osiris | f868ca3de0e202d0b2e9dffb9d9cc7f668f91cbe7a397cad6d951c7063ad1b68

Resubmissions

02-04-2024 02:51

240402-dcgc6aee6z 10

02-04-2024 02:51

02-04-2024 02:49

02-04-2024 02:48

02-04-2024 02:14

19-12-2023 13:11

Analysis

max time kernel
1200s
max time network
1143s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02-04-2024 02:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2e8f4deb77b157067ae01fafb05c2605.exe
Size

444KB
MD5

2e8f4deb77b157067ae01fafb05c2605
SHA1

093c3d4965df93063f20bd6c5e0951b267e74daf
SHA256

f868ca3de0e202d0b2e9dffb9d9cc7f668f91cbe7a397cad6d951c7063ad1b68
SHA512

808dbffe05a7f4805d1f0d162e0251f86af94655db403533eb906cd5951abfec25f9574a914770fd4374f82de7b9dc8eec5997f649a13a156837adadb8d87344
SSDEEP

12288:sqiNL0Y/eQ2ZaOpTYP+Xjn+sX9eK+ySCm:sxNL0Y/ezauYP+FX9t+zv

Score

10^/10

osiris banker botnet

Malware Config

Signatures

Osiris
banker botnet osiris
Executes dropped EXE 1 IoCs

Processes:

GetX64BTIT.exe

pid process

1296 GetX64BTIT.exe
Loads dropped DLL 1 IoCs

Processes:

2e8f4deb77b157067ae01fafb05c2605.exe

pid process

2044 2e8f4deb77b157067ae01fafb05c2605.exe
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

3 api.ipify.org
4 api.ipify.org
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.

Proxy
T1090

pid	process
1296	GetX64BTIT.exe

flow	ioc
3	api.ipify.org
4	api.ipify.org

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

2e8f4deb77b157067ae01fafb05c2605.exe

pid	process
2044	2e8f4deb77b157067ae01fafb05c2605.exe
2044	2e8f4deb77b157067ae01fafb05c2605.exe
2044	2e8f4deb77b157067ae01fafb05c2605.exe
2044	2e8f4deb77b157067ae01fafb05c2605.exe
2044	2e8f4deb77b157067ae01fafb05c2605.exe
2044	2e8f4deb77b157067ae01fafb05c2605.exe
2044	2e8f4deb77b157067ae01fafb05c2605.exe
2044	2e8f4deb77b157067ae01fafb05c2605.exe
2044	2e8f4deb77b157067ae01fafb05c2605.exe
2044	2e8f4deb77b157067ae01fafb05c2605.exe
2044	2e8f4deb77b157067ae01fafb05c2605.exe
2044	2e8f4deb77b157067ae01fafb05c2605.exe
2044	2e8f4deb77b157067ae01fafb05c2605.exe
2044	2e8f4deb77b157067ae01fafb05c2605.exe
2044	2e8f4deb77b157067ae01fafb05c2605.exe
2044	2e8f4deb77b157067ae01fafb05c2605.exe
2044	2e8f4deb77b157067ae01fafb05c2605.exe
2044	2e8f4deb77b157067ae01fafb05c2605.exe
2044	2e8f4deb77b157067ae01fafb05c2605.exe
2044	2e8f4deb77b157067ae01fafb05c2605.exe
2044	2e8f4deb77b157067ae01fafb05c2605.exe
2044	2e8f4deb77b157067ae01fafb05c2605.exe
2044	2e8f4deb77b157067ae01fafb05c2605.exe
2044	2e8f4deb77b157067ae01fafb05c2605.exe
2044	2e8f4deb77b157067ae01fafb05c2605.exe
2044	2e8f4deb77b157067ae01fafb05c2605.exe
2044	2e8f4deb77b157067ae01fafb05c2605.exe
2044	2e8f4deb77b157067ae01fafb05c2605.exe
2044	2e8f4deb77b157067ae01fafb05c2605.exe
2044	2e8f4deb77b157067ae01fafb05c2605.exe
2044	2e8f4deb77b157067ae01fafb05c2605.exe
2044	2e8f4deb77b157067ae01fafb05c2605.exe
2044	2e8f4deb77b157067ae01fafb05c2605.exe
2044	2e8f4deb77b157067ae01fafb05c2605.exe
2044	2e8f4deb77b157067ae01fafb05c2605.exe
2044	2e8f4deb77b157067ae01fafb05c2605.exe
2044	2e8f4deb77b157067ae01fafb05c2605.exe
2044	2e8f4deb77b157067ae01fafb05c2605.exe
2044	2e8f4deb77b157067ae01fafb05c2605.exe
2044	2e8f4deb77b157067ae01fafb05c2605.exe
2044	2e8f4deb77b157067ae01fafb05c2605.exe
2044	2e8f4deb77b157067ae01fafb05c2605.exe
2044	2e8f4deb77b157067ae01fafb05c2605.exe
2044	2e8f4deb77b157067ae01fafb05c2605.exe
2044	2e8f4deb77b157067ae01fafb05c2605.exe
2044	2e8f4deb77b157067ae01fafb05c2605.exe
2044	2e8f4deb77b157067ae01fafb05c2605.exe
2044	2e8f4deb77b157067ae01fafb05c2605.exe
2044	2e8f4deb77b157067ae01fafb05c2605.exe
2044	2e8f4deb77b157067ae01fafb05c2605.exe
2044	2e8f4deb77b157067ae01fafb05c2605.exe
2044	2e8f4deb77b157067ae01fafb05c2605.exe
2044	2e8f4deb77b157067ae01fafb05c2605.exe
2044	2e8f4deb77b157067ae01fafb05c2605.exe
2044	2e8f4deb77b157067ae01fafb05c2605.exe
2044	2e8f4deb77b157067ae01fafb05c2605.exe
2044	2e8f4deb77b157067ae01fafb05c2605.exe
2044	2e8f4deb77b157067ae01fafb05c2605.exe
2044	2e8f4deb77b157067ae01fafb05c2605.exe
2044	2e8f4deb77b157067ae01fafb05c2605.exe
2044	2e8f4deb77b157067ae01fafb05c2605.exe
2044	2e8f4deb77b157067ae01fafb05c2605.exe
2044	2e8f4deb77b157067ae01fafb05c2605.exe
2044	2e8f4deb77b157067ae01fafb05c2605.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

2e8f4deb77b157067ae01fafb05c2605.exe

pid process

2044 2e8f4deb77b157067ae01fafb05c2605.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

2e8f4deb77b157067ae01fafb05c2605.exe

description	pid	process	target process
PID 2044 wrote to memory of 1296	2044	2e8f4deb77b157067ae01fafb05c2605.exe	GetX64BTIT.exe
PID 2044 wrote to memory of 1296	2044	2e8f4deb77b157067ae01fafb05c2605.exe	GetX64BTIT.exe
PID 2044 wrote to memory of 1296	2044	2e8f4deb77b157067ae01fafb05c2605.exe	GetX64BTIT.exe
PID 2044 wrote to memory of 1296	2044	2e8f4deb77b157067ae01fafb05c2605.exe	GetX64BTIT.exe
PID 2044 wrote to memory of 2416	2044	2e8f4deb77b157067ae01fafb05c2605.exe	firefox.exe

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:2416

C:\Users\Admin\AppData\Local\Temp\2e8f4deb77b157067ae01fafb05c2605.exe
"C:\Users\Admin\AppData\Local\Temp\2e8f4deb77b157067ae01fafb05c2605.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2044

C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe
"C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"
2⤵
- Executes dropped EXE
PID:1296

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Proxy

T1090

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe
Filesize
3KB

MD5
b4cd27f2b37665f51eb9fe685ec1d373

SHA1
7f08febf0fdb7fc9f8bf35a10fb11e7de431abe0

SHA256
91f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581

SHA512
e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\x64btit.txt
Filesize
28B

MD5
e512dcf8fd2375d7debc8e1a37882918

SHA1
8a67ba41a3ec304b5137ecc70c0f34fd58be9f3c

SHA256
458a2ed3e4d5c26d80a417cbb5f82aa5ba7e7670bacb645beef0f1c1691e4fc0

SHA512
1e8ef33f2fd0d073c6a0d3a4d5ad506e165f0d47e6a559e4157ee236ad988fbbd2eed6fe273953d81e5b89b6161cc8a99c8a2daf7a716d77665c109e0123f1c8

Download Submit
memory/2044-23-0x0000000000330000-0x00000000003CF000-memory.dmp

Filesize
636KB

Download
memory/2044-70-0x0000000000330000-0x00000000003CF000-memory.dmp

Filesize
636KB

Download
memory/2044-5-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/2044-7-0x0000000000330000-0x00000000003CF000-memory.dmp

Filesize
636KB

Download
memory/2044-6-0x0000000000330000-0x00000000003CF000-memory.dmp

Filesize
636KB

Download
memory/2044-8-0x0000000000330000-0x00000000003CF000-memory.dmp

Filesize
636KB

Download
memory/2044-10-0x0000000000330000-0x00000000003CF000-memory.dmp

Filesize
636KB

Download
memory/2044-3-0x00000000002D0000-0x0000000000324000-memory.dmp

Filesize
336KB

Download
memory/2044-2-0x0000000000520000-0x0000000000620000-memory.dmp

Filesize
1024KB

Download
memory/2044-18-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download
memory/2044-20-0x0000000000220000-0x000000000023E000-memory.dmp

Filesize
120KB

Download
memory/2044-22-0x0000000000330000-0x00000000003CF000-memory.dmp

Filesize
636KB

Download
memory/2044-77-0x0000000000330000-0x00000000003CF000-memory.dmp

Filesize
636KB

Download
memory/2044-4-0x0000000000330000-0x00000000003CF000-memory.dmp

Filesize
636KB

Download
memory/2044-39-0x0000000000330000-0x00000000003CF000-memory.dmp

Filesize
636KB

Download
memory/2044-27-0x0000000000520000-0x0000000000620000-memory.dmp

Filesize
1024KB

Download
memory/2044-31-0x0000000000330000-0x00000000003CF000-memory.dmp

Filesize
636KB

Download
memory/2044-37-0x0000000000330000-0x00000000003CF000-memory.dmp

Filesize
636KB

Download
memory/2044-25-0x0000000000330000-0x00000000003CF000-memory.dmp

Filesize
636KB

Download
memory/2044-44-0x0000000000330000-0x00000000003CF000-memory.dmp

Filesize
636KB

Download
memory/2044-49-0x0000000000330000-0x00000000003CF000-memory.dmp

Filesize
636KB

Download
memory/2044-54-0x0000000000330000-0x00000000003CF000-memory.dmp

Filesize
636KB

Download
memory/2044-55-0x0000000000330000-0x00000000003CF000-memory.dmp

Filesize
636KB

Download
memory/2044-60-0x0000000000330000-0x00000000003CF000-memory.dmp

Filesize
636KB

Download
memory/2044-66-0x0000000000330000-0x00000000003CF000-memory.dmp

Filesize
636KB

Download
memory/2044-24-0x0000000000330000-0x00000000003CF000-memory.dmp

Filesize
636KB

Download
memory/2044-71-0x0000000000330000-0x00000000003CF000-memory.dmp

Filesize
636KB

Download
memory/2044-0-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download