osiris | 2b6f62b7b957100080f851c141e79a09c394750332d445d5c00b9c5b8bf20401

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05-04-2024 01:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c78ad25795300ed3c4ed7f3d2cdb8b51_JaffaCakes118.exe
Size

786KB
MD5

c78ad25795300ed3c4ed7f3d2cdb8b51
SHA1

62f9bbf935d54415eadf7fdb72b1640ac4ac390e
SHA256

2b6f62b7b957100080f851c141e79a09c394750332d445d5c00b9c5b8bf20401
SHA512

0889c4511ca3f6cfb1c4f875de5d0432518f0c14a6328991397e1b7003d80cfb0512f76c19f5af51bbdbedc607c917f98b265fd959e3124d038da077e526050d
SSDEEP

12288:vyxPJa2s86jofrWEuxjcZxyPq8tf8sQ+PRtj3lDsmMHj3N6eiaFmhL+Jig8:vyxPJ/s86szWEuKiflOmMDhPEhL+l8

Score

10^/10

osiris banker botnet

Malware Config

Signatures

Osiris
banker botnet osiris

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ultrasearch.lnk	c78ad25795300ed3c4ed7f3d2cdb8b51_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2984	GetX64BTIT.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
38	api.ipify.org
39	api.ipify.org

Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.

Proxy
T1090
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1964	c78ad25795300ed3c4ed7f3d2cdb8b51_JaffaCakes118.exe
1964	c78ad25795300ed3c4ed7f3d2cdb8b51_JaffaCakes118.exe
1964	c78ad25795300ed3c4ed7f3d2cdb8b51_JaffaCakes118.exe
1964	c78ad25795300ed3c4ed7f3d2cdb8b51_JaffaCakes118.exe
1964	c78ad25795300ed3c4ed7f3d2cdb8b51_JaffaCakes118.exe
1964	c78ad25795300ed3c4ed7f3d2cdb8b51_JaffaCakes118.exe
1964	c78ad25795300ed3c4ed7f3d2cdb8b51_JaffaCakes118.exe
1964	c78ad25795300ed3c4ed7f3d2cdb8b51_JaffaCakes118.exe
1964	c78ad25795300ed3c4ed7f3d2cdb8b51_JaffaCakes118.exe
1964	c78ad25795300ed3c4ed7f3d2cdb8b51_JaffaCakes118.exe
1964	c78ad25795300ed3c4ed7f3d2cdb8b51_JaffaCakes118.exe
1964	c78ad25795300ed3c4ed7f3d2cdb8b51_JaffaCakes118.exe
1964	c78ad25795300ed3c4ed7f3d2cdb8b51_JaffaCakes118.exe
1964	c78ad25795300ed3c4ed7f3d2cdb8b51_JaffaCakes118.exe
1964	c78ad25795300ed3c4ed7f3d2cdb8b51_JaffaCakes118.exe
1964	c78ad25795300ed3c4ed7f3d2cdb8b51_JaffaCakes118.exe
1964	c78ad25795300ed3c4ed7f3d2cdb8b51_JaffaCakes118.exe
1964	c78ad25795300ed3c4ed7f3d2cdb8b51_JaffaCakes118.exe
1964	c78ad25795300ed3c4ed7f3d2cdb8b51_JaffaCakes118.exe
1964	c78ad25795300ed3c4ed7f3d2cdb8b51_JaffaCakes118.exe
1964	c78ad25795300ed3c4ed7f3d2cdb8b51_JaffaCakes118.exe
1964	c78ad25795300ed3c4ed7f3d2cdb8b51_JaffaCakes118.exe
1964	c78ad25795300ed3c4ed7f3d2cdb8b51_JaffaCakes118.exe
1964	c78ad25795300ed3c4ed7f3d2cdb8b51_JaffaCakes118.exe
1964	c78ad25795300ed3c4ed7f3d2cdb8b51_JaffaCakes118.exe
1964	c78ad25795300ed3c4ed7f3d2cdb8b51_JaffaCakes118.exe
1964	c78ad25795300ed3c4ed7f3d2cdb8b51_JaffaCakes118.exe
1964	c78ad25795300ed3c4ed7f3d2cdb8b51_JaffaCakes118.exe
1964	c78ad25795300ed3c4ed7f3d2cdb8b51_JaffaCakes118.exe
1964	c78ad25795300ed3c4ed7f3d2cdb8b51_JaffaCakes118.exe
1964	c78ad25795300ed3c4ed7f3d2cdb8b51_JaffaCakes118.exe
1964	c78ad25795300ed3c4ed7f3d2cdb8b51_JaffaCakes118.exe
1964	c78ad25795300ed3c4ed7f3d2cdb8b51_JaffaCakes118.exe
1964	c78ad25795300ed3c4ed7f3d2cdb8b51_JaffaCakes118.exe
1964	c78ad25795300ed3c4ed7f3d2cdb8b51_JaffaCakes118.exe
1964	c78ad25795300ed3c4ed7f3d2cdb8b51_JaffaCakes118.exe
1964	c78ad25795300ed3c4ed7f3d2cdb8b51_JaffaCakes118.exe
1964	c78ad25795300ed3c4ed7f3d2cdb8b51_JaffaCakes118.exe
1964	c78ad25795300ed3c4ed7f3d2cdb8b51_JaffaCakes118.exe
1964	c78ad25795300ed3c4ed7f3d2cdb8b51_JaffaCakes118.exe
1964	c78ad25795300ed3c4ed7f3d2cdb8b51_JaffaCakes118.exe
1964	c78ad25795300ed3c4ed7f3d2cdb8b51_JaffaCakes118.exe
1964	c78ad25795300ed3c4ed7f3d2cdb8b51_JaffaCakes118.exe
1964	c78ad25795300ed3c4ed7f3d2cdb8b51_JaffaCakes118.exe
1964	c78ad25795300ed3c4ed7f3d2cdb8b51_JaffaCakes118.exe
1964	c78ad25795300ed3c4ed7f3d2cdb8b51_JaffaCakes118.exe
1964	c78ad25795300ed3c4ed7f3d2cdb8b51_JaffaCakes118.exe
1964	c78ad25795300ed3c4ed7f3d2cdb8b51_JaffaCakes118.exe
1964	c78ad25795300ed3c4ed7f3d2cdb8b51_JaffaCakes118.exe
1964	c78ad25795300ed3c4ed7f3d2cdb8b51_JaffaCakes118.exe
1964	c78ad25795300ed3c4ed7f3d2cdb8b51_JaffaCakes118.exe
1964	c78ad25795300ed3c4ed7f3d2cdb8b51_JaffaCakes118.exe
1964	c78ad25795300ed3c4ed7f3d2cdb8b51_JaffaCakes118.exe
1964	c78ad25795300ed3c4ed7f3d2cdb8b51_JaffaCakes118.exe
1964	c78ad25795300ed3c4ed7f3d2cdb8b51_JaffaCakes118.exe
1964	c78ad25795300ed3c4ed7f3d2cdb8b51_JaffaCakes118.exe
1964	c78ad25795300ed3c4ed7f3d2cdb8b51_JaffaCakes118.exe
1964	c78ad25795300ed3c4ed7f3d2cdb8b51_JaffaCakes118.exe
1964	c78ad25795300ed3c4ed7f3d2cdb8b51_JaffaCakes118.exe
1964	c78ad25795300ed3c4ed7f3d2cdb8b51_JaffaCakes118.exe
1964	c78ad25795300ed3c4ed7f3d2cdb8b51_JaffaCakes118.exe
1964	c78ad25795300ed3c4ed7f3d2cdb8b51_JaffaCakes118.exe
1964	c78ad25795300ed3c4ed7f3d2cdb8b51_JaffaCakes118.exe
1964	c78ad25795300ed3c4ed7f3d2cdb8b51_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1964	c78ad25795300ed3c4ed7f3d2cdb8b51_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 2984	1964	c78ad25795300ed3c4ed7f3d2cdb8b51_JaffaCakes118.exe	96
PID 1964 wrote to memory of 2984	1964	c78ad25795300ed3c4ed7f3d2cdb8b51_JaffaCakes118.exe	96

C:\Users\Admin\AppData\Local\Temp\c78ad25795300ed3c4ed7f3d2cdb8b51_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c78ad25795300ed3c4ed7f3d2cdb8b51_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe
  "C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"
  2⤵
  - Executes dropped EXE
  PID:2984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Proxy

T1090

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe

Filesize
3KB

MD5
b4cd27f2b37665f51eb9fe685ec1d373

SHA1
7f08febf0fdb7fc9f8bf35a10fb11e7de431abe0

SHA256
91f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581

SHA512
e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\x64btit.txt

Filesize
28B

MD5
c298abc1cef49b0f4ea1522f0df35a37

SHA1
49123fe0c9d62e4dc72e7fa48d9923e2937389a9

SHA256
2d65d2f4900552096e3e748fda4e49b250ca5aa3a5b7b1c92305a0951adc749c

SHA512
e4cb49bd3df2ad64e3c87271804c33a651213def42b529e15dc181cefbc199f16f966802b2af28d597dbcbd8336243bd4fdf1744fe931635559085a8f1724888

Download Submit
memory/1964-8-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/1964-16-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/1964-5-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/1964-6-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/1964-7-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/1964-3-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/1964-1-0x0000000003140000-0x0000000003182000-memory.dmp

Filesize
264KB

Download
memory/1964-2-0x00000000000D0000-0x000000000019A000-memory.dmp

Filesize
808KB

Download
memory/1964-15-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/1964-4-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/1964-17-0x00000000000D0000-0x000000000019A000-memory.dmp

Filesize
808KB

Download
memory/1964-19-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/1964-21-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/1964-22-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/1964-26-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/1964-30-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/1964-32-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download