Analysis
-
max time kernel
189s -
max time network
194s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
-
submitted
31-07-2022 06:33
General
-
Target
6392b4578b3ae0dc27dc616e45347b2396425d90ec92f6ad28ef4af355c19a72.exe
-
Size
623KB
-
MD5
80193d630c9767cfa8f78234b5d2dbd5
-
SHA1
3c9e6af76e6e2cf3009ffe61a5525d1052e73b93
-
SHA256
6392b4578b3ae0dc27dc616e45347b2396425d90ec92f6ad28ef4af355c19a72
-
SHA512
dd296b327e464590a4024a52512a64d24d4af09e0f5fa94ab3526856eb6e4eacc10e92579687543eb1d5bbc7c5c67d3e098574ba4e8c785d26eb4c21c6bd8203
Malware Config
Signatures
-
Osiris
-
Executes dropped EXE 1 IoCs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6392b4578b3ae0dc27dc616e45347b2396425d90ec92f6ad28ef4af355c19a72.exe"C:\Users\Admin\AppData\Local\Temp\6392b4578b3ae0dc27dc616e45347b2396425d90ec92f6ad28ef4af355c19a72.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exeFilesize
3KB
MD5b4cd27f2b37665f51eb9fe685ec1d373
SHA17f08febf0fdb7fc9f8bf35a10fb11e7de431abe0
SHA25691f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581
SHA512e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e
-
C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exeFilesize
3KB
MD5b4cd27f2b37665f51eb9fe685ec1d373
SHA17f08febf0fdb7fc9f8bf35a10fb11e7de431abe0
SHA25691f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581
SHA512e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e
-
C:\Users\Admin\AppData\Local\Temp\x64btit.txtFilesize
28B
MD54912762f6813e43a1992593a7b0f6dce
SHA125b41ffb0f2cf73ac865fb51e0571f489a768887
SHA256b7cabdb02f368b2a79df5960e67b83bfdb809dd5c1e6eb698e531bdbad24a860
SHA512cf20ff32754c5a356c5f08227d8193f062b152e303c94717a050b7b289fd33132878e5873ef7153289210db98c393800b2676ed44f13f9123219d97c9356872f
-
memory/220-130-0x0000000000400000-0x00000000004C0000-memory.dmpFilesize
768KB
-
memory/220-131-0x0000000000835000-0x0000000000889000-memory.dmpFilesize
336KB
-
memory/220-132-0x0000000000590000-0x00000000005E4000-memory.dmpFilesize
336KB
-
memory/220-133-0x0000000000400000-0x00000000004C0000-memory.dmpFilesize
768KB
-
memory/220-134-0x0000000000630000-0x00000000006CF000-memory.dmpFilesize
636KB
-
memory/220-139-0x0000000000835000-0x0000000000889000-memory.dmpFilesize
336KB
-
memory/220-140-0x0000000000400000-0x00000000004C0000-memory.dmpFilesize
768KB
-
memory/220-141-0x0000000000630000-0x00000000006CF000-memory.dmpFilesize
636KB
-
memory/4868-135-0x0000000000000000-mapping.dmp