Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
-
submitted
31-07-2022 06:33
General
-
Target
d35a443020e5393e1985dabbb79adcf320f095994cd67a8910e460540261764d.exe
-
Size
462KB
-
MD5
d86db78703a67e806cc536a97c0fed8d
-
SHA1
29fc516816dc5693ae2e831a06ed4617d3776f2e
-
SHA256
d35a443020e5393e1985dabbb79adcf320f095994cd67a8910e460540261764d
-
SHA512
3fb472580e99c8f466513168af340ff5b2dea931989e0d041723c478d146c8aa60e7ca0769c7351d92c2dab38185dcc7aa7d6f55da32621034cf9e7d175db3b5
Malware Config
Signatures
-
Osiris
-
Executes dropped EXE 1 IoCs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d35a443020e5393e1985dabbb79adcf320f095994cd67a8910e460540261764d.exe"C:\Users\Admin\AppData\Local\Temp\d35a443020e5393e1985dabbb79adcf320f095994cd67a8910e460540261764d.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exeFilesize
3KB
MD5b4cd27f2b37665f51eb9fe685ec1d373
SHA17f08febf0fdb7fc9f8bf35a10fb11e7de431abe0
SHA25691f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581
SHA512e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e
-
C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exeFilesize
3KB
MD5b4cd27f2b37665f51eb9fe685ec1d373
SHA17f08febf0fdb7fc9f8bf35a10fb11e7de431abe0
SHA25691f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581
SHA512e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e
-
C:\Users\Admin\AppData\Local\Temp\x64btit.txtFilesize
28B
MD52f9c5496df2545f18cf682cd19b50dfe
SHA1639f09e58193e3c7d93d51d9113f278ba14baa4b
SHA25649c84ead59daabd3a9420847232cd7b13793665cf6916d57cf88329598139b68
SHA5127fdbe4e094d880480ed3ae87126cc035477b85d74e10de73ce3c25b8434bcd78610b17a47b4ec6415ce62fad9b505836d8200c50e4de8c611591aa20f13a7cf1
-
memory/4364-130-0x0000000000000000-mapping.dmp
-
memory/4400-133-0x0000000006DBD000-0x0000000006E11000-memory.dmpFilesize
336KB
-
memory/4400-134-0x0000000008880000-0x00000000088D4000-memory.dmpFilesize
336KB
-
memory/4400-135-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/4400-136-0x00000000088E0000-0x000000000897F000-memory.dmpFilesize
636KB
-
memory/4400-138-0x00000000088E0000-0x000000000897F000-memory.dmpFilesize
636KB