orcus | b76b69c16976ae70838529ce9dac1246c46fe6e97eb0e22cef7d71db759955b9

General

Target

hxload_protected.exe
Size

2.2MB
MD5

42b1cc47f577e373137d1637706778e0
SHA1

17408414e4ca34997f6b3cfbe2258657b286b57c
SHA256

b76b69c16976ae70838529ce9dac1246c46fe6e97eb0e22cef7d71db759955b9
SHA512

d29a4a1c260ef32d8355c6fecf8ea9a6dc620db1d191bc65161637b8e97fc98ad36a454a70b4b221927b7bae19468d438ba2f8246eb8b81cdfd251704cdeb167
SSDEEP

49152:lUhxXwlHSuMTX/Dx3y0bPj/4jGsyLJCjQRCHV:CTX4SuMD/zj/cGscO

Score

10^/10

orcus rat spyware stealer

Malware Config

Signatures

Orcus
Orcus is a Remote Access Trojan that is being sold on underground forums.
rat spyware stealer orcus

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\Control Panel\International\Geo\Nation	hxload_protected.exe

Executes dropped EXE 2 IoCs

pid	Process
4184	checkmsc.exe
3304	checkmsc.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

pid	Process
3656	hxload_protected.exe
4184	checkmsc.exe
3304	checkmsc.exe
4184	checkmsc.exe
3304	checkmsc.exe
4184	checkmsc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3656	hxload_protected.exe
Token: SeDebugPrivilege	4184	checkmsc.exe
Token: SeDebugPrivilege	3304	checkmsc.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3656	hxload_protected.exe
4184	checkmsc.exe
3304	checkmsc.exe
4184	checkmsc.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3656 wrote to memory of 4184	3656	hxload_protected.exe	88
PID 3656 wrote to memory of 4184	3656	hxload_protected.exe	88
PID 3656 wrote to memory of 4184	3656	hxload_protected.exe	88

C:\Users\Admin\AppData\Local\Temp\hxload_protected.exe
"C:\Users\Admin\AppData\Local\Temp\hxload_protected.exe"
1⤵
- Checks computer location settings
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3656
- C:\Users\Admin\AppData\Roaming\microsoft\checkmsc.exe
  "C:\Users\Admin\AppData\Roaming\microsoft\checkmsc.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4184

C:\Users\Admin\AppData\Roaming\microsoft\checkmsc.exe
C:\Users\Admin\AppData\Roaming\microsoft\checkmsc.exe
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3304

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\checkmsc.exe

Filesize
2.2MB

MD5
42b1cc47f577e373137d1637706778e0

SHA1
17408414e4ca34997f6b3cfbe2258657b286b57c

SHA256
b76b69c16976ae70838529ce9dac1246c46fe6e97eb0e22cef7d71db759955b9

SHA512
d29a4a1c260ef32d8355c6fecf8ea9a6dc620db1d191bc65161637b8e97fc98ad36a454a70b4b221927b7bae19468d438ba2f8246eb8b81cdfd251704cdeb167

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\checkmsc.exe

Filesize
2.2MB

MD5
42b1cc47f577e373137d1637706778e0

SHA1
17408414e4ca34997f6b3cfbe2258657b286b57c

SHA256
b76b69c16976ae70838529ce9dac1246c46fe6e97eb0e22cef7d71db759955b9

SHA512
d29a4a1c260ef32d8355c6fecf8ea9a6dc620db1d191bc65161637b8e97fc98ad36a454a70b4b221927b7bae19468d438ba2f8246eb8b81cdfd251704cdeb167

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\checkmsc.exe

Filesize
2.2MB

MD5
42b1cc47f577e373137d1637706778e0

SHA1
17408414e4ca34997f6b3cfbe2258657b286b57c

SHA256
b76b69c16976ae70838529ce9dac1246c46fe6e97eb0e22cef7d71db759955b9

SHA512
d29a4a1c260ef32d8355c6fecf8ea9a6dc620db1d191bc65161637b8e97fc98ad36a454a70b4b221927b7bae19468d438ba2f8246eb8b81cdfd251704cdeb167

Download Submit
C:\Users\Admin\AppData\Roaming\microsoft\checkmsc.exe.config

Filesize
357B

MD5
a2b76cea3a59fa9af5ea21ff68139c98

SHA1
35d76475e6a54c168f536e30206578babff58274

SHA256
f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839

SHA512
b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad

Download Submit
\??\c:\users\admin\appdata\roaming\microsoft\checkmsc.exe

Filesize
2.2MB

MD5
42b1cc47f577e373137d1637706778e0

SHA1
17408414e4ca34997f6b3cfbe2258657b286b57c

SHA256
b76b69c16976ae70838529ce9dac1246c46fe6e97eb0e22cef7d71db759955b9

SHA512
d29a4a1c260ef32d8355c6fecf8ea9a6dc620db1d191bc65161637b8e97fc98ad36a454a70b4b221927b7bae19468d438ba2f8246eb8b81cdfd251704cdeb167

Download Submit
memory/3304-166-0x0000000000740000-0x0000000000C38000-memory.dmp

Filesize
5.0MB

Download
memory/3304-169-0x0000000004F40000-0x0000000004F41000-memory.dmp

Filesize
4KB

Download
memory/3304-175-0x0000000000740000-0x0000000000C38000-memory.dmp

Filesize
5.0MB

Download
memory/3304-168-0x00000000072D0000-0x00000000072E0000-memory.dmp

Filesize
64KB

Download
memory/3304-165-0x0000000000740000-0x0000000000C38000-memory.dmp

Filesize
5.0MB

Download
memory/3304-162-0x0000000000740000-0x0000000000C38000-memory.dmp

Filesize
5.0MB

Download
memory/3656-137-0x00000000070E0000-0x00000000070F0000-memory.dmp

Filesize
64KB

Download
memory/3656-153-0x0000000000160000-0x0000000000658000-memory.dmp

Filesize
5.0MB

Download
memory/3656-142-0x0000000007F00000-0x0000000007F66000-memory.dmp

Filesize
408KB

Download
memory/3656-138-0x0000000006EC0000-0x0000000006EC1000-memory.dmp

Filesize
4KB

Download
memory/3656-133-0x0000000000160000-0x0000000000658000-memory.dmp

Filesize
5.0MB

Download
memory/3656-139-0x0000000007160000-0x0000000007182000-memory.dmp

Filesize
136KB

Download
memory/3656-134-0x0000000000160000-0x0000000000658000-memory.dmp

Filesize
5.0MB

Download
memory/3656-135-0x00000000076A0000-0x0000000007C44000-memory.dmp

Filesize
5.6MB

Download
memory/3656-136-0x0000000007190000-0x0000000007222000-memory.dmp

Filesize
584KB

Download
memory/4184-170-0x00000000089D0000-0x00000000089E2000-memory.dmp

Filesize
72KB

Download
memory/4184-172-0x0000000009190000-0x000000000929A000-memory.dmp

Filesize
1.0MB

Download
memory/4184-164-0x0000000008E80000-0x0000000008E8A000-memory.dmp

Filesize
40KB

Download
memory/4184-158-0x0000000007210000-0x0000000007211000-memory.dmp

Filesize
4KB

Download
memory/4184-157-0x0000000007310000-0x0000000007320000-memory.dmp

Filesize
64KB

Download
memory/4184-161-0x0000000008430000-0x00000000084DA000-memory.dmp

Filesize
680KB

Download
memory/4184-160-0x0000000008570000-0x0000000008732000-memory.dmp

Filesize
1.8MB

Download
memory/4184-156-0x0000000000740000-0x0000000000C38000-memory.dmp

Filesize
5.0MB

Download
memory/4184-167-0x0000000007310000-0x0000000007320000-memory.dmp

Filesize
64KB

Download
memory/4184-171-0x0000000008FF0000-0x000000000902C000-memory.dmp

Filesize
240KB

Download
memory/4184-163-0x00000000094A0000-0x0000000009AB8000-memory.dmp

Filesize
6.1MB

Download
memory/4184-155-0x0000000000740000-0x0000000000C38000-memory.dmp

Filesize
5.0MB

Download
memory/4184-177-0x0000000000740000-0x0000000000C38000-memory.dmp

Filesize
5.0MB

Download
memory/4184-178-0x0000000007310000-0x0000000007320000-memory.dmp

Filesize
64KB

Download
memory/4184-179-0x0000000007310000-0x0000000007320000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing