Malware Analysis Report

2025-01-22 13:29

Sample ID 241123-e686psykfv
Target 495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe
SHA256 495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e
Tags
osiris banker botnet discovery
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e

Threat Level: Known bad

The file 495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe was found to be: Known bad.

Malicious Activity Summary

osiris banker botnet discovery

Osiris

Osiris family

Executes dropped EXE

Loads dropped DLL

Uses Tor communications

Looks up external IP address via web service

Suspicious use of SetThreadContext

System Location Discovery: System Language Discovery

Unsigned PE

Program crash

Enumerates physical storage devices

NSIS installer

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-23 04:34

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

NSIS installer

installer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-23 04:34

Reported

2024-11-23 04:36

Platform

win7-20240903-en

Max time kernel

120s

Max time network

106s

Command Line

"C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe"

Signatures

Osiris

banker botnet osiris

Osiris family

osiris

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.ipify.org N/A N/A
N/A api.ipify.org N/A N/A

Uses Tor communications

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2848 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe
PID 2848 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe
PID 2848 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe
PID 2848 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe
PID 2848 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe
PID 2848 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe
PID 2848 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe
PID 2848 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe
PID 2616 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe
PID 2616 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe
PID 2616 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe
PID 2616 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe

Processes

C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe

"C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe"

C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe

"C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe"

C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe

"C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"

Network

Country Destination Domain Proto
NL 194.109.206.212:80 tcp
CA 199.58.81.140:80 199.58.81.140 tcp
US 8.8.8.8:53 api.ipify.org udp
US 172.67.74.152:443 api.ipify.org tcp
NL 45.66.35.11:80 45.66.35.11 tcp
SG 129.126.111.54:443 tcp
US 8.8.8.8:53 time-a.nist.gov udp
US 129.6.15.28:13 time-a.nist.gov tcp
DE 193.23.244.244:80 193.23.244.244 tcp
DE 202.61.241.225:443 tcp
NL 45.66.35.11:80 45.66.35.11 tcp
NL 77.221.159.193:443 tcp

Files

\Users\Admin\AppData\Local\Temp\nsj99F0.tmp\System.dll

MD5 fccff8cb7a1067e23fd2e2b63971a8e1
SHA1 30e2a9e137c1223a78a0f7b0bf96a1c361976d91
SHA256 6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e
SHA512 f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c

memory/2616-7-0x0000000000400000-0x0000000000456000-memory.dmp

memory/2616-9-0x0000000000400000-0x0000000000456000-memory.dmp

memory/2616-10-0x0000000000400000-0x0000000000456000-memory.dmp

memory/2616-11-0x0000000000400000-0x0000000000456000-memory.dmp

memory/2616-12-0x0000000000350000-0x00000000003EF000-memory.dmp

memory/2616-14-0x0000000000350000-0x00000000003EF000-memory.dmp

memory/2616-13-0x0000000000350000-0x00000000003EF000-memory.dmp

memory/2616-16-0x0000000000350000-0x00000000003EF000-memory.dmp

memory/2616-15-0x0000000000350000-0x00000000003EF000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe

MD5 b4cd27f2b37665f51eb9fe685ec1d373
SHA1 7f08febf0fdb7fc9f8bf35a10fb11e7de431abe0
SHA256 91f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581
SHA512 e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e

C:\Users\Admin\AppData\Local\Temp\x64btit.txt

MD5 d49bdfbe3a306999e2720a8a5c465ab1
SHA1 703d76c9809fee8f80f34425231f6c1e4918d893
SHA256 d5ab8c4c0c3d96819db21050ec689c23a412cbe8eecdecccb3f2aef8c989e249
SHA512 53eab08fc53d9c8f790590b7061d5af22ebd5ea66ef84464fe3a22d39b1a435ce2eedb6c950905c4cb0eaad03f31a6691fba239f982dd6bd31aac6db9e4e8e39

memory/2616-24-0x0000000010000000-0x0000000010015000-memory.dmp

memory/2616-26-0x00000000007A0000-0x00000000007BE000-memory.dmp

memory/2616-29-0x0000000000350000-0x00000000003EF000-memory.dmp

memory/2616-28-0x0000000000350000-0x00000000003EF000-memory.dmp

memory/2616-32-0x0000000000350000-0x00000000003EF000-memory.dmp

memory/2616-33-0x0000000000350000-0x00000000003EF000-memory.dmp

memory/2616-38-0x0000000000350000-0x00000000003EF000-memory.dmp

memory/2616-43-0x0000000000350000-0x00000000003EF000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-23 04:34

Reported

2024-11-23 04:36

Platform

win10v2004-20241007-en

Max time kernel

93s

Max time network

94s

Command Line

"C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe"

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe

"C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe"

C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe

"C:\Users\Admin\AppData\Local\Temp\495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4332 -ip 4332

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4332 -s 952

Network

Country Destination Domain Proto
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 65.139.73.23.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 102.208.201.84.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\nshBF2A.tmp\System.dll

MD5 fccff8cb7a1067e23fd2e2b63971a8e1
SHA1 30e2a9e137c1223a78a0f7b0bf96a1c361976d91
SHA256 6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e
SHA512 f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c