Analysis
-
max time kernel
150s -
max time network
157s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
29-06-2021 07:12
General
-
Target
25BE4FB3B1C478E02194503047AC838A.exe
-
Size
911KB
-
MD5
25be4fb3b1c478e02194503047ac838a
-
SHA1
a4223aa801bae210d077ea9c30835bdd3a82aa22
-
SHA256
28506529f97de0d6a877427c102e62425f63c764dd2d55f4510dcc5d49335085
-
SHA512
67cf89cd1d3592044d878f4876a2f7a2a2e8412ec13c16b977b2ba8512cd94970c8058479e39c436691d1c95f3c795feb9ce464cbb4923bf8e12b74c03f71df6
Malware Config
Extracted
orcus
74.201.28.60:4296
Hysteria4
-
autostart_method
Registry
-
enable_keylogger
false
-
install_path
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\O\WindowsUserApplicationData.exe
-
reconnect_delay
10000
-
registry_keyname
Hysteria
-
taskscheduler_taskname
Hysteria
-
watchdog_path
AppData\WindowsUserApplicationData.exe
Signatures
-
Orcus
Orcus is a Remote Access Trojan that is being sold on underground forums.
-
Orcus Main Payload 3 IoCs
-
Orcurs Rat Executable 3 IoCs
-
Executes dropped EXE 4 IoCs
-
Drops startup file 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\25BE4FB3B1C478E02194503047AC838A.exe"C:\Users\Admin\AppData\Local\Temp\25BE4FB3B1C478E02194503047AC838A.exe"1⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\O\WindowsUserApplicationData.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\O\WindowsUserApplicationData.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\WindowsUserApplicationData.exe"C:\Users\Admin\AppData\Roaming\WindowsUserApplicationData.exe" /launchSelfAndExit "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\O\WindowsUserApplicationData.exe" 39443⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\WindowsUserApplicationData.exe"C:\Users\Admin\AppData\Roaming\WindowsUserApplicationData.exe" /watchProcess "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\O\WindowsUserApplicationData.exe" 39444⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\O\WindowsUserApplicationData.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\O\WindowsUserApplicationData.exe"1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
360KB
-
Filesize
48KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
48KB
-
Filesize
8KB
-
Filesize
84KB
-
Filesize
288KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB