Analysis
-
max time kernel
27s -
max time network
148s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
31-07-2021 09:03
Static task
static1
Behavioral task
behavioral1
Sample
BDCA302A43DFD30F874CE13B2A20F4211E7BD88EBA40A.exe
Resource
win7v20210410
General
-
Target
BDCA302A43DFD30F874CE13B2A20F4211E7BD88EBA40A.exe
-
Size
789KB
-
MD5
75e95a530e5fe926bcca7c2c1a008e18
-
SHA1
ff759b9abdd18c05b51509f92146a801f3fae939
-
SHA256
bdca302a43dfd30f874ce13b2a20f4211e7bd88eba40a0c41f30873389133d3d
-
SHA512
ad2cc5878b248cda26e5464dea496ea67ddd9bdf120c56dceee2581a167ae0771d19b68c19b62f4c487d045b0680c7d3892ba8aa99023e93b6391ea8d49821da
Malware Config
Extracted
orcus
$
lsdw.dyndns.org:10134
bad69595827c48b5b9b2ea99aaff68b6
-
autostart_method
Disable
-
enable_keylogger
true
-
install_path
%programfiles%\Orcus\Orcus.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
Orcus
-
watchdog_path
AppData\OrcusWatchdog.exe
Signatures
-
Orcurs Rat Executable 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2268-136-0x00000000055A0000-0x0000000005682000-memory.dmp orcus -
Processes:
mydoc.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mydoc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mydoc.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
BDCA302A43DFD30F874CE13B2A20F4211E7BD88EBA40A.exemydoc.exepid process 808 BDCA302A43DFD30F874CE13B2A20F4211E7BD88EBA40A.exe 808 BDCA302A43DFD30F874CE13B2A20F4211E7BD88EBA40A.exe 2268 mydoc.exe 2268 mydoc.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
BDCA302A43DFD30F874CE13B2A20F4211E7BD88EBA40A.exepid process 808 BDCA302A43DFD30F874CE13B2A20F4211E7BD88EBA40A.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
BDCA302A43DFD30F874CE13B2A20F4211E7BD88EBA40A.exemydoc.exedescription pid process Token: SeDebugPrivilege 808 BDCA302A43DFD30F874CE13B2A20F4211E7BD88EBA40A.exe Token: SeDebugPrivilege 2268 mydoc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
mydoc.exepid process 2268 mydoc.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
BDCA302A43DFD30F874CE13B2A20F4211E7BD88EBA40A.execmd.exemydoc.execmd.execmd.exedescription pid process target process PID 808 wrote to memory of 3736 808 BDCA302A43DFD30F874CE13B2A20F4211E7BD88EBA40A.exe cmd.exe PID 808 wrote to memory of 3736 808 BDCA302A43DFD30F874CE13B2A20F4211E7BD88EBA40A.exe cmd.exe PID 808 wrote to memory of 3736 808 BDCA302A43DFD30F874CE13B2A20F4211E7BD88EBA40A.exe cmd.exe PID 3736 wrote to memory of 2268 3736 cmd.exe mydoc.exe PID 3736 wrote to memory of 2268 3736 cmd.exe mydoc.exe PID 3736 wrote to memory of 2268 3736 cmd.exe mydoc.exe PID 2268 wrote to memory of 2640 2268 mydoc.exe cmd.exe PID 2268 wrote to memory of 2640 2268 mydoc.exe cmd.exe PID 2268 wrote to memory of 2640 2268 mydoc.exe cmd.exe PID 2640 wrote to memory of 208 2640 cmd.exe schtasks.exe PID 2640 wrote to memory of 208 2640 cmd.exe schtasks.exe PID 2640 wrote to memory of 208 2640 cmd.exe schtasks.exe PID 2268 wrote to memory of 3468 2268 mydoc.exe cmd.exe PID 2268 wrote to memory of 3468 2268 mydoc.exe cmd.exe PID 2268 wrote to memory of 3468 2268 mydoc.exe cmd.exe PID 3468 wrote to memory of 1448 3468 cmd.exe schtasks.exe PID 3468 wrote to memory of 1448 3468 cmd.exe schtasks.exe PID 3468 wrote to memory of 1448 3468 cmd.exe schtasks.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
mydoc.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mydoc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\BDCA302A43DFD30F874CE13B2A20F4211E7BD88EBA40A.exe"C:\Users\Admin\AppData\Local\Temp\BDCA302A43DFD30F874CE13B2A20F4211E7BD88EBA40A.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Videos\show\mydoc.exe"C:\Users\Admin\Videos\show\mydoc.exe"3⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\cmd.exe"cmd"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /Delete /TN "Update\doc" /F5⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /Create /TN "Update\doc" /XML "C:\Users\Admin\AppData\Local\Temp\2029615973.xml"5⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\2029615973.xmlMD5
fdd69428aa77b311dc8a1f6c375514ad
SHA14a36e515b36a24251dd1efe42686c64d553a9542
SHA2566b4c638ca3ff660e43475a387ca57358e6b023b202c9c5e9b6cc15e180b988cf
SHA512be738cc2b1e03d1963ef2333aa49c69aad6c5c1872b267970a47a1201132f22b04b8f5e9734afdfac192615a52fd5c6950061ad88c565610911f5b098c5fc604
-
memory/208-132-0x0000000000000000-mapping.dmp
-
memory/808-116-0x0000000004F90000-0x0000000004F91000-memory.dmpFilesize
4KB
-
memory/808-117-0x0000000005530000-0x0000000005531000-memory.dmpFilesize
4KB
-
memory/808-118-0x0000000005220000-0x00000000052CC000-memory.dmpFilesize
688KB
-
memory/808-119-0x0000000005400000-0x00000000054B1000-memory.dmpFilesize
708KB
-
memory/808-120-0x0000000005030000-0x000000000552E000-memory.dmpFilesize
5.0MB
-
memory/808-121-0x00000000028D0000-0x00000000028D4000-memory.dmpFilesize
16KB
-
memory/808-114-0x00000000006E0000-0x00000000006E1000-memory.dmpFilesize
4KB
-
memory/1448-134-0x0000000000000000-mapping.dmp
-
memory/2268-143-0x0000000006120000-0x0000000006121000-memory.dmpFilesize
4KB
-
memory/2268-141-0x0000000005D80000-0x0000000005D90000-memory.dmpFilesize
64KB
-
memory/2268-151-0x0000000007360000-0x0000000007361000-memory.dmpFilesize
4KB
-
memory/2268-123-0x0000000000000000-mapping.dmp
-
memory/2268-136-0x00000000055A0000-0x0000000005682000-memory.dmpFilesize
904KB
-
memory/2268-137-0x0000000004B90000-0x0000000004B9C000-memory.dmpFilesize
48KB
-
memory/2268-138-0x0000000004AA0000-0x0000000004F9E000-memory.dmpFilesize
5.0MB
-
memory/2268-139-0x0000000005790000-0x00000000057EA000-memory.dmpFilesize
360KB
-
memory/2268-140-0x0000000005890000-0x0000000005891000-memory.dmpFilesize
4KB
-
memory/2268-150-0x0000000004C60000-0x0000000004C61000-memory.dmpFilesize
4KB
-
memory/2268-142-0x0000000005D90000-0x0000000005DA5000-memory.dmpFilesize
84KB
-
memory/2268-149-0x0000000006440000-0x0000000006441000-memory.dmpFilesize
4KB
-
memory/2268-144-0x0000000005F20000-0x0000000005F2C000-memory.dmpFilesize
48KB
-
memory/2268-145-0x00000000062F0000-0x00000000062F1000-memory.dmpFilesize
4KB
-
memory/2268-146-0x00000000071E0000-0x00000000071E1000-memory.dmpFilesize
4KB
-
memory/2268-147-0x0000000007D00000-0x0000000007D01000-memory.dmpFilesize
4KB
-
memory/2268-148-0x0000000004C40000-0x0000000004C41000-memory.dmpFilesize
4KB
-
memory/2640-131-0x0000000000000000-mapping.dmp
-
memory/3468-133-0x0000000000000000-mapping.dmp
-
memory/3736-122-0x0000000000000000-mapping.dmp