�CgD�g�"�T�#�E�Y�W�o�O��MZ�L>�+�Ո7��8Jj�ޒAA �f7c(�e?b1~4������Lr=�["?��m�P�X5���=�tCp8c?*��C!L@���e�Z݀T�slnT�����/��r�t?W���USj������md�լ��H}��N���<�*�pƟ��������]�![��LK�(x��i���t$�kC`j�.�`�;�����6!e�w��9X�!/����V��æ��h-��'I}0sز{�������wO�lWS��72��#ʸ�Ժc���-���_�r��k�2�A�ջ�/�%G^�*�K�TD.�[��-)|��6I�^�ȪU2�ԯ��re堩߈3��.�#b�h��=ƭ?x �ۋ�ۆƷ:���� ����?F�r�C���;���Ŗ�$J���e�|�9���86�ư���5�u�n�/��7���d0K�^Vd�[��pxБ^����� ,/�}{� 8�����j�I��4fG�u�P������<�pjTmA��2NU��Dn������BYx��V�v96���,����ZZoW��@�<c������u,� ~��rNt���nF�ԊḈ�5�_��$>���P�4�3M7��o'ԧ�~���}��[E���P�\��)�|�+!�O�|� a��gI0q'IG����ga/=�s~-�c�z��ᬀ��b���$��醳��!Mz9����b[�I�2X� .K�����!)d�%�8�lb�l��[ӇQE+�$���i�*�<I;���m�%" �G�q�����&��TP��̦N�P�����Y˭����(�V�$�q�o��a�;�d��ë\��PZ�����﹕��}O`�{��*�4*�ɷ�)=U�Xoʻ�8�HS,��)��ڋ��O!B�1���@�*���NZ�ʥXS�z�.����� ��+)�Up y�����r�V���PR\<il%W�'�yr�WQs��;���2.21. u��#�V�I����素�<P����RO��uO^+)In@l$ t���HZ�{XXΛ2p�T�c��'O��ٮ�qx|��V��X�_����[R������X�Yׁx�����g�؞g����-[0�Pē����� X#ޣ3��`�'?Q3�A�n5�`\/��NDx���6|��k�6�iB�HYS �8{�)nCbQs��-�&�a�}�-�E�����]�!����[\��hQ8�n-o0*���k��J[��Q<��$�����~���R��= 1B�Rǻo<��=��������N�E��'��w�V㦼8�瞋�.��:l��r.���hv*�0�YAr��K��L3-m. o�8��tTx�4�f��Ź��T� �.��;7�0@.��ϋ� �Nk>:VB�[н̜�&�˗/ȷ��?��{��@k9p�0)U��(fE�H �<F������BAn� a�u�:�e�Mꝃ9:K@�����b��'���A�+��QhEd�8��C�����M��4�m�rm��ϩ�c�<��ǭ���~T��T?,VX���AC�5�zO���T �cs����Ё�dN��#@I}��� ��<��:P0�NN�sh�r�T�����i��V�HC;sMά�Ϡ�M6��d�j��h�5t[l���k�98? ~�g[]����7�y��q����HQ�nMճ:��'�T���k4R�G�8y���4{;/�D��n���p:Ē��&�}A�7�Ӗ��C�~K�x��8�q�/$Z����֢l�|�%��xAH��<��������"��e�ծo��� �ؾ �ۂĠ�l�|����p��ԕ�/��v��´��� >Ls��ދ�h&^�%d��#(��z�Z���?�O�g+�S��w��N#�(���뵖���~��m�kD�9vq��5�����2�Nj1�)�F�%��E8��AR��V���Jl��FU� �z���0�'�h�K�?�$�2`�w�kX{�R!�y`V ��ȕ��6��[y��=aQ/�\��h>�L\mW�>^�oZ��^�k�~��V���y#hV��E*C��Њn���T��a� ;DZ��n3Qa�D�#�.S����0'5��Ӻ2���}�` f ^�a�^�����cq���#t{��{�����,e7A����P��m��D�n�')�V�T�@�<��E�T�w`<����β9� �GS) ޢ�4��,�����$������&O��)��o>[���(�f�8?_��PR?}K� �%���a��čC����C����o �w�$�����gv�|��^?��0=��H!�ύ��7�i¥U�9��1�p`s�f2��������wd�_��{o>�h������Vw��?B��Y�a�nZ}ӫ�籉:2��u�����n��W���c1\�M�7"pc�|ۜ�nSl�$t�c�0 Ɖm !4QeO��<4�F��io}U�BN���� H�a5[e����;,�8�G��c���4<W�b�ΙĴ�܊t�2��[�6�-��m�-#���ߴ8�ˍg*5��9٣A�{dH��Ϩ Ϥ�'�x�t-P�铩�FB�|�� �wt���~�K��j�2�u�B̕+�/�vCsa�F�Mp? ����r7�a�vr)�Y�Z ��o�҂������\��_�fEش�!��0c?Ђ���t�J�6�2>|��ʝ��T�1� 9�p��G�"C�t�]�#��P���LN�%�+��P����cA�_�T܅��q&H|�J&|��'/�E�����S���3w[����6}݆��^q�N*bg^{��{���c-�W9��¬����ҵ�E��]R�ݣ>_<��~%/��M͵���'5��j� )h�W������X/�}��˭�*Z��m���\7���)���K;\S�O���v������!-�6������G��-�ئE�N��g�g����|�-���3T�0�Q�.�?YX�����H��q+����1xZ.&����t�%�j�"i�}%���l���-��e�!I�T8�"���gQ7�c�0K��a��.�=��yr�[z����#�Tط@��u)
Behavioral task
behavioral1
Sample
OSIRIS.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
OSIRIS.exe
Resource
win10v2004-20240802-en
General
-
Target
OSIRIS.exe
-
Size
5.3MB
-
MD5
d2ec628078ae49c984194958bfc051c9
-
SHA1
c8c65179dcbc816756581fe221f3bc8ec13add8a
-
SHA256
76e1df68f0b0d447bc44ff9b9ba8d28b365189729f1822d313946fe544b6b27e
-
SHA512
09c8e02c51417204a761572f30785cd615b8677d1cfac343061d47a1193d97b599d03e65cea855303f4d04a87f12391306165320417612d8faad43b6bb9ce2dc
-
SSDEEP
98304:Try36koSq7mvL/SX3z/Slf8mncmfTMRJ8BLAc3n8PaaztAyxYrOu9RqvlPhK:TpkoSq7smXjSlkOcmfgjgLAvPa7sY6wR
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource OSIRIS.exe
Files
-
OSIRIS.exe.exe windows:6 windows x64 arch:x64
dad5a8680ee9b0714d812cdc601a01d8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetCurrentProcessId
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetWindowThreadProcessId
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
advapi32
RegOpenKeyExW
shell32
ShellExecuteExW
msvcp140
_Cnd_broadcast
urlmon
URLDownloadToFileW
wininet
InternetOpenUrlA
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memcpy
api-ms-win-crt-stdio-l1-1-0
fgetpos
api-ms-win-crt-runtime-l1-1-0
_get_initial_narrow_environment
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-string-l1-1-0
_wcsicmp
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 49KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 225KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.3MB - Virtual size: 5.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 200B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ