osiris | ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f | Triage

Analysis

max time kernel
173s
max time network
178s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30-11-2022 15:04

Sharing

Report Analysis Logs

General

Target

ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
Size

1.7MB
MD5

be05248b4cb0985b2c65804f548db8d3
SHA1

bdd6009bcf09fb52d8ec2664a48dfb3d5e90d988
SHA256

ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f
SHA512

d6334fcf4db525e018040ec839163f9b330885746ae52935e4269b43602a3ec1f37ad274014c6d1f09d2c05140677150135526ae677a2b25f879a903f8c994bd
SSDEEP

24576:FxBZxrdKk7Siu3mcZVTVkoHYxiJDo5eantrwHsD8Xw2ugSG9EkCu1vDewil4Ml5l:HhdKJBZVT+f35RdI3vEkZpDe7OMB

Score

10^/10

osiris banker botnet

Malware Config

Signatures

Osiris
banker botnet osiris
Executes dropped EXE 1 IoCs

Processes:

GetX64BTIT.exe

pid process

2216 GetX64BTIT.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

39 api.ipify.org
40 api.ipify.org
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.

Connection Proxy
T1090

Suspicious use of SetThreadContext 1 IoCs

Processes:

ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe

description	pid	process	target process
PID 4384 set thread context of 4132	4384	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4288 4384 WerFault.exe ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe

Modifies registry class 58 IoCs

Processes:

ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F81F339A-9723-F9F3-8105-47DFFBB7B538}\AuxUserType\2\ = "Worksheet"	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F81F339A-9723-F9F3-8105-47DFFBB7B538}\AuxUserType\3	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F81F339A-9723-F9F3-8105-47DFFBB7B538}\Conversion	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F81F339A-9723-F9F3-8105-47DFFBB7B538}\DataFormats\GetSet\1	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F81F339A-9723-F9F3-8105-47DFFBB7B538}\DefaultExtension\ = ".xlsx, Excel Workbook (*.xlsx)"	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F81F339A-9723-F9F3-8105-47DFFBB7B538}\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\Office16\\XLICONS.EXE,1"	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F81F339A-9723-F9F3-8105-47DFFBB7B538}\Conversion\Readable	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F81F339A-9723-F9F3-8105-47DFFBB7B538}\AuxUserType\2	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F81F339A-9723-F9F3-8105-47DFFBB7B538}\DataFormats\GetSet\1\ = "2,1,16,1"	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F81F339A-9723-F9F3-8105-47DFFBB7B538}\LocalServer32	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F81F339A-9723-F9F3-8105-47DFFBB7B538}\DataFormats\GetSet\0	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F81F339A-9723-F9F3-8105-47DFFBB7B538}\MiscStatus\ = "0"	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F81F339A-9723-F9F3-8105-47DFFBB7B538}\Implemented Categories	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F81F339A-9723-F9F3-8105-47DFFBB7B538}\Insertable\	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F81F339A-9723-F9F3-8105-47DFFBB7B538}\TypeLib\ = "{00020813-0000-0000-C000-000000000046}"	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F81F339A-9723-F9F3-8105-47DFFBB7B538}\DataFormats\GetSet\0\ = "3,1,32,1"	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F81F339A-9723-F9F3-8105-47DFFBB7B538}\DataFormats\GetSet\3\ = "NotesDocInfo,1,1,1"	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F81F339A-9723-F9F3-8105-47DFFBB7B538}\DefaultIcon	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F81F339A-9723-F9F3-8105-47DFFBB7B538}\DocObject	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F81F339A-9723-F9F3-8105-47DFFBB7B538}\Implemented Categories\{000C0118-0000-0000-C000-000000000046}\	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F81F339A-9723-F9F3-8105-47DFFBB7B538}\Verb	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F81F339A-9723-F9F3-8105-47DFFBB7B538}\DataFormats	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F81F339A-9723-F9F3-8105-47DFFBB7B538}\DataFormats\GetSet	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F81F339A-9723-F9F3-8105-47DFFBB7B538}\TypeLib	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F81F339A-9723-F9F3-8105-47DFFBB7B538}\Version\ = "1.6"	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F81F339A-9723-F9F3-8105-47DFFBB7B538}\ = "Microsoft Excel Worksheet"	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F81F339A-9723-F9F3-8105-47DFFBB7B538}\Conversion\Readable\Main	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F81F339A-9723-F9F3-8105-47DFFBB7B538}\DataFormats\DefaultFile	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F81F339A-9723-F9F3-8105-47DFFBB7B538}\InprocHandler32\ = "ole32.dll"	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F81F339A-9723-F9F3-8105-47DFFBB7B538}\DataFormats\DefaultFile\ = "ExcelML12"	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F81F339A-9723-F9F3-8105-47DFFBB7B538}\VersionIndependentProgID\ = "Excel.Sheet"	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F81F339A-9723-F9F3-8105-47DFFBB7B538}\AuxUserType\3\ = "Microsoft Excel 12"	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F81F339A-9723-F9F3-8105-47DFFBB7B538}\Verb\0	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F81F339A-9723-F9F3-8105-47DFFBB7B538}\VersionIndependentProgID	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F81F339A-9723-F9F3-8105-47DFFBB7B538}	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F81F339A-9723-F9F3-8105-47DFFBB7B538}\Conversion\ReadWritable	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F81F339A-9723-F9F3-8105-47DFFBB7B538}\Conversion\ReadWritable\Main	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F81F339A-9723-F9F3-8105-47DFFBB7B538}\DataFormats\GetSet\2\ = "1,1,1,1"	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F81F339A-9723-F9F3-8105-47DFFBB7B538}\DataFormats\GetSet\3	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F81F339A-9723-F9F3-8105-47DFFBB7B538}\LocalServer32\ = "\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\""	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F81F339A-9723-F9F3-8105-47DFFBB7B538}\AuxUserType	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F81F339A-9723-F9F3-8105-47DFFBB7B538}\Conversion\Readable\Main\ = "ExcelML12,ExcelWorksheet,Biff12,ExcelODS12,Biff8"	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F81F339A-9723-F9F3-8105-47DFFBB7B538}\DataFormats\GetSet\4	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F81F339A-9723-F9F3-8105-47DFFBB7B538}\Implemented Categories\{000C0118-0000-0000-C000-000000000046}	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F81F339A-9723-F9F3-8105-47DFFBB7B538}\Insertable	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F81F339A-9723-F9F3-8105-47DFFBB7B538}\Verb\1\ = "&Open,0,2"	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F81F339A-9723-F9F3-8105-47DFFBB7B538}\ProgID\ = "Excel.Sheet.12"	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F81F339A-9723-F9F3-8105-47DFFBB7B538}\Verb\1	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F81F339A-9723-F9F3-8105-47DFFBB7B538}\Conversion\ReadWritable\Main\ = "ExcelML12,Biff12,ExcelODS12,Biff8"	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F81F339A-9723-F9F3-8105-47DFFBB7B538}\DefaultExtension	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F81F339A-9723-F9F3-8105-47DFFBB7B538}\DataFormats\GetSet\4\ = "NoteshNote,-1,1,1"	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F81F339A-9723-F9F3-8105-47DFFBB7B538}\DocObject\ = "16"	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F81F339A-9723-F9F3-8105-47DFFBB7B538}\MiscStatus	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F81F339A-9723-F9F3-8105-47DFFBB7B538}\ProgID	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F81F339A-9723-F9F3-8105-47DFFBB7B538}\Verb\0\ = "&Edit,0,2"	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F81F339A-9723-F9F3-8105-47DFFBB7B538}\DataFormats\GetSet\2	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F81F339A-9723-F9F3-8105-47DFFBB7B538}\InprocHandler32	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F81F339A-9723-F9F3-8105-47DFFBB7B538}\Version	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe

NTFS ADS 2 IoCs

Processes:

ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe

description	ioc	process
File created	C:\ProgramData\TEMP:AC6CA6CF	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
File opened for modification	C:\ProgramData\TEMP:AC6CA6CF	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe

pid	process
4132	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
4132	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
4132	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
4132	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
4132	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
4132	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
4132	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
4132	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
4132	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
4132	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
4132	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
4132	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
4132	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
4132	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
4132	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
4132	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
4132	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
4132	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
4132	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
4132	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
4132	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
4132	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
4132	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
4132	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
4132	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
4132	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
4132	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
4132	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
4132	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
4132	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
4132	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
4132	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
4132	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
4132	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
4132	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
4132	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
4132	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
4132	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
4132	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
4132	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
4132	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
4132	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
4132	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
4132	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
4132	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
4132	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
4132	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
4132	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
4132	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
4132	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
4132	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
4132	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
4132	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
4132	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
4132	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
4132	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
4132	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
4132	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
4132	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
4132	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
4132	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
4132	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
4132	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
4132	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe

description	pid	process
Token: 33	4384	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
Token: SeIncBasePriorityPrivilege	4384	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe

pid process

4132 ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exeac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe

description	pid	process	target process
PID 4384 wrote to memory of 4132	4384	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
PID 4384 wrote to memory of 4132	4384	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
PID 4384 wrote to memory of 4132	4384	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
PID 4384 wrote to memory of 4132	4384	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
PID 4384 wrote to memory of 4132	4384	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
PID 4384 wrote to memory of 4132	4384	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
PID 4384 wrote to memory of 4132	4384	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
PID 4384 wrote to memory of 4132	4384	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
PID 4384 wrote to memory of 4132	4384	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
PID 4132 wrote to memory of 2216	4132	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe	GetX64BTIT.exe
PID 4132 wrote to memory of 2216	4132	ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe	GetX64BTIT.exe

C:\Users\Admin\AppData\Local\Temp\ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
"C:\Users\Admin\AppData\Local\Temp\ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe"
1⤵
- Checks BIOS information in registry
- Suspicious use of SetThreadContext
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4384

C:\Users\Admin\AppData\Local\Temp\ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe
"C:\Users\Admin\AppData\Local\Temp\ac9db121f9bffe93135fc8409d427bb1d555430cad35db2dcc37af0477d95e6f.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4132

C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe
"C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"
3⤵
- Executes dropped EXE
PID:2216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4384 -s 1076
2⤵
- Program crash
PID:4288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4384 -ip 4384
1⤵
PID:1456

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Connection Proxy

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe
Filesize
3KB

MD5
b4cd27f2b37665f51eb9fe685ec1d373

SHA1
7f08febf0fdb7fc9f8bf35a10fb11e7de431abe0

SHA256
91f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581

SHA512
e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe
Filesize
3KB

MD5
b4cd27f2b37665f51eb9fe685ec1d373

SHA1
7f08febf0fdb7fc9f8bf35a10fb11e7de431abe0

SHA256
91f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581

SHA512
e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\x64btit.txt
Filesize
28B

MD5
74537c43a09479d390016b439f5916f2

SHA1
4de04184b626cf9e0920e8f1d9a48ee199b967c4

SHA256
6378ecbc0b73add4a39c049773bf9994b9a67e7f25bce2e2be53c8da7329993f

SHA512
d08836426e8c7f92a3c9734be317e4f567685fd2c24f4ad74af5f318dab21334f4d4aaf81d502d014b0d647005c2b38787735ac0a4eb6b6a635914dc26c108aa

Download Submit
memory/2216-154-0x0000000000000000-mapping.dmp

Download
memory/4132-153-0x0000000000570000-0x000000000060F000-memory.dmp

Filesize
636KB

Download
memory/4132-152-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/4132-157-0x0000000000570000-0x000000000060F000-memory.dmp

Filesize
636KB

Download
memory/4132-150-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/4132-146-0x0000000000000000-mapping.dmp

Download
memory/4132-147-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/4384-145-0x0000000000400000-0x0000000000655000-memory.dmp

Filesize
2.3MB

Download
memory/4384-144-0x0000000000400000-0x0000000000655000-memory.dmp

Filesize
2.3MB

Download
memory/4384-132-0x0000000000400000-0x0000000000655000-memory.dmp

Filesize
2.3MB

Download
memory/4384-142-0x0000000000400000-0x0000000000655000-memory.dmp

Filesize
2.3MB

Download
memory/4384-141-0x0000000000400000-0x0000000000655000-memory.dmp

Filesize
2.3MB

Download
memory/4384-140-0x0000000000400000-0x0000000000655000-memory.dmp

Filesize
2.3MB

Download
memory/4384-143-0x0000000000400000-0x0000000000655000-memory.dmp

Filesize
2.3MB

Download
memory/4384-134-0x0000000002480000-0x00000000025B5000-memory.dmp

Filesize
1.2MB

Download
memory/4384-159-0x0000000000400000-0x0000000000655000-memory.dmp

Filesize
2.3MB

Download