Overview

overview

10

Static

static

10

b7756f9d9e...ae.exe

windows7-x64

1

b7756f9d9e...ae.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b7756f9d9e8c5f4ba2c930adb666fbae.exe

  • Size

    100KB

  • Sample

    221019-h4yhzafaa6

  • MD5

    b7756f9d9e8c5f4ba2c930adb666fbae

  • SHA1

    8ddb9f2a559f6af5ccaa04c8b5b589d216357340

  • SHA256

    57e85409564bed14d33d2ae2663b2bc64f99588c83b208f9091eceaf87097c1b

  • SHA512

    c5c85c86251c34530b672de0feee38bd148cddd53beb7191a250f09e6d504460c343a0f608e2002434e4b98585e61222f44bc159bfb2a340c0e73a3941bef67f

  • SSDEEP

    1536:DQIAibOVOk3udovOyePC9Eop2h90L64QG9iDCzPgQD8Kg90a//MudDBG:DQ/ibOcIudovOy8CUwIOkCzgQq0UzxM

Score
10/10
orcusplaguebotbotnetevasionpersistenceratspywarestealertrojan

Malware Config

Extracted

Family

orcus

C2

146.70.143.176:81

Mutex

712d31c7a3f54904a08d968a15b836e9

Attributes
  • autostart_method

    Registry

  • enable_keylogger

    false

  • install_path

    %programfiles%\orc\orc.exe

  • reconnect_delay

    10000

  • registry_keyname

    orc

  • taskscheduler_taskname

    orc

  • watchdog_path

    AppData\Watchdog.exe

Targets

    • Target

      b7756f9d9e8c5f4ba2c930adb666fbae.exe

    • Size

      100KB

    • MD5

      b7756f9d9e8c5f4ba2c930adb666fbae

    • SHA1

      8ddb9f2a559f6af5ccaa04c8b5b589d216357340

    • SHA256

      57e85409564bed14d33d2ae2663b2bc64f99588c83b208f9091eceaf87097c1b

    • SHA512

      c5c85c86251c34530b672de0feee38bd148cddd53beb7191a250f09e6d504460c343a0f608e2002434e4b98585e61222f44bc159bfb2a340c0e73a3941bef67f

    • SSDEEP

      1536:DQIAibOVOk3udovOyePC9Eop2h90L64QG9iDCzPgQD8Kg90a//MudDBG:DQ/ibOcIudovOy8CUwIOkCzgQq0UzxM

    Score
    10/10
    orcusplaguebotbotnetevasionpersistenceratspywarestealertrojan

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Modifies security service

      evasion

    • Orcus

      Orcus is a Remote Access Trojan that is being sold on underground forums.

      ratspywarestealerorcus

    • Orcus main payload

    • PlagueBot

      PlagueBot is an open source Bot written in Pascal.

      botnetplaguebot

    • Orcurs Rat Executable

    • PlagueBot Executable

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Modify Existing Service

2
T1031

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

4
T1112

Disabling Security Tools

2
T1089

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks