osiris | 37c34bc3b886f0995b0ba57fec6d33eee5c98d200fddc2c50feeef10c51adf5e

General

Target

37c34bc3b886f0995b0ba57fec6d33eee5c98d200fddc2c50feeef10c51adf5e.exe
Size

791KB
MD5

79614c2110f224d0ef0bb674304ca2d2
SHA1

eb1f200aaeb480c9ed8c4e694e80efb27cb7db1f
SHA256

37c34bc3b886f0995b0ba57fec6d33eee5c98d200fddc2c50feeef10c51adf5e
SHA512

887ebba92b9d361467e5f26d478a6296e4405f8954a9ae69d38bf83372f5a1ab772aa2cc38f5b9305135aab527219209e9175936eccb25f31749fd0bbd5c28c7
SSDEEP

12288:OGoOiNM1QcKQkjLSKjrecrE5bglF2Yg5BeV9V8XpcXAD1u2F43md8ds7NZQmvS2t:OGwV17acI5bglsQ+5cwD1b40csYvg

Score

10^/10

osiris banker botnet

Malware Config

Signatures

Osiris
banker botnet osiris
Executes dropped EXE 1 IoCs

Processes:

GetX64BTIT.exe

pid process

3836 GetX64BTIT.exe
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

2 api.ipify.org
3 api.ipify.org
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.

Proxy
T1090

pid	process
3836	GetX64BTIT.exe

flow	ioc
2	api.ipify.org
3	api.ipify.org

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

37c34bc3b886f0995b0ba57fec6d33eee5c98d200fddc2c50feeef10c51adf5e.exe

pid	process
1932	37c34bc3b886f0995b0ba57fec6d33eee5c98d200fddc2c50feeef10c51adf5e.exe
1932	37c34bc3b886f0995b0ba57fec6d33eee5c98d200fddc2c50feeef10c51adf5e.exe
1932	37c34bc3b886f0995b0ba57fec6d33eee5c98d200fddc2c50feeef10c51adf5e.exe
1932	37c34bc3b886f0995b0ba57fec6d33eee5c98d200fddc2c50feeef10c51adf5e.exe
1932	37c34bc3b886f0995b0ba57fec6d33eee5c98d200fddc2c50feeef10c51adf5e.exe
1932	37c34bc3b886f0995b0ba57fec6d33eee5c98d200fddc2c50feeef10c51adf5e.exe
1932	37c34bc3b886f0995b0ba57fec6d33eee5c98d200fddc2c50feeef10c51adf5e.exe
1932	37c34bc3b886f0995b0ba57fec6d33eee5c98d200fddc2c50feeef10c51adf5e.exe
1932	37c34bc3b886f0995b0ba57fec6d33eee5c98d200fddc2c50feeef10c51adf5e.exe
1932	37c34bc3b886f0995b0ba57fec6d33eee5c98d200fddc2c50feeef10c51adf5e.exe
1932	37c34bc3b886f0995b0ba57fec6d33eee5c98d200fddc2c50feeef10c51adf5e.exe
1932	37c34bc3b886f0995b0ba57fec6d33eee5c98d200fddc2c50feeef10c51adf5e.exe
1932	37c34bc3b886f0995b0ba57fec6d33eee5c98d200fddc2c50feeef10c51adf5e.exe
1932	37c34bc3b886f0995b0ba57fec6d33eee5c98d200fddc2c50feeef10c51adf5e.exe
1932	37c34bc3b886f0995b0ba57fec6d33eee5c98d200fddc2c50feeef10c51adf5e.exe
1932	37c34bc3b886f0995b0ba57fec6d33eee5c98d200fddc2c50feeef10c51adf5e.exe
1932	37c34bc3b886f0995b0ba57fec6d33eee5c98d200fddc2c50feeef10c51adf5e.exe
1932	37c34bc3b886f0995b0ba57fec6d33eee5c98d200fddc2c50feeef10c51adf5e.exe
1932	37c34bc3b886f0995b0ba57fec6d33eee5c98d200fddc2c50feeef10c51adf5e.exe
1932	37c34bc3b886f0995b0ba57fec6d33eee5c98d200fddc2c50feeef10c51adf5e.exe
1932	37c34bc3b886f0995b0ba57fec6d33eee5c98d200fddc2c50feeef10c51adf5e.exe
1932	37c34bc3b886f0995b0ba57fec6d33eee5c98d200fddc2c50feeef10c51adf5e.exe
1932	37c34bc3b886f0995b0ba57fec6d33eee5c98d200fddc2c50feeef10c51adf5e.exe
1932	37c34bc3b886f0995b0ba57fec6d33eee5c98d200fddc2c50feeef10c51adf5e.exe
1932	37c34bc3b886f0995b0ba57fec6d33eee5c98d200fddc2c50feeef10c51adf5e.exe
1932	37c34bc3b886f0995b0ba57fec6d33eee5c98d200fddc2c50feeef10c51adf5e.exe
1932	37c34bc3b886f0995b0ba57fec6d33eee5c98d200fddc2c50feeef10c51adf5e.exe
1932	37c34bc3b886f0995b0ba57fec6d33eee5c98d200fddc2c50feeef10c51adf5e.exe
1932	37c34bc3b886f0995b0ba57fec6d33eee5c98d200fddc2c50feeef10c51adf5e.exe
1932	37c34bc3b886f0995b0ba57fec6d33eee5c98d200fddc2c50feeef10c51adf5e.exe
1932	37c34bc3b886f0995b0ba57fec6d33eee5c98d200fddc2c50feeef10c51adf5e.exe
1932	37c34bc3b886f0995b0ba57fec6d33eee5c98d200fddc2c50feeef10c51adf5e.exe
1932	37c34bc3b886f0995b0ba57fec6d33eee5c98d200fddc2c50feeef10c51adf5e.exe
1932	37c34bc3b886f0995b0ba57fec6d33eee5c98d200fddc2c50feeef10c51adf5e.exe
1932	37c34bc3b886f0995b0ba57fec6d33eee5c98d200fddc2c50feeef10c51adf5e.exe
1932	37c34bc3b886f0995b0ba57fec6d33eee5c98d200fddc2c50feeef10c51adf5e.exe
1932	37c34bc3b886f0995b0ba57fec6d33eee5c98d200fddc2c50feeef10c51adf5e.exe
1932	37c34bc3b886f0995b0ba57fec6d33eee5c98d200fddc2c50feeef10c51adf5e.exe
1932	37c34bc3b886f0995b0ba57fec6d33eee5c98d200fddc2c50feeef10c51adf5e.exe
1932	37c34bc3b886f0995b0ba57fec6d33eee5c98d200fddc2c50feeef10c51adf5e.exe
1932	37c34bc3b886f0995b0ba57fec6d33eee5c98d200fddc2c50feeef10c51adf5e.exe
1932	37c34bc3b886f0995b0ba57fec6d33eee5c98d200fddc2c50feeef10c51adf5e.exe
1932	37c34bc3b886f0995b0ba57fec6d33eee5c98d200fddc2c50feeef10c51adf5e.exe
1932	37c34bc3b886f0995b0ba57fec6d33eee5c98d200fddc2c50feeef10c51adf5e.exe
1932	37c34bc3b886f0995b0ba57fec6d33eee5c98d200fddc2c50feeef10c51adf5e.exe
1932	37c34bc3b886f0995b0ba57fec6d33eee5c98d200fddc2c50feeef10c51adf5e.exe
1932	37c34bc3b886f0995b0ba57fec6d33eee5c98d200fddc2c50feeef10c51adf5e.exe
1932	37c34bc3b886f0995b0ba57fec6d33eee5c98d200fddc2c50feeef10c51adf5e.exe
1932	37c34bc3b886f0995b0ba57fec6d33eee5c98d200fddc2c50feeef10c51adf5e.exe
1932	37c34bc3b886f0995b0ba57fec6d33eee5c98d200fddc2c50feeef10c51adf5e.exe
1932	37c34bc3b886f0995b0ba57fec6d33eee5c98d200fddc2c50feeef10c51adf5e.exe
1932	37c34bc3b886f0995b0ba57fec6d33eee5c98d200fddc2c50feeef10c51adf5e.exe
1932	37c34bc3b886f0995b0ba57fec6d33eee5c98d200fddc2c50feeef10c51adf5e.exe
1932	37c34bc3b886f0995b0ba57fec6d33eee5c98d200fddc2c50feeef10c51adf5e.exe
1932	37c34bc3b886f0995b0ba57fec6d33eee5c98d200fddc2c50feeef10c51adf5e.exe
1932	37c34bc3b886f0995b0ba57fec6d33eee5c98d200fddc2c50feeef10c51adf5e.exe
1932	37c34bc3b886f0995b0ba57fec6d33eee5c98d200fddc2c50feeef10c51adf5e.exe
1932	37c34bc3b886f0995b0ba57fec6d33eee5c98d200fddc2c50feeef10c51adf5e.exe
1932	37c34bc3b886f0995b0ba57fec6d33eee5c98d200fddc2c50feeef10c51adf5e.exe
1932	37c34bc3b886f0995b0ba57fec6d33eee5c98d200fddc2c50feeef10c51adf5e.exe
1932	37c34bc3b886f0995b0ba57fec6d33eee5c98d200fddc2c50feeef10c51adf5e.exe
1932	37c34bc3b886f0995b0ba57fec6d33eee5c98d200fddc2c50feeef10c51adf5e.exe
1932	37c34bc3b886f0995b0ba57fec6d33eee5c98d200fddc2c50feeef10c51adf5e.exe
1932	37c34bc3b886f0995b0ba57fec6d33eee5c98d200fddc2c50feeef10c51adf5e.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

37c34bc3b886f0995b0ba57fec6d33eee5c98d200fddc2c50feeef10c51adf5e.exe

pid process

1932 37c34bc3b886f0995b0ba57fec6d33eee5c98d200fddc2c50feeef10c51adf5e.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

37c34bc3b886f0995b0ba57fec6d33eee5c98d200fddc2c50feeef10c51adf5e.exe

description	pid	process	target process
PID 1932 wrote to memory of 3836	1932	37c34bc3b886f0995b0ba57fec6d33eee5c98d200fddc2c50feeef10c51adf5e.exe	GetX64BTIT.exe
PID 1932 wrote to memory of 3836	1932	37c34bc3b886f0995b0ba57fec6d33eee5c98d200fddc2c50feeef10c51adf5e.exe	GetX64BTIT.exe

C:\Users\Admin\AppData\Local\Temp\37c34bc3b886f0995b0ba57fec6d33eee5c98d200fddc2c50feeef10c51adf5e.exe
"C:\Users\Admin\AppData\Local\Temp\37c34bc3b886f0995b0ba57fec6d33eee5c98d200fddc2c50feeef10c51adf5e.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1932

C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe
"C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"
2⤵
- Executes dropped EXE
PID:3836

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Proxy

1

T1090

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe
Filesize
3KB

MD5
b4cd27f2b37665f51eb9fe685ec1d373

SHA1
7f08febf0fdb7fc9f8bf35a10fb11e7de431abe0

SHA256
91f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581

SHA512
e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\x64btit.txt
Filesize
28B

MD5
60a922c893b9d68bc6ac3774dd80b601

SHA1
e560de448452dadd8adb8bd53744789e50dbe62e

SHA256
0d58de38110e10ec1badc16e39eb03e53aed79b9a4b3fc738dbcc4379f7198bf

SHA512
05322a0f4487f3688b5bc8e9d11cc4ae025111df82499538ea3c4623a0fa44d8968e3defe72dc978efbf4359f3f36c98a140b83b7c58835bd570878a3af152b2

Download Submit
memory/1932-16-0x0000000002880000-0x0000000002946000-memory.dmp

Filesize
792KB

Download
memory/1932-45-0x0000000002880000-0x0000000002946000-memory.dmp

Filesize
792KB

Download
memory/1932-0-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/1932-5-0x0000000002880000-0x0000000002946000-memory.dmp

Filesize
792KB

Download
memory/1932-6-0x0000000002880000-0x0000000002946000-memory.dmp

Filesize
792KB

Download
memory/1932-7-0x0000000002880000-0x0000000002946000-memory.dmp

Filesize
792KB

Download
memory/1932-8-0x0000000002880000-0x0000000002946000-memory.dmp

Filesize
792KB

Download
memory/1932-2-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/1932-1-0x0000000002720000-0x00000000027D7000-memory.dmp

Filesize
732KB

Download
memory/1932-18-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/1932-4-0x0000000002880000-0x0000000002946000-memory.dmp

Filesize
792KB

Download
memory/1932-3-0x0000000002880000-0x0000000002946000-memory.dmp

Filesize
792KB

Download
memory/1932-15-0x0000000002880000-0x0000000002946000-memory.dmp

Filesize
792KB

Download
memory/1932-19-0x0000000002880000-0x0000000002946000-memory.dmp

Filesize
792KB

Download
memory/1932-21-0x0000000002720000-0x00000000027D7000-memory.dmp

Filesize
732KB

Download
memory/1932-26-0x0000000002880000-0x0000000002946000-memory.dmp

Filesize
792KB

Download
memory/1932-31-0x0000000002880000-0x0000000002946000-memory.dmp

Filesize
792KB

Download
memory/1932-33-0x0000000002880000-0x0000000002946000-memory.dmp

Filesize
792KB

Download
memory/1932-36-0x0000000002880000-0x0000000002946000-memory.dmp

Filesize
792KB

Download
memory/1932-38-0x0000000002880000-0x0000000002946000-memory.dmp

Filesize
792KB

Download
memory/1932-40-0x0000000002880000-0x0000000002946000-memory.dmp

Filesize
792KB

Download
memory/1932-42-0x0000000002880000-0x0000000002946000-memory.dmp

Filesize
792KB

Download
memory/1932-17-0x0000000002880000-0x0000000002946000-memory.dmp

Filesize
792KB

Download

Resubmissions

Analysis

Sharing