Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
-
submitted
24-07-2022 17:28
General
-
Target
b925c85f01a5623f5c117ef862984252376c761f3ab5a3413c217823c1a67421.exe
-
Size
724KB
-
MD5
d3a09aed1ef8d187dbdb7a425058ffc3
-
SHA1
2904d28d295160f8ac6ae4234e9c9cfd3af5f680
-
SHA256
b925c85f01a5623f5c117ef862984252376c761f3ab5a3413c217823c1a67421
-
SHA512
6bbeca556699d36672b46b476d1d5ca8ae9ed95627afea53054c99e2cee6140409a23603ecb96a1d6f59d257f24d2303b2c2fca1600b56ef15dfb11bbb00883b
Malware Config
Signatures
-
Osiris
-
Executes dropped EXE 1 IoCs
-
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b925c85f01a5623f5c117ef862984252376c761f3ab5a3413c217823c1a67421.exe"C:\Users\Admin\AppData\Local\Temp\b925c85f01a5623f5c117ef862984252376c761f3ab5a3413c217823c1a67421.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exeFilesize
3KB
MD5b4cd27f2b37665f51eb9fe685ec1d373
SHA17f08febf0fdb7fc9f8bf35a10fb11e7de431abe0
SHA25691f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581
SHA512e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e
-
C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exeFilesize
3KB
MD5b4cd27f2b37665f51eb9fe685ec1d373
SHA17f08febf0fdb7fc9f8bf35a10fb11e7de431abe0
SHA25691f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581
SHA512e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e
-
C:\Users\Admin\AppData\Local\Temp\x64btit.txtFilesize
28B
MD558af65783e90a2fe06ce005f859116a8
SHA108bb5f828a79abb6752e45cac661e5faf8813ade
SHA25631095316304f4b9773cd1e727c02510d6a9754b310e4c2170e66bcccd87562d5
SHA512277ffe48167a9b70dc80edaf6bb787dc9ee5758d11dbc9f9474ffbee02a8456cf0226335d2d4bf9165ca31c5f228195a1a5591870e12de9f0cc7b939e5a709f7
-
memory/4580-134-0x0000000000000000-mapping.dmp
-
memory/4928-132-0x00000000097F0000-0x0000000009844000-memory.dmpFilesize
336KB
-
memory/4928-131-0x0000000007970000-0x0000000007A70000-memory.dmpFilesize
1024KB
-
memory/4928-133-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/4928-137-0x0000000009890000-0x000000000992F000-memory.dmpFilesize
636KB
-
memory/4928-139-0x0000000007970000-0x0000000007A70000-memory.dmpFilesize
1024KB
-
memory/4928-140-0x0000000009890000-0x000000000992F000-memory.dmpFilesize
636KB