osiris | 5a3a69a57da03bd1c26fe525e51df51b391c1556cb013bb7e411ccaead253fb9

General

Target

c27131bdcd5cb27339af4833ab139305.exe
Size

566KB
MD5

c27131bdcd5cb27339af4833ab139305
SHA1

4dcbc9009b87fbee794a911879997156b8a61d8e
SHA256

5a3a69a57da03bd1c26fe525e51df51b391c1556cb013bb7e411ccaead253fb9
SHA512

91ac3e5c6e476146e38df502c233dc45d3f54ff6c7e9e628fbc570c8323dc046a950baf32b4bbedf7bc6d9c509309d8e4fbcf69bf5f1616e535ca933f0945477
SSDEEP

12288:Bz4ubZCXMtdUKat+YH7/yJ2je3rojGvB/WaEYvWr:pjOMtd1a/yl3KOj+

Score

10^/10

osiris banker botnet persistence

Malware Config

Signatures

Osiris
banker botnet osiris
Executes dropped EXE 1 IoCs

Processes:

GetX64BTIT.exe

pid process

2872 GetX64BTIT.exe
Loads dropped DLL 1 IoCs

Processes:

c27131bdcd5cb27339af4833ab139305.exe

pid process

2948 c27131bdcd5cb27339af4833ab139305.exe

pid	process
2872	GetX64BTIT.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

c27131bdcd5cb27339af4833ab139305.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\c27131bdcd5cb27339af4833ab139305.exe"	c27131bdcd5cb27339af4833ab139305.exe

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

3 api.ipify.org
4 api.ipify.org
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.

Proxy
T1090

flow	ioc
3	api.ipify.org
4	api.ipify.org

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

c27131bdcd5cb27339af4833ab139305.exe

pid	process
2948	c27131bdcd5cb27339af4833ab139305.exe
2948	c27131bdcd5cb27339af4833ab139305.exe
2948	c27131bdcd5cb27339af4833ab139305.exe
2948	c27131bdcd5cb27339af4833ab139305.exe
2948	c27131bdcd5cb27339af4833ab139305.exe
2948	c27131bdcd5cb27339af4833ab139305.exe
2948	c27131bdcd5cb27339af4833ab139305.exe
2948	c27131bdcd5cb27339af4833ab139305.exe
2948	c27131bdcd5cb27339af4833ab139305.exe
2948	c27131bdcd5cb27339af4833ab139305.exe
2948	c27131bdcd5cb27339af4833ab139305.exe
2948	c27131bdcd5cb27339af4833ab139305.exe
2948	c27131bdcd5cb27339af4833ab139305.exe
2948	c27131bdcd5cb27339af4833ab139305.exe
2948	c27131bdcd5cb27339af4833ab139305.exe
2948	c27131bdcd5cb27339af4833ab139305.exe
2948	c27131bdcd5cb27339af4833ab139305.exe
2948	c27131bdcd5cb27339af4833ab139305.exe
2948	c27131bdcd5cb27339af4833ab139305.exe
2948	c27131bdcd5cb27339af4833ab139305.exe
2948	c27131bdcd5cb27339af4833ab139305.exe
2948	c27131bdcd5cb27339af4833ab139305.exe
2948	c27131bdcd5cb27339af4833ab139305.exe
2948	c27131bdcd5cb27339af4833ab139305.exe
2948	c27131bdcd5cb27339af4833ab139305.exe
2948	c27131bdcd5cb27339af4833ab139305.exe
2948	c27131bdcd5cb27339af4833ab139305.exe
2948	c27131bdcd5cb27339af4833ab139305.exe
2948	c27131bdcd5cb27339af4833ab139305.exe
2948	c27131bdcd5cb27339af4833ab139305.exe
2948	c27131bdcd5cb27339af4833ab139305.exe
2948	c27131bdcd5cb27339af4833ab139305.exe
2948	c27131bdcd5cb27339af4833ab139305.exe
2948	c27131bdcd5cb27339af4833ab139305.exe
2948	c27131bdcd5cb27339af4833ab139305.exe
2948	c27131bdcd5cb27339af4833ab139305.exe
2948	c27131bdcd5cb27339af4833ab139305.exe
2948	c27131bdcd5cb27339af4833ab139305.exe
2948	c27131bdcd5cb27339af4833ab139305.exe
2948	c27131bdcd5cb27339af4833ab139305.exe
2948	c27131bdcd5cb27339af4833ab139305.exe
2948	c27131bdcd5cb27339af4833ab139305.exe
2948	c27131bdcd5cb27339af4833ab139305.exe
2948	c27131bdcd5cb27339af4833ab139305.exe
2948	c27131bdcd5cb27339af4833ab139305.exe
2948	c27131bdcd5cb27339af4833ab139305.exe
2948	c27131bdcd5cb27339af4833ab139305.exe
2948	c27131bdcd5cb27339af4833ab139305.exe
2948	c27131bdcd5cb27339af4833ab139305.exe
2948	c27131bdcd5cb27339af4833ab139305.exe
2948	c27131bdcd5cb27339af4833ab139305.exe
2948	c27131bdcd5cb27339af4833ab139305.exe
2948	c27131bdcd5cb27339af4833ab139305.exe
2948	c27131bdcd5cb27339af4833ab139305.exe
2948	c27131bdcd5cb27339af4833ab139305.exe
2948	c27131bdcd5cb27339af4833ab139305.exe
2948	c27131bdcd5cb27339af4833ab139305.exe
2948	c27131bdcd5cb27339af4833ab139305.exe
2948	c27131bdcd5cb27339af4833ab139305.exe
2948	c27131bdcd5cb27339af4833ab139305.exe
2948	c27131bdcd5cb27339af4833ab139305.exe
2948	c27131bdcd5cb27339af4833ab139305.exe
2948	c27131bdcd5cb27339af4833ab139305.exe
2948	c27131bdcd5cb27339af4833ab139305.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

c27131bdcd5cb27339af4833ab139305.exe

pid process

2948 c27131bdcd5cb27339af4833ab139305.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

c27131bdcd5cb27339af4833ab139305.exe

description	pid	process	target process
PID 2948 wrote to memory of 2872	2948	c27131bdcd5cb27339af4833ab139305.exe	GetX64BTIT.exe
PID 2948 wrote to memory of 2872	2948	c27131bdcd5cb27339af4833ab139305.exe	GetX64BTIT.exe
PID 2948 wrote to memory of 2872	2948	c27131bdcd5cb27339af4833ab139305.exe	GetX64BTIT.exe
PID 2948 wrote to memory of 2872	2948	c27131bdcd5cb27339af4833ab139305.exe	GetX64BTIT.exe

C:\Users\Admin\AppData\Local\Temp\c27131bdcd5cb27339af4833ab139305.exe
"C:\Users\Admin\AppData\Local\Temp\c27131bdcd5cb27339af4833ab139305.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2948

C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe
"C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"
2⤵
- Executes dropped EXE
PID:2872

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Proxy

1

T1090

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe
Filesize
3KB

MD5
b4cd27f2b37665f51eb9fe685ec1d373

SHA1
7f08febf0fdb7fc9f8bf35a10fb11e7de431abe0

SHA256
91f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581

SHA512
e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\x64btit.txt
Filesize
28B

MD5
6dc13875f352d5685b297de103001773

SHA1
84de3498cf19101804a437f576bd7f894682b0be

SHA256
e8af1450405521907e74bcf67dd49c3a9f6288291f5cbb6459ef0de03a2d112f

SHA512
cb4397cb74e6e18c1f0404d2e7971e2b6d9111fd43e929020d6fbb2a269744ac752953ad363aaff94224a1c00aa4f05751eae7b788f7895e651e08dd0da14524

Download Submit
memory/2948-15-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download
memory/2948-17-0x0000000000320000-0x000000000033F000-memory.dmp

Filesize
124KB

Download
memory/2948-5-0x0000000001CE0000-0x0000000001D89000-memory.dmp

Filesize
676KB

Download
memory/2948-3-0x0000000001CE0000-0x0000000001D89000-memory.dmp

Filesize
676KB

Download
memory/2948-6-0x0000000001CE0000-0x0000000001D89000-memory.dmp

Filesize
676KB

Download
memory/2948-7-0x0000000001CE0000-0x0000000001D89000-memory.dmp

Filesize
676KB

Download
memory/2948-0-0x0000000000220000-0x0000000000278000-memory.dmp

Filesize
352KB

Download
memory/2948-1-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/2948-2-0x0000000001CE0000-0x0000000001D89000-memory.dmp

Filesize
676KB

Download
memory/2948-4-0x0000000001CE0000-0x0000000001D89000-memory.dmp

Filesize
676KB

Download
memory/2948-19-0x0000000001CE0000-0x0000000001D89000-memory.dmp

Filesize
676KB

Download
memory/2948-20-0x0000000001CE0000-0x0000000001D89000-memory.dmp

Filesize
676KB

Download
memory/2948-24-0x0000000001CE0000-0x0000000001D89000-memory.dmp

Filesize
676KB

Download
memory/2948-25-0x0000000001CE0000-0x0000000001D89000-memory.dmp

Filesize
676KB

Download
memory/2948-30-0x0000000001CE0000-0x0000000001D89000-memory.dmp

Filesize
676KB

Download
memory/2948-35-0x0000000001CE0000-0x0000000001D89000-memory.dmp

Filesize
676KB

Download
memory/2948-40-0x0000000001CE0000-0x0000000001D89000-memory.dmp

Filesize
676KB

Download
memory/2948-41-0x0000000001CE0000-0x0000000001D89000-memory.dmp

Filesize
676KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads