Static task
static1
Behavioral task
behavioral1
Sample
Osiris.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Osiris.dll
Resource
win10v2004-20220812-en
General
-
Target
Osiris.dll
-
Size
6.4MB
-
MD5
5417dec1552fa27fdcdf2af40066d0b5
-
SHA1
e8f37b4d2b5507685f6a94c11d419ec27459dc02
-
SHA256
8c7d61d84554df3ddbfc3041ff69385d437a1c642c0cfdfdd6abed47d5bc54ca
-
SHA512
d67041f17e6db4c33da8f9927927eb4caa1493d5cb96ba972018801543579e67c5095e9d3d5bfd8fc9c0a11b0620cf703cb729e0276bf5c640893035de6db59a
-
SSDEEP
49152:3Y0I7f42fBR30fA4yeJ9+yqBDlarwplPrhvSDHIaPLlnyvuGPM71Cq7UXAZkdimy:3y7f42JR30v9+RltlPr5axyvTS7UHdi
Malware Config
Signatures
Files
-
Osiris.dll.dll windows x86
4049bb57e9bb7c137a0424846c667457
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
shell32
SHGetKnownFolderPath
ShellExecuteW
ole32
CoTaskMemFree
user32
LoadCursorW
ScreenToClient
ClientToScreen
GetCursorPos
SetCursor
SetCursorPos
GetClientRect
ReleaseDC
GetForegroundWindow
ReleaseCapture
SetCapture
GetCapture
GetKeyState
SetProcessDPIAware
EmptyClipboard
GetClipboardData
SetClipboardData
CloseClipboard
OpenClipboard
SetWindowLongW
MessageBoxA
CallWindowProcW
FindWindowW
FlashWindowEx
ShowWindow
GetDC
MonitorFromWindow
IsChild
kernel32
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
SetConsoleCtrlHandler
OutputDebugStringW
WriteFile
HeapQueryInformation
HeapSize
GetCurrentThread
ReadFile
ExitProcess
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
WideCharToMultiByte
VirtualQuery
VirtualProtect
VirtualAlloc
VirtualFree
CloseHandle
HeapCreate
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
Sleep
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
OpenThread
SuspendThread
ResumeThread
GetThreadContext
SetThreadContext
FlushInstructionCache
GetModuleHandleW
GetProcAddress
CreateToolhelp32Snapshot
Thread32First
Thread32Next
CreateThread
FreeLibraryAndExitThread
GetModuleHandleA
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalFree
MultiByteToWideChar
LoadLibraryW
VerSetConditionMask
QueryPerformanceCounter
QueryPerformanceFrequency
LoadLibraryA
VerifyVersionInfoW
K32GetModuleInformation
LocalFree
FormatMessageA
GetLocaleInfoEx
SetCurrentDirectoryW
GetCurrentDirectoryW
CreateDirectoryW
CreateFileW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetDiskFreeSpaceExW
GetFileAttributesW
GetConsoleOutputCP
GetFileInformationByHandle
GetFinalPathNameByHandleW
GetFullPathNameW
SetEndOfFile
SetFileAttributesW
SetFileInformationByHandle
SetFilePointerEx
SetFileTime
GetTempPathW
AreFileApisANSI
GetLastError
DeviceIoControl
CreateDirectoryExW
CopyFileW
MoveFileExW
CreateHardLinkW
GetFileInformationByHandleEx
CreateSymbolicLinkW
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
TryEnterCriticalSection
SetEnvironmentVariableW
EncodePointer
DecodePointer
LCMapStringEx
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitOnceExecuteOnce
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
SleepConditionVariableSRW
CreateEventExW
CreateSemaphoreExW
FlushProcessWriteBuffers
GetCurrentProcessorNumber
GetSystemTimeAsFileTime
GetTickCount64
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolWait
SetThreadpoolWait
CloseThreadpoolWait
GetStringTypeW
CompareStringEx
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
IsDebuggerPresent
RaiseException
GetStartupInfoW
GetProcessHeap
FreeLibrary
InitializeSListHead
GetDriveTypeW
GetConsoleMode
GetFileSizeEx
SetStdHandle
ReadConsoleW
GetTimeZoneInformation
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetFileAttributesExW
DeleteCriticalSection
RtlUnwind
GetModuleFileNameW
LoadLibraryExW
InterlockedPushEntrySList
InterlockedFlushSList
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
HeapValidate
GetSystemInfo
GetModuleHandleExW
GetStdHandle
GetFileType
WriteConsoleW
imm32
ImmReleaseContext
ImmGetContext
ImmSetCompositionWindow
gdi32
GetDeviceCaps
SelectObject
GetFontData
EnumFontFamiliesExW
DeleteObject
DeleteDC
CreateFontW
CreateFontA
CreateCompatibleDC
Sections
.textbss Size: - Virtual size: 2.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 5.5MB - Virtual size: 5.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 706KB - Virtual size: 706KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 51KB - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.msvcjmc Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 1024B - Virtual size: 794B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.00cfg Size: 512B - Virtual size: 270B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 192KB - Virtual size: 192KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ