Resubmissions
09-04-2024 12:50
240409-p3e4kaaf7v 1009-04-2024 12:50
240409-p3d69saf7s 1009-04-2024 12:50
240409-p3dkqsfd36 1009-04-2024 12:50
240409-p3cy7saf61 10Analysis
-
max time kernel
1801s -
max time network
1805s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
14-04-2024 08:53
Static task
static1
Behavioral task
behavioral1
Sample
osiris.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
osiris.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
osiris.exe
Resource
win10v2004-20240226-en
General
-
Target
osiris.exe
-
Size
434KB
-
MD5
64876d5de7061e925e29f6a0c87cea9b
-
SHA1
51d6ed277b85b07974d450a9b3441c780467613f
-
SHA256
01d5f1b32235b5d5ba5970d56639d82aa3d83b57ec08c79b3580fd0c88ef1c29
-
SHA512
2dfe245cd058d10ac35c441238c52dcb08db8c565786d5824baf9cbd2846f2a4803709d4e9850add7f4c8e6ea5f37c23c66423820a9d6af2b7da8ddf74b6cb1b
-
SSDEEP
12288:rXPcLcbGfVylwG/ZDCK/ScBXo8TsyMkKMY8m7WOK9SATTsx/SA/WegYfdNbrqnuv:rXh6XcBXo8TsL8Y8m/ATTySA/DrfdNbV
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1876 GetX64BTIT.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 35 api.ipify.org 36 api.ipify.org -
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString msedge.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU msedge.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4768 osiris.exe 4768 osiris.exe 4768 osiris.exe 4768 osiris.exe 4768 osiris.exe 4768 osiris.exe 4768 osiris.exe 4768 osiris.exe 4768 osiris.exe 4768 osiris.exe 4768 osiris.exe 4768 osiris.exe 4768 osiris.exe 4768 osiris.exe 4768 osiris.exe 4768 osiris.exe 4768 osiris.exe 4768 osiris.exe 4768 osiris.exe 4768 osiris.exe 4768 osiris.exe 4768 osiris.exe 4768 osiris.exe 4768 osiris.exe 4768 osiris.exe 4768 osiris.exe 4768 osiris.exe 4768 osiris.exe 4768 osiris.exe 4768 osiris.exe 4768 osiris.exe 4768 osiris.exe 4768 osiris.exe 4768 osiris.exe 4768 osiris.exe 4768 osiris.exe 4768 osiris.exe 4768 osiris.exe 4768 osiris.exe 4768 osiris.exe 4768 osiris.exe 4768 osiris.exe 4768 osiris.exe 4768 osiris.exe 4768 osiris.exe 4768 osiris.exe 4768 osiris.exe 4768 osiris.exe 4768 osiris.exe 4768 osiris.exe 4768 osiris.exe 4768 osiris.exe 4768 osiris.exe 4768 osiris.exe 4768 osiris.exe 4768 osiris.exe 4768 osiris.exe 4768 osiris.exe 4768 osiris.exe 4768 osiris.exe 4768 osiris.exe 4768 osiris.exe 4768 osiris.exe 4768 osiris.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4768 osiris.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4768 wrote to memory of 1876 4768 osiris.exe 92 PID 4768 wrote to memory of 1876 4768 osiris.exe 92 PID 4768 wrote to memory of 2032 4768 osiris.exe 78 PID 4768 wrote to memory of 2304 4768 osiris.exe 79 PID 4768 wrote to memory of 3988 4768 osiris.exe 80 PID 4768 wrote to memory of 2548 4768 osiris.exe 81 PID 4768 wrote to memory of 2092 4768 osiris.exe 82 PID 4768 wrote to memory of 2072 4768 osiris.exe 84 PID 4768 wrote to memory of 1980 4768 osiris.exe 85 PID 2032 wrote to memory of 1132 2032 msedge.exe 101 PID 2032 wrote to memory of 1132 2032 msedge.exe 101 PID 2032 wrote to memory of 1132 2032 msedge.exe 101 PID 2032 wrote to memory of 1132 2032 msedge.exe 101 PID 2032 wrote to memory of 1132 2032 msedge.exe 101 PID 2032 wrote to memory of 1132 2032 msedge.exe 101 PID 2032 wrote to memory of 1132 2032 msedge.exe 101 PID 2032 wrote to memory of 1132 2032 msedge.exe 101 PID 2032 wrote to memory of 1132 2032 msedge.exe 101 PID 2032 wrote to memory of 1132 2032 msedge.exe 101 PID 2032 wrote to memory of 1132 2032 msedge.exe 101 PID 2032 wrote to memory of 1132 2032 msedge.exe 101 PID 2032 wrote to memory of 1132 2032 msedge.exe 101 PID 2032 wrote to memory of 1132 2032 msedge.exe 101 PID 2032 wrote to memory of 1132 2032 msedge.exe 101 PID 2032 wrote to memory of 1132 2032 msedge.exe 101 PID 2032 wrote to memory of 1132 2032 msedge.exe 101 PID 2032 wrote to memory of 1132 2032 msedge.exe 101 PID 2032 wrote to memory of 1132 2032 msedge.exe 101 PID 2032 wrote to memory of 1132 2032 msedge.exe 101 PID 2032 wrote to memory of 1132 2032 msedge.exe 101 PID 2032 wrote to memory of 1132 2032 msedge.exe 101 PID 2032 wrote to memory of 1132 2032 msedge.exe 101 PID 2032 wrote to memory of 1132 2032 msedge.exe 101 PID 2032 wrote to memory of 1132 2032 msedge.exe 101 PID 2032 wrote to memory of 1132 2032 msedge.exe 101 PID 2032 wrote to memory of 1132 2032 msedge.exe 101 PID 2032 wrote to memory of 1132 2032 msedge.exe 101 PID 2032 wrote to memory of 1132 2032 msedge.exe 101 PID 2032 wrote to memory of 1132 2032 msedge.exe 101 PID 2032 wrote to memory of 1132 2032 msedge.exe 101 PID 2032 wrote to memory of 1132 2032 msedge.exe 101 PID 2032 wrote to memory of 1132 2032 msedge.exe 101 PID 2032 wrote to memory of 1132 2032 msedge.exe 101 PID 2032 wrote to memory of 1132 2032 msedge.exe 101 PID 2032 wrote to memory of 1132 2032 msedge.exe 101 PID 2032 wrote to memory of 1132 2032 msedge.exe 101 PID 2032 wrote to memory of 1132 2032 msedge.exe 101 PID 2032 wrote to memory of 1132 2032 msedge.exe 101 PID 2032 wrote to memory of 1132 2032 msedge.exe 101 PID 2032 wrote to memory of 1132 2032 msedge.exe 101 PID 2032 wrote to memory of 1132 2032 msedge.exe 101 PID 2032 wrote to memory of 1132 2032 msedge.exe 101 PID 2032 wrote to memory of 1132 2032 msedge.exe 101 PID 2032 wrote to memory of 1132 2032 msedge.exe 101 PID 2032 wrote to memory of 1132 2032 msedge.exe 101 PID 2032 wrote to memory of 1132 2032 msedge.exe 101 PID 2032 wrote to memory of 1132 2032 msedge.exe 101 PID 2032 wrote to memory of 1132 2032 msedge.exe 101 PID 2032 wrote to memory of 1132 2032 msedge.exe 101 PID 2032 wrote to memory of 1132 2032 msedge.exe 101 PID 2032 wrote to memory of 1132 2032 msedge.exe 101 PID 2032 wrote to memory of 1132 2032 msedge.exe 101 PID 2032 wrote to memory of 1132 2032 msedge.exe 101 PID 2032 wrote to memory of 1132 2032 msedge.exe 101
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window1⤵
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.52 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffa00e22e98,0x7ffa00e22ea4,0x7ffa00e22eb02⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:2304
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2272 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:22⤵PID:3988
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=3200 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:32⤵PID:2548
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=3412 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:82⤵PID:2092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --mojo-platform-channel-handle=5336 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:12⤵PID:2072
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --mojo-platform-channel-handle=5484 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:12⤵PID:1980
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4144 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:82⤵PID:1132
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=3744 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:32⤵PID:1524
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=3416 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:32⤵PID:1748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=3744 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:32⤵PID:2000
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5088 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:82⤵PID:620
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=3696 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:32⤵PID:544
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=3696 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:32⤵PID:1484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=3228 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:32⤵PID:2408
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=5048 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:32⤵PID:524
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=5048 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:32⤵PID:4452
-
-
C:\Users\Admin\AppData\Local\Temp\osiris.exe"C:\Users\Admin\AppData\Local\Temp\osiris.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"2⤵
- Executes dropped EXE
PID:1876
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\07a5d9f0-0872-43f2-ac5c-c599675c2495.dmp
Filesize10.7MB
MD5cc9f54fd2ecd0cde92c8f627d4a5c05a
SHA1eb11699079c2f84dfdc8ae3f63d4f290e5a689eb
SHA2564e17f0860ad4c06e4120146bfe78fe1187008b752cc221e4d6e2509f739415f6
SHA512fc9d4a1dd58c283f59d0dd4842d4a6c47eb16a815154f0b3e734365fe3a52b93c96db33773aa03a443150bf4785960dcb6235b1160264f7dc030017efcf5c84d
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
40B
MD520d4b8fa017a12a108c87f540836e250
SHA11ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA2566028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
SHA512507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
-
Filesize
9KB
MD5e04a100309907d9726b2a899c709f527
SHA11794f2ab11f1e7da48a1ce8997fe90e37ce8a545
SHA2568b2cec59a17671967daf6c3a2f6899bd73bffc03310fd73e0aaf420ed8e7d237
SHA5124d9ab2a161d5184db7e29c26297733084b29be98e8c80718715be8eb775550348c6fc456508b9c747198026c58980bc05d8042271f724bbb5c138a82e84cf80e
-
Filesize
36KB
MD501b80cbd830040b2d41ec1d2ce204132
SHA1be285a7fcab547740b4619c36ade7f181a6e580f
SHA2560f961be58d068e06127197bcbe6f6b9c44ea454fef825f3b69058c1e77b591fc
SHA512d9d3dd03e5e26631bc6ed9001b9ce25faeb8fd01cdf4b5451fc8294fa92690766b45ad7c526a8f5d95bcb8696d072cdfb59fba0b5df0f3ef4e4e28f1ef37c565
-
Filesize
3KB
MD5b4cd27f2b37665f51eb9fe685ec1d373
SHA17f08febf0fdb7fc9f8bf35a10fb11e7de431abe0
SHA25691f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581
SHA512e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e
-
Filesize
28B
MD5383a3f7fb57445470edd6e5c1a42a908
SHA19f22a8e97d26e6564fdf21b1c8fca3a282dbfb22
SHA256964fcd58b440f6823d60a461ebdb7b5ca96f23796458f3a4ad1b9f1aa331dd1c
SHA5129c86cc5729b450333ff472677082a8073de58db6713b15d28e33d9001b3b33fac5739ef28b51cfb336bd8e86d68ba5d7b4aab8cfe86d21b9ec36be1981209009