Analysis

  • max time kernel
    159s
  • max time network
    174s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220331-en
  • submitted
    08-04-2022 08:54

General

  • Target

    ac8be183acf3079cd5475f8c170a98ae.exe

  • Size

    2.9MB

  • MD5

    ac8be183acf3079cd5475f8c170a98ae

  • SHA1

    4eab4aba5e2888496a267f2e755c5fbd29a5c25d

  • SHA256

    c7ad74775251731d6ffc24878658341b5a3b3398a5480ab113f80af42eda32c3

  • SHA512

    d3c80ff0ee04ecf898a0951433bf4e1dba25a214f4b1d902bc8e0a79a1b08bacc6813cd30c40a7a3f6cd10312b49850475f61f2f33886ad2797f25c37cfa54f3

Malware Config

Extracted

Family

orcus

Botnet

old

C2

tools.3utilities.com:17650

Mutex

3e72d23ec7f64b6aab470ad129f9a745

Attributes
  • autostart_method

    TaskScheduler

  • enable_keylogger

    false

  • install_path

    %programfiles%\vcredist\vcredistapp.exe

  • reconnect_delay

    10000

  • registry_keyname

    vcredistappreg

  • taskscheduler_taskname

    vcredistappsch

  • watchdog_path

    Temp\vcredistapp.exe

Extracted

Family

44caliber

C2

https://discord.com/api/webhooks/959366883545579581/Z1Be8qUrtXUbCZydkDEnV1VMcMYEDqpAE1fFmNhN26L5vd4nrcJOGi-iQnD-msZc-BJX

Signatures

  • 44Caliber

    An open source infostealer written in C#.

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

  • Orcurs Rat Executable 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ac8be183acf3079cd5475f8c170a98ae.exe
    "C:\Users\Admin\AppData\Local\Temp\ac8be183acf3079cd5475f8c170a98ae.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4284
    • C:\Users\Admin\AppData\Local\Temp\libchrome.exe
      "C:\Users\Admin\AppData\Local\Temp\libchrome.exe"
      2⤵
      • Executes dropped EXE
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4216

Network

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Collection

Data from Local System

3
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\libchrome.exe
    Filesize

    274KB

    MD5

    f0a6137751223c932f77f1807ad0805e

    SHA1

    af5befc8e36c8c062ef96ad57e8e1a1f39a2f675

    SHA256

    2105779b2f3e3f454cea059d25484b9ef423a0318abc7c8cbe04289e393e8697

    SHA512

    c4096757420b11bc3748522202efb0d8ee1ecd09e7b773505a96124a339e40951533432d02dfbc929380f8a15160ed2911018dee56b2af7db4d6d9222e4dee4a

  • C:\Users\Admin\AppData\Local\Temp\libchrome.exe
    Filesize

    274KB

    MD5

    f0a6137751223c932f77f1807ad0805e

    SHA1

    af5befc8e36c8c062ef96ad57e8e1a1f39a2f675

    SHA256

    2105779b2f3e3f454cea059d25484b9ef423a0318abc7c8cbe04289e393e8697

    SHA512

    c4096757420b11bc3748522202efb0d8ee1ecd09e7b773505a96124a339e40951533432d02dfbc929380f8a15160ed2911018dee56b2af7db4d6d9222e4dee4a

  • memory/4216-135-0x0000000000000000-mapping.dmp
  • memory/4216-139-0x00007FFDDB810000-0x00007FFDDC2D1000-memory.dmp
    Filesize

    10.8MB

  • memory/4216-140-0x000000001BF90000-0x000000001BF92000-memory.dmp
    Filesize

    8KB

  • memory/4216-138-0x0000000000620000-0x000000000066A000-memory.dmp
    Filesize

    296KB

  • memory/4284-128-0x00000000072F0000-0x0000000007356000-memory.dmp
    Filesize

    408KB

  • memory/4284-131-0x0000000007520000-0x000000000755C000-memory.dmp
    Filesize

    240KB

  • memory/4284-132-0x0000000007700000-0x000000000780A000-memory.dmp
    Filesize

    1.0MB

  • memory/4284-133-0x00000000080E0000-0x00000000082A2000-memory.dmp
    Filesize

    1.8MB

  • memory/4284-134-0x00000000086B0000-0x0000000008700000-memory.dmp
    Filesize

    320KB

  • memory/4284-130-0x00000000074C0000-0x00000000074D2000-memory.dmp
    Filesize

    72KB

  • memory/4284-129-0x0000000007AC0000-0x00000000080D8000-memory.dmp
    Filesize

    6.1MB

  • memory/4284-124-0x0000000000D10000-0x0000000001004000-memory.dmp
    Filesize

    3.0MB

  • memory/4284-127-0x0000000006B60000-0x0000000006B6A000-memory.dmp
    Filesize

    40KB

  • memory/4284-126-0x0000000005C30000-0x0000000005CC2000-memory.dmp
    Filesize

    584KB

  • memory/4284-125-0x0000000006140000-0x00000000066E4000-memory.dmp
    Filesize

    5.6MB