osiris | f868ca3de0e202d0b2e9dffb9d9cc7f668f91cbe7a397cad6d951c7063ad1b68

Resubmissions

02-04-2024 02:51

240402-dcgc6aee6z 10

02-04-2024 02:51

02-04-2024 02:49

02-04-2024 02:48

02-04-2024 02:14

19-12-2023 13:11

Analysis

max time kernel
1800s
max time network
1569s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02-04-2024 02:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2e8f4deb77b157067ae01fafb05c2605.exe
Size

444KB
MD5

2e8f4deb77b157067ae01fafb05c2605
SHA1

093c3d4965df93063f20bd6c5e0951b267e74daf
SHA256

f868ca3de0e202d0b2e9dffb9d9cc7f668f91cbe7a397cad6d951c7063ad1b68
SHA512

808dbffe05a7f4805d1f0d162e0251f86af94655db403533eb906cd5951abfec25f9574a914770fd4374f82de7b9dc8eec5997f649a13a156837adadb8d87344
SSDEEP

12288:sqiNL0Y/eQ2ZaOpTYP+Xjn+sX9eK+ySCm:sxNL0Y/ezauYP+FX9t+zv

Score

10^/10

osiris banker botnet

Malware Config

Signatures

Osiris
banker botnet osiris
Executes dropped EXE 1 IoCs

Processes:

GetX64BTIT.exe

pid process

1792 GetX64BTIT.exe
Loads dropped DLL 1 IoCs

Processes:

2e8f4deb77b157067ae01fafb05c2605.exe

pid process

320 2e8f4deb77b157067ae01fafb05c2605.exe
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

3 api.ipify.org
4 api.ipify.org
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.

Proxy
T1090

pid	process
1792	GetX64BTIT.exe

flow	ioc
3	api.ipify.org
4	api.ipify.org

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

2e8f4deb77b157067ae01fafb05c2605.exe

pid	process
320	2e8f4deb77b157067ae01fafb05c2605.exe
320	2e8f4deb77b157067ae01fafb05c2605.exe
320	2e8f4deb77b157067ae01fafb05c2605.exe
320	2e8f4deb77b157067ae01fafb05c2605.exe
320	2e8f4deb77b157067ae01fafb05c2605.exe
320	2e8f4deb77b157067ae01fafb05c2605.exe
320	2e8f4deb77b157067ae01fafb05c2605.exe
320	2e8f4deb77b157067ae01fafb05c2605.exe
320	2e8f4deb77b157067ae01fafb05c2605.exe
320	2e8f4deb77b157067ae01fafb05c2605.exe
320	2e8f4deb77b157067ae01fafb05c2605.exe
320	2e8f4deb77b157067ae01fafb05c2605.exe
320	2e8f4deb77b157067ae01fafb05c2605.exe
320	2e8f4deb77b157067ae01fafb05c2605.exe
320	2e8f4deb77b157067ae01fafb05c2605.exe
320	2e8f4deb77b157067ae01fafb05c2605.exe
320	2e8f4deb77b157067ae01fafb05c2605.exe
320	2e8f4deb77b157067ae01fafb05c2605.exe
320	2e8f4deb77b157067ae01fafb05c2605.exe
320	2e8f4deb77b157067ae01fafb05c2605.exe
320	2e8f4deb77b157067ae01fafb05c2605.exe
320	2e8f4deb77b157067ae01fafb05c2605.exe
320	2e8f4deb77b157067ae01fafb05c2605.exe
320	2e8f4deb77b157067ae01fafb05c2605.exe
320	2e8f4deb77b157067ae01fafb05c2605.exe
320	2e8f4deb77b157067ae01fafb05c2605.exe
320	2e8f4deb77b157067ae01fafb05c2605.exe
320	2e8f4deb77b157067ae01fafb05c2605.exe
320	2e8f4deb77b157067ae01fafb05c2605.exe
320	2e8f4deb77b157067ae01fafb05c2605.exe
320	2e8f4deb77b157067ae01fafb05c2605.exe
320	2e8f4deb77b157067ae01fafb05c2605.exe
320	2e8f4deb77b157067ae01fafb05c2605.exe
320	2e8f4deb77b157067ae01fafb05c2605.exe
320	2e8f4deb77b157067ae01fafb05c2605.exe
320	2e8f4deb77b157067ae01fafb05c2605.exe
320	2e8f4deb77b157067ae01fafb05c2605.exe
320	2e8f4deb77b157067ae01fafb05c2605.exe
320	2e8f4deb77b157067ae01fafb05c2605.exe
320	2e8f4deb77b157067ae01fafb05c2605.exe
320	2e8f4deb77b157067ae01fafb05c2605.exe
320	2e8f4deb77b157067ae01fafb05c2605.exe
320	2e8f4deb77b157067ae01fafb05c2605.exe
320	2e8f4deb77b157067ae01fafb05c2605.exe
320	2e8f4deb77b157067ae01fafb05c2605.exe
320	2e8f4deb77b157067ae01fafb05c2605.exe
320	2e8f4deb77b157067ae01fafb05c2605.exe
320	2e8f4deb77b157067ae01fafb05c2605.exe
320	2e8f4deb77b157067ae01fafb05c2605.exe
320	2e8f4deb77b157067ae01fafb05c2605.exe
320	2e8f4deb77b157067ae01fafb05c2605.exe
320	2e8f4deb77b157067ae01fafb05c2605.exe
320	2e8f4deb77b157067ae01fafb05c2605.exe
320	2e8f4deb77b157067ae01fafb05c2605.exe
320	2e8f4deb77b157067ae01fafb05c2605.exe
320	2e8f4deb77b157067ae01fafb05c2605.exe
320	2e8f4deb77b157067ae01fafb05c2605.exe
320	2e8f4deb77b157067ae01fafb05c2605.exe
320	2e8f4deb77b157067ae01fafb05c2605.exe
320	2e8f4deb77b157067ae01fafb05c2605.exe
320	2e8f4deb77b157067ae01fafb05c2605.exe
320	2e8f4deb77b157067ae01fafb05c2605.exe
320	2e8f4deb77b157067ae01fafb05c2605.exe
320	2e8f4deb77b157067ae01fafb05c2605.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

2e8f4deb77b157067ae01fafb05c2605.exe

pid process

320 2e8f4deb77b157067ae01fafb05c2605.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2e8f4deb77b157067ae01fafb05c2605.exe

description	pid	process	target process
PID 320 wrote to memory of 1792	320	2e8f4deb77b157067ae01fafb05c2605.exe	GetX64BTIT.exe
PID 320 wrote to memory of 1792	320	2e8f4deb77b157067ae01fafb05c2605.exe	GetX64BTIT.exe
PID 320 wrote to memory of 1792	320	2e8f4deb77b157067ae01fafb05c2605.exe	GetX64BTIT.exe
PID 320 wrote to memory of 1792	320	2e8f4deb77b157067ae01fafb05c2605.exe	GetX64BTIT.exe

C:\Users\Admin\AppData\Local\Temp\2e8f4deb77b157067ae01fafb05c2605.exe
"C:\Users\Admin\AppData\Local\Temp\2e8f4deb77b157067ae01fafb05c2605.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:320

C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe
"C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"
2⤵
- Executes dropped EXE
PID:1792

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Proxy

T1090

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\x64btit.txt
Filesize
28B

MD5
f1555b61c7dc1fd337c845d0482688f1

SHA1
9423e132d95852075ba9374ee477f3b92a290166

SHA256
a7a0d6b4dc17c4e1ea0f059e801413d77e9c474f63ca7a41e2dd753e13c6ebc5

SHA512
33729cdca4ff42291b523dd48f0e5382d1a4fa60eb5e34c075afd071013cfc5c54f70465136617eaed6482bb2d50f5347c7baf611cdcfe4bb5317845e349cd2e

Download Submit
\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe
Filesize
3KB

MD5
b4cd27f2b37665f51eb9fe685ec1d373

SHA1
7f08febf0fdb7fc9f8bf35a10fb11e7de431abe0

SHA256
91f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581

SHA512
e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e

Download Submit
memory/320-23-0x0000000000480000-0x000000000051F000-memory.dmp

Filesize
636KB

Download
memory/320-64-0x0000000000480000-0x000000000051F000-memory.dmp

Filesize
636KB

Download
memory/320-0-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/320-6-0x0000000000480000-0x000000000051F000-memory.dmp

Filesize
636KB

Download
memory/320-7-0x0000000000480000-0x000000000051F000-memory.dmp

Filesize
636KB

Download
memory/320-3-0x0000000000220000-0x0000000000274000-memory.dmp

Filesize
336KB

Download
memory/320-10-0x0000000000480000-0x000000000051F000-memory.dmp

Filesize
636KB

Download
memory/320-9-0x0000000000480000-0x000000000051F000-memory.dmp

Filesize
636KB

Download
memory/320-8-0x0000000000480000-0x000000000051F000-memory.dmp

Filesize
636KB

Download
memory/320-2-0x0000000000620000-0x0000000000720000-memory.dmp

Filesize
1024KB

Download
memory/320-18-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download
memory/320-20-0x00000000003D0000-0x00000000003EE000-memory.dmp

Filesize
120KB

Download
memory/320-5-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/320-4-0x0000000000480000-0x000000000051F000-memory.dmp

Filesize
636KB

Download
memory/320-43-0x0000000000480000-0x000000000051F000-memory.dmp

Filesize
636KB

Download
memory/320-26-0x0000000000480000-0x000000000051F000-memory.dmp

Filesize
636KB

Download
memory/320-28-0x0000000000480000-0x000000000051F000-memory.dmp

Filesize
636KB

Download
memory/320-29-0x0000000000620000-0x0000000000720000-memory.dmp

Filesize
1024KB

Download
memory/320-35-0x0000000000480000-0x000000000051F000-memory.dmp

Filesize
636KB

Download
memory/320-37-0x0000000000480000-0x000000000051F000-memory.dmp

Filesize
636KB

Download
memory/320-38-0x0000000000480000-0x000000000051F000-memory.dmp

Filesize
636KB

Download
memory/320-24-0x0000000000480000-0x000000000051F000-memory.dmp

Filesize
636KB

Download
memory/320-48-0x0000000000480000-0x000000000051F000-memory.dmp

Filesize
636KB

Download
memory/320-53-0x0000000000480000-0x000000000051F000-memory.dmp

Filesize
636KB

Download
memory/320-54-0x0000000000480000-0x000000000051F000-memory.dmp

Filesize
636KB

Download
memory/320-59-0x0000000000480000-0x000000000051F000-memory.dmp

Filesize
636KB

Download
memory/320-22-0x0000000000480000-0x000000000051F000-memory.dmp

Filesize
636KB

Download