Malware Analysis Report

2025-01-22 13:35

Sample ID 210922-qmvprafdbl
Target 5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0
SHA256 5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0
Tags
osiris banker botnet
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0

Threat Level: Known bad

The file 5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0 was found to be: Known bad.

Malicious Activity Summary

osiris banker botnet

Osiris

Executes dropped EXE

Loads dropped DLL

Uses Tor communications

Looks up external IP address via web service

Suspicious use of SetThreadContext

Enumerates physical storage devices

NSIS installer

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2021-09-22 13:23

Signatures

NSIS installer

installer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2021-09-22 13:23

Reported

2021-09-22 13:28

Platform

win10v20210408

Max time kernel

152s

Max time network

108s

Command Line

"C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe"

Signatures

Osiris

banker botnet osiris

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.ipify.org N/A N/A
N/A api.ipify.org N/A N/A

Uses Tor communications

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe

"C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe"

C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe

"C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe"

C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe

"C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"

Network

Country Destination Domain Proto
US 66.111.2.131:9030 66.111.2.131 tcp
US 8.8.8.8:53 api.ipify.org udp
US 50.19.104.221:443 api.ipify.org tcp
DE 144.76.143.137:80 144.76.143.137 tcp
DE 138.201.244.249:443 tcp
US 8.8.8.8:53 time-a.nist.gov udp
US 129.6.15.28:13 time-a.nist.gov tcp
NL 45.66.33.45:80 45.66.33.45 tcp
SE 193.189.100.205:80 193.189.100.205 tcp
RO 37.221.66.244:80 37.221.66.244 tcp
GR 185.4.132.183:80 185.4.132.183 tcp
AU 139.99.238.17:80 139.99.238.17 tcp
US 23.129.64.149:80 23.129.64.149 tcp
NL 185.227.82.7:80 185.227.82.7 tcp
US 23.129.64.137:80 23.129.64.137 tcp
CZ 46.28.110.244:80 46.28.110.244 tcp
CA 198.50.238.128:443 tcp
RO 185.100.84.212:80 185.100.84.212 tcp
SE 213.164.204.171:80 213.164.204.171 tcp
NL 51.15.62.130:80 51.15.62.130 tcp
GB 51.89.143.153:443 tcp
US 23.120.182.125:80 23.120.182.125 tcp
AT 109.70.100.16:80 109.70.100.16 tcp
DE 148.251.191.252:80 148.251.191.252 tcp
RU 185.154.52.92:443 tcp
US 38.147.122.253:80 38.147.122.253 tcp
DK 185.38.175.131:80 185.38.175.131 tcp
RO 37.221.67.56:80 37.221.67.56 tcp
CR 138.59.18.106:443 tcp
DE 185.220.102.241:80 185.220.102.241 tcp
RO 195.254.135.76:80 195.254.135.76 tcp
RO 37.221.66.254:443 tcp
HK 45.125.166.58:80 45.125.166.58 tcp
NL 95.211.136.23:80 95.211.136.23 tcp
LU 104.244.77.53:80 104.244.77.53 tcp
IT 151.32.93.194:443 tcp
US 199.249.230.178:80 199.249.230.178 tcp
BG 217.12.203.242:80 217.12.203.242 tcp
DE 195.37.209.9:80 195.37.209.9 tcp
FR 51.254.136.195:443 tcp
FR 178.170.10.3:80 178.170.10.3 tcp
DE 148.251.191.252:80 148.251.191.252 tcp

Files

\Users\Admin\AppData\Local\Temp\nso6CA0.tmp\System.dll

MD5 fccff8cb7a1067e23fd2e2b63971a8e1
SHA1 30e2a9e137c1223a78a0f7b0bf96a1c361976d91
SHA256 6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e
SHA512 f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c

memory/3020-115-0x00000000004016AE-mapping.dmp

memory/3020-117-0x0000000000570000-0x00000000006BA000-memory.dmp

memory/3020-116-0x0000000000400000-0x0000000000456000-memory.dmp

memory/3496-118-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe

MD5 b4cd27f2b37665f51eb9fe685ec1d373
SHA1 7f08febf0fdb7fc9f8bf35a10fb11e7de431abe0
SHA256 91f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581
SHA512 e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e

C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe

MD5 b4cd27f2b37665f51eb9fe685ec1d373
SHA1 7f08febf0fdb7fc9f8bf35a10fb11e7de431abe0
SHA256 91f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581
SHA512 e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e

C:\Users\Admin\AppData\Local\Temp\x64btit.txt

MD5 e5c65908ea0a6cc798c02667d9e118d6
SHA1 81f1f5a58198ea6f1d169d61598ff1f7d3f6e621
SHA256 2ee78663402f763a0400873f21839b50f760d97df2a4c502af33a7af5f0b7fb1
SHA512 49a924da71ab7f0cce6fe661a1b94cf3ecd13763e46cede350fd102664a0279bd682952d31440e68a9c12e51a079299d5945982dfa17521a3df2aaffa9a689eb

Analysis: behavioral1

Detonation Overview

Submitted

2021-09-22 13:23

Reported

2021-09-22 13:28

Platform

win7v20210408

Max time kernel

161s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe"

Signatures

Osiris

banker botnet osiris

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.ipify.org N/A N/A
N/A api.ipify.org N/A N/A

Uses Tor communications

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 880 wrote to memory of 1892 N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe
PID 880 wrote to memory of 1892 N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe
PID 880 wrote to memory of 1892 N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe
PID 880 wrote to memory of 1892 N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe
PID 880 wrote to memory of 1892 N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe
PID 880 wrote to memory of 1892 N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe
PID 880 wrote to memory of 1892 N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe
PID 880 wrote to memory of 1892 N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe
PID 1892 wrote to memory of 1332 N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe
PID 1892 wrote to memory of 1332 N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe
PID 1892 wrote to memory of 1332 N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe
PID 1892 wrote to memory of 1332 N/A C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe

Processes

C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe

"C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe"

C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe

"C:\Users\Admin\AppData\Local\Temp\5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0.exe"

C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe

"C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"

Network

Country Destination Domain Proto
US 93.184.220.29:80 tcp
DE 131.188.40.189:80 131.188.40.189 tcp
US 8.8.8.8:53 api.ipify.org udp
US 23.21.76.7:443 api.ipify.org tcp
DE 88.198.91.74:80 88.198.91.74 tcp
NL 51.15.0.92:443 tcp
US 8.8.8.8:53 time-a.nist.gov udp
US 129.6.15.28:13 time-a.nist.gov tcp
DE 167.86.127.130:80 167.86.127.130 tcp
DE 89.163.224.187:443 tcp
NL 50.7.179.202:80 50.7.179.202 tcp
CR 179.48.251.188:80 179.48.251.188 tcp
US 199.249.230.123:80 199.249.230.123 tcp
CA 66.70.204.175:443 tcp
RO 185.225.17.3:80 185.225.17.3 tcp
US 23.129.64.130:443 tcp
DE 185.220.101.62:80 185.220.101.62 tcp
NO 185.42.170.203:443 tcp
FR 51.15.249.81:80 51.15.249.81 tcp
AT 37.252.191.41:80 37.252.191.41 tcp
SG 195.123.237.148:80 195.123.237.148 tcp
DK 185.38.175.130:80 185.38.175.130 tcp
MD 178.17.171.197:80 178.17.171.197 tcp
DE 136.243.176.148:80 136.243.176.148 tcp
AT 37.252.188.180:80 37.252.188.180 tcp
NL 5.2.76.221:80 5.2.76.221 tcp
KZ 185.120.77.117:80 185.120.77.117 tcp
RO 193.169.145.194:443 tcp
CA 192.160.102.166:80 192.160.102.166 tcp
FR 51.15.243.22:80 51.15.243.22 tcp
US 162.247.74.217:80 162.247.74.217 tcp
DE 93.186.197.181:443 tcp

Files

memory/880-60-0x0000000075801000-0x0000000075803000-memory.dmp

\Users\Admin\AppData\Local\Temp\nsqA267.tmp\System.dll

MD5 fccff8cb7a1067e23fd2e2b63971a8e1
SHA1 30e2a9e137c1223a78a0f7b0bf96a1c361976d91
SHA256 6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e
SHA512 f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c

memory/1892-62-0x00000000004016AE-mapping.dmp

memory/1892-64-0x0000000000400000-0x0000000000456000-memory.dmp

memory/1892-65-0x0000000000460000-0x00000000004FF000-memory.dmp

\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe

MD5 b4cd27f2b37665f51eb9fe685ec1d373
SHA1 7f08febf0fdb7fc9f8bf35a10fb11e7de431abe0
SHA256 91f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581
SHA512 e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e

memory/1332-67-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe

MD5 b4cd27f2b37665f51eb9fe685ec1d373
SHA1 7f08febf0fdb7fc9f8bf35a10fb11e7de431abe0
SHA256 91f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581
SHA512 e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e

C:\Users\Admin\AppData\Local\Temp\x64btit.txt

MD5 2a3a77c860febf14b2ab54b0544db4ed
SHA1 a75df69436c6e67f2632b8aba62f96e4a9d07593
SHA256 caabe8ce1e02603891c9e52c285f5b7f435d58cc3b81938a810ce07fe3ecd82d
SHA512 360ac0033e4b5b917f8589e69f5a29ae6034e78408417cffa904731cd2909e38094bbe50171c532f2cc705611efb1d178589374838f130e10330852d1b9c4dbe