Analysis
- max time kernel
149s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-en-20220112 - submitted
18/02/2022, 17:46
Static task
static1
Behavioral task
behavioral1
Sample
b24c7f70337242e9b04e6f7a03f420fb.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
- Target b24c7f70337242e9b04e6f7a03f420fb.exe
- Size 727KB
- Sample220218-wcb3jsdfbp
- SHA256 e877ee10428a6a81a83caaa9222466efbc4635a719613d63f813d8dc49baef8f
- MD5 b24c7f70337242e9b04e6f7a03f420fb
- SHA1 fe5cc9871ae75de0e96103fd072987d18ea6e2ec
- SHA512 8c93dfbb2eea4ab607eec78a07946ede22df0befdfd18a646dc1728380771246d87a3a1d978ef8ed238d630273595e6e01ac397ad5f6fd3dc096c61a1bc09c7a
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
orcus
Botnet
-
NEW
C2
-
122.186.23.243:10134
Mutex
-
c7798e5973374c92859ce651077d0576
Attributes
-
autostart_method
Registry
-
enable_keylogger
true
-
install_path
%windir%\Desktop Window Manager.exe
-
reconnect_delay
10000
-
registry_keyname
Program
-
taskscheduler_taskname
Windows
-
watchdog_path
AppData\OrcusWatchdog.exe
Signatures
- Orcus Main Payload 4 IoCs
resource yara_rule behavioral2/files/0x000500000001ed3f-133.dat family_orcus behavioral2/files/0x000500000001ed3f-132.dat family_orcus behavioral2/files/0x00070000000220ea-145.dat family_orcus behavioral2/files/0x00070000000220ea-148.dat family_orcus - Orcurs Rat Executable 5 IoCs
resource yara_rule behavioral2/files/0x000500000001ed3f-133.dat orcus behavioral2/files/0x000500000001ed3f-132.dat orcus behavioral2/memory/1528-135-0x00000000007F0000-0x00000000008D8000-memory.dmp orcus behavioral2/files/0x00070000000220ea-145.dat orcus behavioral2/files/0x00070000000220ea-148.dat orcus - Executes dropped EXE 3 IoCs
pid Process 1340 Mass.exe 1528 Desktop Window Manager.exe 2788 Desktop Window Manager.exe - Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation Desktop Window Manager.exe Key value queried \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation b24c7f70337242e9b04e6f7a03f420fb.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Program = "\"C:\\Windows\\Desktop Window Manager.exe\"" Desktop Window Manager.exe - Drops file in Windows directory 6 IoCs
description ioc Process File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File created C:\Windows\Desktop Window Manager.exe Desktop Window Manager.exe File opened for modification C:\Windows\Desktop Window Manager.exe Desktop Window Manager.exe File created C:\Windows\Desktop Window Manager.exe.config Desktop Window Manager.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MusNotifyIcon.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MusNotifyIcon.exe - Modifies data under HKEY_USERS 51 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "8.208779" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4072" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132898563964775715" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "10.001780" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.000000" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4364" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4160" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "3.846082" svchost.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2788 Desktop Window Manager.exe Token: SeSecurityPrivilege 2172 TiWorker.exe Token: SeRestorePrivilege 2172 TiWorker.exe Token: SeBackupPrivilege 2172 TiWorker.exe Token: SeBackupPrivilege 2172 TiWorker.exe Token: SeRestorePrivilege 2172 TiWorker.exe Token: SeSecurityPrivilege 2172 TiWorker.exe Token: SeBackupPrivilege 2172 TiWorker.exe Token: SeRestorePrivilege 2172 TiWorker.exe Token: SeSecurityPrivilege 2172 TiWorker.exe Token: SeBackupPrivilege 2172 TiWorker.exe Token: SeRestorePrivilege 2172 TiWorker.exe Token: SeSecurityPrivilege 2172 TiWorker.exe Token: SeBackupPrivilege 2172 TiWorker.exe Token: SeRestorePrivilege 2172 TiWorker.exe Token: SeSecurityPrivilege 2172 TiWorker.exe Token: SeBackupPrivilege 2172 TiWorker.exe Token: SeRestorePrivilege 2172 TiWorker.exe Token: SeSecurityPrivilege 2172 TiWorker.exe Token: SeBackupPrivilege 2172 TiWorker.exe Token: SeRestorePrivilege 2172 TiWorker.exe Token: SeSecurityPrivilege 2172 TiWorker.exe Token: SeBackupPrivilege 2172 TiWorker.exe Token: SeRestorePrivilege 2172 TiWorker.exe Token: SeSecurityPrivilege 2172 TiWorker.exe Token: SeBackupPrivilege 2172 TiWorker.exe Token: SeRestorePrivilege 2172 TiWorker.exe Token: SeSecurityPrivilege 2172 TiWorker.exe Token: SeBackupPrivilege 2172 TiWorker.exe Token: SeRestorePrivilege 2172 TiWorker.exe Token: SeSecurityPrivilege 2172 TiWorker.exe Token: SeBackupPrivilege 2172 TiWorker.exe Token: SeRestorePrivilege 2172 TiWorker.exe Token: SeSecurityPrivilege 2172 TiWorker.exe Token: SeBackupPrivilege 2172 TiWorker.exe Token: SeRestorePrivilege 2172 TiWorker.exe Token: SeSecurityPrivilege 2172 TiWorker.exe Token: SeBackupPrivilege 2172 TiWorker.exe Token: SeRestorePrivilege 2172 TiWorker.exe Token: SeSecurityPrivilege 2172 TiWorker.exe Token: SeBackupPrivilege 2172 TiWorker.exe Token: SeRestorePrivilege 2172 TiWorker.exe Token: SeSecurityPrivilege 2172 TiWorker.exe Token: SeBackupPrivilege 2172 TiWorker.exe Token: SeRestorePrivilege 2172 TiWorker.exe Token: SeSecurityPrivilege 2172 TiWorker.exe Token: SeBackupPrivilege 2172 TiWorker.exe Token: SeRestorePrivilege 2172 TiWorker.exe Token: SeSecurityPrivilege 2172 TiWorker.exe Token: SeBackupPrivilege 2172 TiWorker.exe Token: SeRestorePrivilege 2172 TiWorker.exe Token: SeSecurityPrivilege 2172 TiWorker.exe Token: SeBackupPrivilege 2172 TiWorker.exe Token: SeRestorePrivilege 2172 TiWorker.exe Token: SeSecurityPrivilege 2172 TiWorker.exe Token: SeBackupPrivilege 2172 TiWorker.exe Token: SeRestorePrivilege 2172 TiWorker.exe Token: SeSecurityPrivilege 2172 TiWorker.exe Token: SeBackupPrivilege 2172 TiWorker.exe Token: SeRestorePrivilege 2172 TiWorker.exe Token: SeSecurityPrivilege 2172 TiWorker.exe Token: SeBackupPrivilege 2172 TiWorker.exe Token: SeRestorePrivilege 2172 TiWorker.exe Token: SeSecurityPrivilege 2172 TiWorker.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2788 Desktop Window Manager.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3716 wrote to memory of 1340 3716 b24c7f70337242e9b04e6f7a03f420fb.exe 59 PID 3716 wrote to memory of 1340 3716 b24c7f70337242e9b04e6f7a03f420fb.exe 59 PID 3716 wrote to memory of 1340 3716 b24c7f70337242e9b04e6f7a03f420fb.exe 59 PID 3716 wrote to memory of 1528 3716 b24c7f70337242e9b04e6f7a03f420fb.exe 60 PID 3716 wrote to memory of 1528 3716 b24c7f70337242e9b04e6f7a03f420fb.exe 60 PID 3716 wrote to memory of 1528 3716 b24c7f70337242e9b04e6f7a03f420fb.exe 60 PID 1528 wrote to memory of 2788 1528 Desktop Window Manager.exe 61 PID 1528 wrote to memory of 2788 1528 Desktop Window Manager.exe 61 PID 1528 wrote to memory of 2788 1528 Desktop Window Manager.exe 61
Processes
-
C:\Users\Admin\AppData\Local\Temp\b24c7f70337242e9b04e6f7a03f420fb.exe"C:\Users\Admin\AppData\Local\Temp\b24c7f70337242e9b04e6f7a03f420fb.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\Mass.exe"C:\Users\Admin\AppData\Local\Temp\Mass.exe"2⤵
- Executes dropped EXE
PID:1340
-
-
C:\Users\Admin\AppData\Local\Temp\Desktop Window Manager.exe"C:\Users\Admin\AppData\Local\Temp\Desktop Window Manager.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Windows\Desktop Window Manager.exe"C:\Windows\Desktop Window Manager.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2788
-
-
-
C:\Windows\system32\MusNotifyIcon.exe%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 131⤵
- Checks processor information in registry
PID:3748
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:1552
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2172