512 ffd17d0c8c2ba382930169b97031a2555fbabf301b4ac8cdfaceb2e57e82e94defe6218e716544733bebd56d1b68efc147d3584612438c1650f79356c7c27bf9

Analysis: behavioral2

Detonation Overview

Submitted

2021-09-22 13:23

Reported

2021-09-22 13:26

Platform

win10-en-20210920

Max time kernel

150s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe"

Signatures

Osiris

banker botnet osiris

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe" C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.ipify.org N/A N/A
N/A api.ipify.org N/A N/A

Uses Tor communications

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe

"C:\Users\Admin\AppData\Local\Temp\3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887.exe"

C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe

"C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"

Network

Country Destination Domain Proto
DE 131.188.40.189:80 131.188.40.189 tcp
US 8.8.8.8:53 api.ipify.org udp
US 50.16.244.183:443 api.ipify.org tcp
VN 125.212.220.60:80 125.212.220.60 tcp
MD 185.177.151.33:443 tcp
US 8.8.8.8:53 time-a.nist.gov udp
US 129.6.15.28:13 time-a.nist.gov tcp
US 206.217.136.47:80 206.217.136.47 tcp
US 185.220.103.119:80 185.220.103.119 tcp
NL 185.227.82.63:80 185.227.82.63 tcp
LU 107.189.12.47:80 107.189.12.47 tcp
TH 45.64.186.122:80 45.64.186.122 tcp
HU 185.225.69.59:80 185.225.69.59 tcp
JP 172.104.88.43:80 172.104.88.43 tcp
AT 109.70.100.78:80 109.70.100.78 tcp
CR 179.48.251.188:80 179.48.251.188 tcp
LT 176.223.141.106:443 tcp
US 199.249.230.111:80 199.249.230.111 tcp
SE 213.164.204.177:80 213.164.204.177 tcp
ZA 160.119.249.24:443 tcp
BG 82.118.242.103:80 82.118.242.103 tcp
CH 176.10.99.207:80 176.10.99.207 tcp
SE 213.164.204.116:80 213.164.204.116 tcp
PL 54.37.232.61:443 tcp
SK 185.48.248.111:80 185.48.248.111 tcp
NL 31.210.20.110:80 31.210.20.110 tcp
IN 139.59.58.109:80 139.59.58.109 tcp
US 192.210.238.119:443 tcp
DE 85.10.202.207:80 85.10.202.207 tcp
FI 135.181.106.130:80 135.181.106.130 tcp
LV 94.140.114.128:80 94.140.114.128 tcp
US 23.129.64.157:443 tcp
DE 51.195.107.236:80 51.195.107.236 tcp
US 23.154.177.67:80 23.154.177.67 tcp
US 209.141.41.225:80 209.141.41.225 tcp
RU 81.28.13.40:443 tcp
KG 91.213.233.60:80 91.213.233.60 tcp
RO 195.254.134.194:80 195.254.134.194 tcp
BG 45.141.157.50:80 45.141.157.50 tcp
US 23.129.64.202:443 tcp
NL 23.154.177.130:80 23.154.177.130 tcp
SE 153.92.126.234:80 153.92.126.234 tcp

Files

memory/3732-116-0x0000000000400000-0x0000000000490000-memory.dmp

memory/3732-115-0x00000000020F0000-0x0000000002148000-memory.dmp

memory/3732-117-0x00000000021B0000-0x0000000002259000-memory.dmp

memory/1912-118-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe

MD5 b4cd27f2b37665f51eb9fe685ec1d373
SHA1 7f08febf0fdb7fc9f8bf35a10fb11e7de431abe0
SHA256 91f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581
SHA512 e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e

C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe

MD5 b4cd27f2b37665f51eb9fe685ec1d373
SHA1 7f08febf0fdb7fc9f8bf35a10fb11e7de431abe0
SHA256 91f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581
SHA512 e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e

C:\Users\Admin\AppData\Local\Temp\x64btit.txt

MD5 824723235df6af48fa4831f12e4b7297
SHA1 23601c01afc91f6550badc4f5a5e584e1d310b8c
SHA256 adef15249b0b4e9216018d99dae45371ea0f295d3e2498172af01e21f16742c5
SHA512 fc926ca86b2dedc8a05524fea85d0ba8f03180fbfbcba040270c38972d7e803bcf65409b7500ced754fda91f550b26eee863a588718dd74a66d7d38c2377c4e1