Overview

overview

10

Static

static

10

a71f91351d...54.exe

windows7_x64

10

a71f91351d...54.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a71f91351dc1bb57f0426080f2c03854.exe

  • Size

    8.4MB

  • Sample

    210717-98tnta93m2

  • MD5

    a71f91351dc1bb57f0426080f2c03854

  • SHA1

    a336bd9298b0772f4d5764f695335fc7ef99755b

  • SHA256

    f95e19a66cb1e3a612f2c07380376196e856dfefbe1038c4e6fd7d6a03388b5d

  • SHA512

    dff5db2f6b3af11d10cb25c6e9df6df5bd4668ff54ba4ff1b6456ee7ab338e59297bad4d8722e7da15d175eabcd5833a632e5d62970d04993c733c379b7f4d19

Score
10/10
asyncratorcusxmrignewvprefinaldiscoveryevasionminerpyinstallerratspywarestealer

Malware Config

Extracted

Family

orcus

Botnet

NewVPREFinal

C2

67.242.2.35:10134

Mutex

8185e643b7514e15b8dcfc7df7a8733b

Attributes
  • autostart_method

    TaskScheduler

  • enable_keylogger

    true

  • install_path

    %systemroot%\lsddsds\lsdds.exe

  • reconnect_delay

    10000

  • registry_keyname

    lsd

  • taskscheduler_taskname

    lsdds

  • watchdog_path

    Temp\olsdd.exe

Targets

    • Target

      a71f91351dc1bb57f0426080f2c03854.exe

    • Size

      8.4MB

    • MD5

      a71f91351dc1bb57f0426080f2c03854

    • SHA1

      a336bd9298b0772f4d5764f695335fc7ef99755b

    • SHA256

      f95e19a66cb1e3a612f2c07380376196e856dfefbe1038c4e6fd7d6a03388b5d

    • SHA512

      dff5db2f6b3af11d10cb25c6e9df6df5bd4668ff54ba4ff1b6456ee7ab338e59297bad4d8722e7da15d175eabcd5833a632e5d62970d04993c733c379b7f4d19

    Score
    10/10
    asyncratorcusxmrignewvprefinaldiscoveryevasionminerpyinstallerratspywarestealer

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

      ratasyncrat

    • Orcus

      Orcus is a Remote Access Trojan that is being sold on underground forums.

      ratspywarestealerorcus

    • Orcus Main Payload

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • Looks for VirtualBox Guest Additions in registry

      evasion

    • Orcurs Rat Executable

    • XMRig Miner Payload

      miner

    • Executes dropped EXE

    • Looks for VMWare Tools registry key

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops desktop.ini file(s)

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Virtualization/Sandbox Evasion

2
T1497

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

8
T1012

Virtualization/Sandbox Evasion

2
T1497

System Information Discovery

6
T1082

Peripheral Device Discovery

2
T1120

Remote System Discovery

1
T1018

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Tasks