osiris | d8c56946b65ffcf4b6aa2bd510fefb626edcc2a135c07e2f0175686aa0e588e6

General

Target

02aa4aac6bc417b73d6ea452194252fe.exe
Size

786KB
MD5

02aa4aac6bc417b73d6ea452194252fe
SHA1

69d4e8942d6c3891a06b988ada2cb8a75fc738b5
SHA256

d8c56946b65ffcf4b6aa2bd510fefb626edcc2a135c07e2f0175686aa0e588e6
SHA512

c241466c03983fa0809836d61db44c640c2ae16d8349723327b6bf0cc5267c69ecf4c91c74ba7e948655ff3b4bf9dd72046e11d4d9a123f35f1dde40e63c4158
SSDEEP

12288:vyxPJa2s86jofrWEuxjcZxyPq8tf8sQ+PRtj3lDsmMHj3N6eiaFmhL+JigD:vyxPJ/s86szWEuKiflOmMDhPEhL+lD

Score

10^/10

osiris banker botnet

Malware Config

Signatures

Osiris
banker botnet osiris

Drops startup file 1 IoCs

Processes:

02aa4aac6bc417b73d6ea452194252fe.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ultrasearch.lnk	02aa4aac6bc417b73d6ea452194252fe.exe

Executes dropped EXE 1 IoCs

Processes:

GetX64BTIT.exe

pid process

2584 GetX64BTIT.exe
Loads dropped DLL 1 IoCs

Processes:

02aa4aac6bc417b73d6ea452194252fe.exe

pid process

2020 02aa4aac6bc417b73d6ea452194252fe.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2584	GetX64BTIT.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

02aa4aac6bc417b73d6ea452194252fe.exe

pid	process
2020	02aa4aac6bc417b73d6ea452194252fe.exe
2020	02aa4aac6bc417b73d6ea452194252fe.exe
2020	02aa4aac6bc417b73d6ea452194252fe.exe
2020	02aa4aac6bc417b73d6ea452194252fe.exe
2020	02aa4aac6bc417b73d6ea452194252fe.exe
2020	02aa4aac6bc417b73d6ea452194252fe.exe
2020	02aa4aac6bc417b73d6ea452194252fe.exe
2020	02aa4aac6bc417b73d6ea452194252fe.exe
2020	02aa4aac6bc417b73d6ea452194252fe.exe
2020	02aa4aac6bc417b73d6ea452194252fe.exe
2020	02aa4aac6bc417b73d6ea452194252fe.exe
2020	02aa4aac6bc417b73d6ea452194252fe.exe
2020	02aa4aac6bc417b73d6ea452194252fe.exe
2020	02aa4aac6bc417b73d6ea452194252fe.exe
2020	02aa4aac6bc417b73d6ea452194252fe.exe
2020	02aa4aac6bc417b73d6ea452194252fe.exe
2020	02aa4aac6bc417b73d6ea452194252fe.exe
2020	02aa4aac6bc417b73d6ea452194252fe.exe
2020	02aa4aac6bc417b73d6ea452194252fe.exe
2020	02aa4aac6bc417b73d6ea452194252fe.exe
2020	02aa4aac6bc417b73d6ea452194252fe.exe
2020	02aa4aac6bc417b73d6ea452194252fe.exe
2020	02aa4aac6bc417b73d6ea452194252fe.exe
2020	02aa4aac6bc417b73d6ea452194252fe.exe
2020	02aa4aac6bc417b73d6ea452194252fe.exe
2020	02aa4aac6bc417b73d6ea452194252fe.exe
2020	02aa4aac6bc417b73d6ea452194252fe.exe
2020	02aa4aac6bc417b73d6ea452194252fe.exe
2020	02aa4aac6bc417b73d6ea452194252fe.exe
2020	02aa4aac6bc417b73d6ea452194252fe.exe
2020	02aa4aac6bc417b73d6ea452194252fe.exe
2020	02aa4aac6bc417b73d6ea452194252fe.exe
2020	02aa4aac6bc417b73d6ea452194252fe.exe
2020	02aa4aac6bc417b73d6ea452194252fe.exe
2020	02aa4aac6bc417b73d6ea452194252fe.exe
2020	02aa4aac6bc417b73d6ea452194252fe.exe
2020	02aa4aac6bc417b73d6ea452194252fe.exe
2020	02aa4aac6bc417b73d6ea452194252fe.exe
2020	02aa4aac6bc417b73d6ea452194252fe.exe
2020	02aa4aac6bc417b73d6ea452194252fe.exe
2020	02aa4aac6bc417b73d6ea452194252fe.exe
2020	02aa4aac6bc417b73d6ea452194252fe.exe
2020	02aa4aac6bc417b73d6ea452194252fe.exe
2020	02aa4aac6bc417b73d6ea452194252fe.exe
2020	02aa4aac6bc417b73d6ea452194252fe.exe
2020	02aa4aac6bc417b73d6ea452194252fe.exe
2020	02aa4aac6bc417b73d6ea452194252fe.exe
2020	02aa4aac6bc417b73d6ea452194252fe.exe
2020	02aa4aac6bc417b73d6ea452194252fe.exe
2020	02aa4aac6bc417b73d6ea452194252fe.exe
2020	02aa4aac6bc417b73d6ea452194252fe.exe
2020	02aa4aac6bc417b73d6ea452194252fe.exe
2020	02aa4aac6bc417b73d6ea452194252fe.exe
2020	02aa4aac6bc417b73d6ea452194252fe.exe
2020	02aa4aac6bc417b73d6ea452194252fe.exe
2020	02aa4aac6bc417b73d6ea452194252fe.exe
2020	02aa4aac6bc417b73d6ea452194252fe.exe
2020	02aa4aac6bc417b73d6ea452194252fe.exe
2020	02aa4aac6bc417b73d6ea452194252fe.exe
2020	02aa4aac6bc417b73d6ea452194252fe.exe
2020	02aa4aac6bc417b73d6ea452194252fe.exe
2020	02aa4aac6bc417b73d6ea452194252fe.exe
2020	02aa4aac6bc417b73d6ea452194252fe.exe
2020	02aa4aac6bc417b73d6ea452194252fe.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

02aa4aac6bc417b73d6ea452194252fe.exe

pid process

2020 02aa4aac6bc417b73d6ea452194252fe.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

02aa4aac6bc417b73d6ea452194252fe.exe

description	pid	process	target process
PID 2020 wrote to memory of 2584	2020	02aa4aac6bc417b73d6ea452194252fe.exe	GetX64BTIT.exe
PID 2020 wrote to memory of 2584	2020	02aa4aac6bc417b73d6ea452194252fe.exe	GetX64BTIT.exe
PID 2020 wrote to memory of 2584	2020	02aa4aac6bc417b73d6ea452194252fe.exe	GetX64BTIT.exe
PID 2020 wrote to memory of 2584	2020	02aa4aac6bc417b73d6ea452194252fe.exe	GetX64BTIT.exe

C:\Users\Admin\AppData\Local\Temp\02aa4aac6bc417b73d6ea452194252fe.exe
"C:\Users\Admin\AppData\Local\Temp\02aa4aac6bc417b73d6ea452194252fe.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2020

C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe
"C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"
2⤵
- Executes dropped EXE
PID:2584

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe
Filesize
3KB

MD5
b4cd27f2b37665f51eb9fe685ec1d373

SHA1
7f08febf0fdb7fc9f8bf35a10fb11e7de431abe0

SHA256
91f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581

SHA512
e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\x64btit.txt
Filesize
28B

MD5
d6b11e5e55947c06bee26fd63c8022be

SHA1
34fca4520b2dd9077f05c6641452656d8ad6c243

SHA256
65126411b1b223def99c82a8924aa472800d9a787b639876ae028450c690c410

SHA512
ec86e43877ac619109153ced4c527da49c5da072ee3866b0c17083b09a61cb6016f79c46c54dc5b8f4a5f4def07fae488512b3f361187658658f24a0bc698a22

Download Submit
\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe
Filesize
2KB

MD5
7c4675aabf37325d49bfd23c9bcbcfa9

SHA1
20e1808aa12a56bc508782c471fd5f82f487eef5

SHA256
9835c9dfef9564685baf99a92956a2537f8bf36e891d1c8faa4f684e22aaa3b5

SHA512
24b389ee8f25d921bf5545252d638f8e1df1ffdd24e89bc4476e08c7ff85d6c9bf045fcaea0f40526085db0f21413f82eb0c07309744a416f00d4121700cee5f

Download Submit
memory/2020-7-0x0000000002890000-0x0000000002939000-memory.dmp

Filesize
676KB

Download
memory/2020-8-0x0000000002890000-0x0000000002939000-memory.dmp

Filesize
676KB

Download
memory/2020-5-0x0000000002890000-0x0000000002939000-memory.dmp

Filesize
676KB

Download
memory/2020-4-0x0000000002890000-0x0000000002939000-memory.dmp

Filesize
676KB

Download
memory/2020-9-0x0000000002890000-0x0000000002939000-memory.dmp

Filesize
676KB

Download
memory/2020-2-0x00000000004B0000-0x00000000004F2000-memory.dmp

Filesize
264KB

Download
memory/2020-6-0x0000000002890000-0x0000000002939000-memory.dmp

Filesize
676KB

Download
memory/2020-15-0x0000000000170000-0x000000000023A000-memory.dmp

Filesize
808KB

Download
memory/2020-19-0x0000000000280000-0x000000000029F000-memory.dmp

Filesize
124KB

Download
memory/2020-21-0x0000000002890000-0x0000000002939000-memory.dmp

Filesize
676KB

Download
memory/2020-20-0x0000000002890000-0x0000000002939000-memory.dmp

Filesize
676KB

Download
memory/2020-18-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download
memory/2020-3-0x0000000000170000-0x000000000023A000-memory.dmp

Filesize
808KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads