osiris | ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f | Triage

Analysis

max time kernel
188s
max time network
168s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30-11-2022 15:04

Sharing

Report Analysis Logs

General

Target

ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
Size

1.7MB
MD5

be05248b4cb0985b2c65804f548db8d3
SHA1

bdd6009bcf09fb52d8ec2664a48dfb3d5e90d988
SHA256

ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f
SHA512

d6334fcf4db525e018040ec839163f9b330885746ae52935e4269b43602a3ec1f37ad274014c6d1f09d2c05140677150135526ae677a2b25f879a903f8c994bd
SSDEEP

24576:FxBZxrdKk7Siu3mcZVTVkoHYxiJDo5eantrwHsD8Xw2ugSG9EkCu1vDewil4Ml5l:HhdKJBZVT+f35RdI3vEkZpDe7OMB

Score

10^/10

osiris banker botnet

Malware Config

Signatures

Osiris
banker botnet osiris
Executes dropped EXE 1 IoCs

Processes:

GetX64BTIT.exe

pid process

1480 GetX64BTIT.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe

Loads dropped DLL 1 IoCs

Processes:

ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe

pid process

2036 ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

3 api.ipify.org
4 api.ipify.org
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.

Connection Proxy
T1090

Suspicious use of SetThreadContext 1 IoCs

Processes:

ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe

description	pid	process	target process
PID 304 set thread context of 2036	304	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1236 304 WerFault.exe ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe

Modifies registry class 4 IoCs

Processes:

ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F81F339A-9723-F9F3-8105-47DFFBB7B538}\InprocServer32	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F81F339A-9723-F9F3-8105-47DFFBB7B538}\InprocServer32\ = "C:\\Windows\\SysWOW64\\qdvd.dll"	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F81F339A-9723-F9F3-8105-47DFFBB7B538}\InprocServer32\ThreadingModel = "Both"	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F81F339A-9723-F9F3-8105-47DFFBB7B538}	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe

NTFS ADS 2 IoCs

Processes:

ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe

description	ioc	process
File created	C:\ProgramData\TEMP:AC6CA6CF	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
File opened for modification	C:\ProgramData\TEMP:AC6CA6CF	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe

pid	process
2036	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
2036	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
2036	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
2036	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
2036	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
2036	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
2036	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
2036	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
2036	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
2036	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
2036	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
2036	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
2036	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
2036	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
2036	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
2036	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
2036	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
2036	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
2036	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
2036	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
2036	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
2036	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
2036	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
2036	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
2036	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
2036	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
2036	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
2036	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
2036	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
2036	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
2036	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
2036	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
2036	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
2036	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
2036	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
2036	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
2036	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
2036	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
2036	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
2036	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
2036	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
2036	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
2036	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
2036	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
2036	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
2036	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
2036	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
2036	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
2036	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
2036	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
2036	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
2036	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
2036	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
2036	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
2036	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
2036	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
2036	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
2036	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
2036	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
2036	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
2036	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
2036	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
2036	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
2036	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe

description	pid	process
Token: 33	304	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
Token: SeIncBasePriorityPrivilege	304	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe

pid process

2036 ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exeac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe

description	pid	process	target process
PID 304 wrote to memory of 2036	304	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
PID 304 wrote to memory of 2036	304	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
PID 304 wrote to memory of 2036	304	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
PID 304 wrote to memory of 2036	304	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
PID 304 wrote to memory of 2036	304	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
PID 304 wrote to memory of 2036	304	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
PID 304 wrote to memory of 2036	304	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
PID 304 wrote to memory of 2036	304	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
PID 304 wrote to memory of 2036	304	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
PID 304 wrote to memory of 2036	304	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
PID 304 wrote to memory of 1236	304	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe	WerFault.exe
PID 304 wrote to memory of 1236	304	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe	WerFault.exe
PID 304 wrote to memory of 1236	304	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe	WerFault.exe
PID 304 wrote to memory of 1236	304	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe	WerFault.exe
PID 2036 wrote to memory of 1480	2036	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe	GetX64BTIT.exe
PID 2036 wrote to memory of 1480	2036	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe	GetX64BTIT.exe
PID 2036 wrote to memory of 1480	2036	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe	GetX64BTIT.exe
PID 2036 wrote to memory of 1480	2036	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe	GetX64BTIT.exe

C:\Users\Admin\AppData\Local\Temp\ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
"C:\Users\Admin\AppData\Local\Temp\ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe"
1⤵
- Checks BIOS information in registry
- Suspicious use of SetThreadContext
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:304

C:\Users\Admin\AppData\Local\Temp\ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
"C:\Users\Admin\AppData\Local\Temp\ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe"
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2036

C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe
"C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"
3⤵
- Executes dropped EXE
PID:1480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 304 -s 620
2⤵
- Program crash
PID:1236

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Connection Proxy

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe
Filesize
3KB

MD5
b4cd27f2b37665f51eb9fe685ec1d373

SHA1
7f08febf0fdb7fc9f8bf35a10fb11e7de431abe0

SHA256
91f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581

SHA512
e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\x64btit.txt
Filesize
28B

MD5
bb66b47d3483896b99a705755708f05a

SHA1
3878205cf7ac9ca84ff7c4f3719483d5c7f2af64

SHA256
e2a6116ddea85c8345817c80b0d08a69d97d3d3067401091e49d5c17ce05f543

SHA512
721ebc1ecf9d4d42747bfa5280a915f429eb505a891a23d0f84123fb53c985439ba936a30cd5f0d3960ef3822528cd357d287cb39f1961fca11baef08a575e2e

Download Submit
\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe
Filesize
3KB

MD5
b4cd27f2b37665f51eb9fe685ec1d373

SHA1
7f08febf0fdb7fc9f8bf35a10fb11e7de431abe0

SHA256
91f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581

SHA512
e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e

Download Submit
memory/304-62-0x0000000000400000-0x0000000000655000-memory.dmp

Filesize
2.3MB

Download
memory/304-63-0x0000000000400000-0x0000000000655000-memory.dmp

Filesize
2.3MB

Download
memory/304-64-0x0000000000400000-0x0000000000655000-memory.dmp

Filesize
2.3MB

Download
memory/304-65-0x0000000000400000-0x0000000000655000-memory.dmp

Filesize
2.3MB

Download
memory/304-66-0x0000000000400000-0x0000000000655000-memory.dmp

Filesize
2.3MB

Download
memory/304-54-0x0000000074C91000-0x0000000074C93000-memory.dmp

Filesize
8KB

Download
memory/304-61-0x0000000000400000-0x0000000000655000-memory.dmp

Filesize
2.3MB

Download
memory/304-55-0x00000000021A0000-0x00000000022D5000-memory.dmp

Filesize
1.2MB

Download
memory/304-78-0x00000000033E0000-0x0000000003635000-memory.dmp

Filesize
2.3MB

Download
memory/1236-81-0x0000000000000000-mapping.dmp

Download
memory/1480-86-0x0000000000000000-mapping.dmp

Download
memory/2036-73-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2036-83-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2036-77-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2036-74-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2036-79-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2036-72-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2036-82-0x0000000000310000-0x00000000003AF000-memory.dmp

Filesize
636KB

Download
memory/2036-75-0x0000000000401698-mapping.dmp

Download
memory/2036-84-0x0000000000310000-0x00000000003AF000-memory.dmp

Filesize
636KB

Download
memory/2036-71-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2036-69-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2036-68-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2036-67-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2036-90-0x0000000000270000-0x000000000028F000-memory.dmp

Filesize
124KB

Download
memory/2036-89-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download