Analysis
-
max time kernel
120s -
max time network
106s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
23-11-2024 04:34
General
-
Target
495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe
-
Size
527KB
-
MD5
6b5d0cd96161a9234da0222c6de4a1cc
-
SHA1
d5707598973611a4d797a69efd5b977f0360b04b
-
SHA256
495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e
-
SHA512
d9665205dc1be22676e0de33b378e83aaddb8f77256d4ee91f35569b2d51c77d9c6d26ea2b5352119103fa4c82c34c283326dd8b53833de1985f17241db0f1cf
-
SSDEEP
6144:m9X0GPt/p90FOKWU3TDPTuU4ldQZ7OTcaYEQSh9Ty0y6c4H3yEDFDQMb6Ph0VA4z:I02PWw9C6hlSZ6g2G0yKHp1VbWabfBnD
Malware Config
Signatures
-
Osiris
-
Osiris family
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe"C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe"C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"3⤵
- Executes dropped EXE
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5b4cd27f2b37665f51eb9fe685ec1d373
SHA17f08febf0fdb7fc9f8bf35a10fb11e7de431abe0
SHA25691f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581
SHA512e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e
-
Filesize
28B
MD5d49bdfbe3a306999e2720a8a5c465ab1
SHA1703d76c9809fee8f80f34425231f6c1e4918d893
SHA256d5ab8c4c0c3d96819db21050ec689c23a412cbe8eecdecccb3f2aef8c989e249
SHA51253eab08fc53d9c8f790590b7061d5af22ebd5ea66ef84464fe3a22d39b1a435ce2eedb6c950905c4cb0eaad03f31a6691fba239f982dd6bd31aac6db9e4e8e39
-
Filesize
11KB
MD5fccff8cb7a1067e23fd2e2b63971a8e1
SHA130e2a9e137c1223a78a0f7b0bf96a1c361976d91
SHA2566fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e
SHA512f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c
-
Filesize
636KB
-
Filesize
84KB
-
Filesize
344KB
-
Filesize
636KB
-
Filesize
636KB
-
Filesize
636KB
-
Filesize
636KB
-
Filesize
344KB
-
Filesize
344KB
-
Filesize
344KB
-
Filesize
120KB
-
Filesize
636KB
-
Filesize
636KB
-
Filesize
636KB
-
Filesize
636KB
-
Filesize
636KB
-
Filesize
636KB