Analysis
-
max time kernel
24s -
max time network
139s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
31-07-2021 09:03
Static task
static1
Behavioral task
behavioral1
Sample
BDCA302A43DFD30F874CE13B2A20F4211E7BD88EBA40A.exe
Resource
win7v20210410
General
-
Target
BDCA302A43DFD30F874CE13B2A20F4211E7BD88EBA40A.exe
-
Size
789KB
-
MD5
75e95a530e5fe926bcca7c2c1a008e18
-
SHA1
ff759b9abdd18c05b51509f92146a801f3fae939
-
SHA256
bdca302a43dfd30f874ce13b2a20f4211e7bd88eba40a0c41f30873389133d3d
-
SHA512
ad2cc5878b248cda26e5464dea496ea67ddd9bdf120c56dceee2581a167ae0771d19b68c19b62f4c487d045b0680c7d3892ba8aa99023e93b6391ea8d49821da
Malware Config
Extracted
orcus
$
lsdw.dyndns.org:10134
bad69595827c48b5b9b2ea99aaff68b6
-
autostart_method
Disable
-
enable_keylogger
true
-
install_path
%programfiles%\Orcus\Orcus.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
Orcus
-
watchdog_path
AppData\OrcusWatchdog.exe
Signatures
-
Orcurs Rat Executable 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1976-79-0x0000000004E80000-0x0000000004F62000-memory.dmp orcus -
Processes:
mydoc.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mydoc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mydoc.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
BDCA302A43DFD30F874CE13B2A20F4211E7BD88EBA40A.exemydoc.exepid process 2004 BDCA302A43DFD30F874CE13B2A20F4211E7BD88EBA40A.exe 2004 BDCA302A43DFD30F874CE13B2A20F4211E7BD88EBA40A.exe 1976 mydoc.exe 1976 mydoc.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
BDCA302A43DFD30F874CE13B2A20F4211E7BD88EBA40A.exepid process 2004 BDCA302A43DFD30F874CE13B2A20F4211E7BD88EBA40A.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
BDCA302A43DFD30F874CE13B2A20F4211E7BD88EBA40A.exemydoc.exedescription pid process Token: SeDebugPrivilege 2004 BDCA302A43DFD30F874CE13B2A20F4211E7BD88EBA40A.exe Token: SeDebugPrivilege 1976 mydoc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
mydoc.exepid process 1976 mydoc.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
BDCA302A43DFD30F874CE13B2A20F4211E7BD88EBA40A.execmd.exemydoc.execmd.execmd.exedescription pid process target process PID 2004 wrote to memory of 1988 2004 BDCA302A43DFD30F874CE13B2A20F4211E7BD88EBA40A.exe cmd.exe PID 2004 wrote to memory of 1988 2004 BDCA302A43DFD30F874CE13B2A20F4211E7BD88EBA40A.exe cmd.exe PID 2004 wrote to memory of 1988 2004 BDCA302A43DFD30F874CE13B2A20F4211E7BD88EBA40A.exe cmd.exe PID 2004 wrote to memory of 1988 2004 BDCA302A43DFD30F874CE13B2A20F4211E7BD88EBA40A.exe cmd.exe PID 1988 wrote to memory of 1976 1988 cmd.exe mydoc.exe PID 1988 wrote to memory of 1976 1988 cmd.exe mydoc.exe PID 1988 wrote to memory of 1976 1988 cmd.exe mydoc.exe PID 1988 wrote to memory of 1976 1988 cmd.exe mydoc.exe PID 1976 wrote to memory of 1092 1976 mydoc.exe cmd.exe PID 1976 wrote to memory of 1092 1976 mydoc.exe cmd.exe PID 1976 wrote to memory of 1092 1976 mydoc.exe cmd.exe PID 1976 wrote to memory of 1092 1976 mydoc.exe cmd.exe PID 1092 wrote to memory of 1932 1092 cmd.exe schtasks.exe PID 1092 wrote to memory of 1932 1092 cmd.exe schtasks.exe PID 1092 wrote to memory of 1932 1092 cmd.exe schtasks.exe PID 1092 wrote to memory of 1932 1092 cmd.exe schtasks.exe PID 1976 wrote to memory of 396 1976 mydoc.exe cmd.exe PID 1976 wrote to memory of 396 1976 mydoc.exe cmd.exe PID 1976 wrote to memory of 396 1976 mydoc.exe cmd.exe PID 1976 wrote to memory of 396 1976 mydoc.exe cmd.exe PID 396 wrote to memory of 676 396 cmd.exe schtasks.exe PID 396 wrote to memory of 676 396 cmd.exe schtasks.exe PID 396 wrote to memory of 676 396 cmd.exe schtasks.exe PID 396 wrote to memory of 676 396 cmd.exe schtasks.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
mydoc.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mydoc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\BDCA302A43DFD30F874CE13B2A20F4211E7BD88EBA40A.exe"C:\Users\Admin\AppData\Local\Temp\BDCA302A43DFD30F874CE13B2A20F4211E7BD88EBA40A.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Videos\show\mydoc.exe"C:\Users\Admin\Videos\show\mydoc.exe"3⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\cmd.exe"cmd"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /Delete /TN "Update\doc" /F5⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /Create /TN "Update\doc" /XML "C:\Users\Admin\AppData\Local\Temp\1495591141.xml"5⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\1495591141.xmlMD5
a2f97ef554c429c58245ff42fa5e4ef6
SHA19df8ae57be64a8780b234d42c3a694590cde4ea8
SHA2567fa6d2e40b2ddfd08e5c8db640fe27e5cbbbb057a8810ea3c6bfd2ee681de91b
SHA512d3a81274099f39fc6b01b3422d992731de42eec57a5c2b08285516cf4c7a543675db12595af3d0c1d5d3bdf47ce1d482452f3fb41c35a80b24c8a3ebd3ca3ee5
-
memory/396-75-0x0000000000000000-mapping.dmp
-
memory/676-76-0x0000000000000000-mapping.dmp
-
memory/1092-73-0x0000000000000000-mapping.dmp
-
memory/1932-74-0x0000000000000000-mapping.dmp
-
memory/1976-78-0x0000000004CE0000-0x0000000004CE1000-memory.dmpFilesize
4KB
-
memory/1976-80-0x0000000000370000-0x000000000037C000-memory.dmpFilesize
48KB
-
memory/1976-67-0x0000000000000000-mapping.dmp
-
memory/1976-84-0x0000000000550000-0x000000000055C000-memory.dmpFilesize
48KB
-
memory/1976-83-0x00000000004D0000-0x00000000004E5000-memory.dmpFilesize
84KB
-
memory/1976-82-0x0000000000460000-0x0000000000470000-memory.dmpFilesize
64KB
-
memory/1976-81-0x0000000002140000-0x000000000219A000-memory.dmpFilesize
360KB
-
memory/1976-79-0x0000000004E80000-0x0000000004F62000-memory.dmpFilesize
904KB
-
memory/1988-65-0x0000000000000000-mapping.dmp
-
memory/2004-64-0x0000000000300000-0x0000000000304000-memory.dmpFilesize
16KB
-
memory/2004-60-0x0000000000970000-0x0000000000971000-memory.dmpFilesize
4KB
-
memory/2004-62-0x0000000004B90000-0x0000000004C3C000-memory.dmpFilesize
688KB
-
memory/2004-63-0x0000000007160000-0x0000000007211000-memory.dmpFilesize
708KB
-
memory/2004-66-0x0000000004C60000-0x0000000004C61000-memory.dmpFilesize
4KB