Overview

overview

10

Static

static

0a22badfd2...ae.exe

windows7_x64

10

0a22badfd2...ae.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    152s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    04-07-2022 09:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe

  • Size

    1.4MB

  • MD5

    10bdc120c93912b9b937ad16cc7a13c9

  • SHA1

    0a22badfd2f33aebe32d4689f11abbc31211d5ae

  • SHA256

    dfb89b62125470adc70f0e24636633c45d0841aa8e84d09b6bab99f437e2f576

  • SHA512

    6b438edf1e591f485974085959634265096a42ef6148c74fe125f622e1f9667e543952fae8ee812d02990ca2566435a44b161383c3fcb58cfe4bb65f6c58530d

Score
10/10
osirisbankerbotnet

Malware Config

Signatures

  • Osiris
    bankerbotnetosiris
  • Executes dropped EXE 2 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Uses Tor communications 1 TTPs

    Malware can proxy its traffic through Tor for more anonymity.

  • Drops file in Windows directory 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe
    "C:\Users\Admin\AppData\Local\Temp\0a22badfd2f33aebe32d4689f11abbc31211d5ae.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:8
    • C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\system32\notepad.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:1308
      • C:\Users\Admin\AppData\Local\Temp\cmd.exe
        "C:\Users\Admin\AppData\Local\Temp\cmd.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:4900
        • C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe
          "C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"
          4⤵
          • Executes dropped EXE
          PID:64

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Connection Proxy

1
T1090

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe
    Filesize

    3KB

    MD5

    b4cd27f2b37665f51eb9fe685ec1d373

    SHA1

    7f08febf0fdb7fc9f8bf35a10fb11e7de431abe0

    SHA256

    91f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581

    SHA512

    e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe
    Filesize

    3KB

    MD5

    b4cd27f2b37665f51eb9fe685ec1d373

    SHA1

    7f08febf0fdb7fc9f8bf35a10fb11e7de431abe0

    SHA256

    91f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581

    SHA512

    e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\cmd.exe
    Filesize

    231KB

    MD5

    d0fce3afa6aa1d58ce9fa336cc2b675b

    SHA1

    4048488de6ba4bfef9edf103755519f1f762668f

    SHA256

    4d89fc34d5f0f9babd022271c585a9477bf41e834e46b991deaa0530fdb25e22

    SHA512

    80e127ef81752cd50f9ea2d662dc4d3bf8db8d29680e75fa5fc406ca22cafa5c4d89ef2eac65b486413d3cdd57a2c12a1cb75f65d1e312a717d262265736d1c2

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\x64btit.txt
    Filesize

    28B

    MD5

    20abceaa2cf144caa76ca240048f5f14

    SHA1

    947911503d0fa7b850f5a2903fc8c526884fa0e0

    SHA256

    4c9cac4a6fedbc3ed47ad9c0bdb43d37740a2fb319e8aa396c801b0e6fdee9b3

    SHA512

    531b6fd997445ced9cbf92050208410c365b33622dbd5ff531fc34fc2f1c95a01342897d2860fe733b86ff6e22d463b169a6e0a4a3c3154efeec8fa7b375c4d1

    Download Submit
  • memory/8-131-0x0000000000B90000-0x0000000000B9A000-memory.dmp
    Filesize

    40KB

    Download
  • memory/64-146-0x0000000000000000-mapping.dmp
    Download
  • memory/1308-134-0x0000000005077000-0x0000000005087000-memory.dmp
    Filesize

    64KB

    Download
  • memory/1308-144-0x0000000005077000-0x0000000005087000-memory.dmp
    Filesize

    64KB

    Download
  • memory/1308-135-0x00007FFA688D0000-0x00007FFA68AC5000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/1308-130-0x0000000000000000-mapping.dmp
    Download
  • memory/1308-133-0x0000000000F90000-0x0000000000F98000-memory.dmp
    Filesize

    32KB

    Download
  • memory/1308-132-0x0000000005070000-0x00000000050F4000-memory.dmp
    Filesize

    528KB

    Download
  • memory/4900-136-0x0000000000000000-mapping.dmp
    Download
  • memory/4900-138-0x00007FFA688D0000-0x00007FFA68AC5000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/4900-139-0x0000000000DD0000-0x0000000000DD8000-memory.dmp
    Filesize

    32KB

    Download
  • memory/4900-145-0x0000000000400000-0x000000000049F000-memory.dmp
    Filesize

    636KB

    Download
  • memory/4900-150-0x0000000000400000-0x000000000049F000-memory.dmp
    Filesize

    636KB

    Download