Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
126s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20231201-en -
resource tags
arch:x64arch:x86image:win7-20231201-enlocale:en-usos:windows7-x64system -
submitted
08/12/2023, 01:07
Behavioral task
behavioral1
Sample
a73df758241b27144774e86fc91a3006f37f867cff7aef89da0a1de89ab51a16.exe
Resource
win7-20231201-en
General
-
Target
a73df758241b27144774e86fc91a3006f37f867cff7aef89da0a1de89ab51a16.exe
-
Size
3.0MB
-
MD5
46c99087ac08294ad362ad6e78f9a2f2
-
SHA1
d813fdcb345b6aa77a788168cc9d93e4ca4f1de6
-
SHA256
a73df758241b27144774e86fc91a3006f37f867cff7aef89da0a1de89ab51a16
-
SHA512
594572c4f73ac4f9fa85e088eef61014cd93d96f27a7a6c7556bfd958d951395b43ce90ed20010262bbedfa5a5e35853475cf7455b1a5c408a39f3e10f5e5bf4
-
SSDEEP
49152:Cs7p1EZKMnkmWg8LX5prviYDyKS5AypQxbRQAo9JnCmpau/nRFfjI7L0qb:CsHTPJg8z1mKnypSbRxo9JCm
Malware Config
Extracted
orcus
Новый тег
31.44.184.52:41931
sudo_sgzwhpv7vdckstvvkmsb2i0hvuy5syfv
-
autostart_method
Disable
-
enable_keylogger
false
-
install_path
%appdata%\phpdb\sqldb.exe
-
reconnect_delay
10000
-
registry_keyname
Sudik
-
taskscheduler_taskname
sudik
-
watchdog_path
AppData\aga.exe
Signatures
-
Orcus main payload 7 IoCs
resource yara_rule behavioral1/files/0x000e00000001234c-10.dat family_orcus behavioral1/files/0x000e00000001234c-13.dat family_orcus behavioral1/files/0x000e00000001234c-12.dat family_orcus behavioral1/files/0x000e00000001234c-15.dat family_orcus behavioral1/files/0x000e00000001234c-34.dat family_orcus behavioral1/files/0x000e00000001234c-60.dat family_orcus behavioral1/files/0x000e00000001234c-65.dat family_orcus -
Orcurs Rat Executable 16 IoCs
resource yara_rule behavioral1/memory/1728-0-0x0000000000100000-0x00000000003FE000-memory.dmp orcus behavioral1/files/0x000e00000001234c-10.dat orcus behavioral1/files/0x000e00000001234c-13.dat orcus behavioral1/files/0x000e00000001234c-12.dat orcus behavioral1/files/0x000e00000001234c-15.dat orcus behavioral1/memory/2696-16-0x0000000000C40000-0x0000000000F3E000-memory.dmp orcus behavioral1/memory/2744-26-0x0000000000400000-0x00000000006FE000-memory.dmp orcus behavioral1/memory/2744-27-0x0000000000400000-0x00000000006FE000-memory.dmp orcus behavioral1/memory/2744-30-0x0000000000400000-0x00000000006FE000-memory.dmp orcus behavioral1/memory/2744-33-0x0000000000400000-0x00000000006FE000-memory.dmp orcus behavioral1/files/0x000e00000001234c-34.dat orcus behavioral1/memory/2744-37-0x0000000000400000-0x00000000006FE000-memory.dmp orcus behavioral1/files/0x000e00000001234c-60.dat orcus behavioral1/memory/2068-62-0x00000000011C0000-0x00000000014BE000-memory.dmp orcus behavioral1/files/0x000e00000001234c-65.dat orcus behavioral1/memory/1604-66-0x0000000001340000-0x000000000163E000-memory.dmp orcus -
Executes dropped EXE 4 IoCs
pid Process 2696 sqldb.exe 2612 sqldb.exe 2068 sqldb.exe 1604 sqldb.exe -
Loads dropped DLL 1 IoCs
pid Process 1728 a73df758241b27144774e86fc91a3006f37f867cff7aef89da0a1de89ab51a16.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2696 set thread context of 2744 2696 sqldb.exe 30 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 1728 a73df758241b27144774e86fc91a3006f37f867cff7aef89da0a1de89ab51a16.exe 2696 sqldb.exe 2696 sqldb.exe 2744 regasm.exe 2744 regasm.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1728 a73df758241b27144774e86fc91a3006f37f867cff7aef89da0a1de89ab51a16.exe Token: SeDebugPrivilege 2696 sqldb.exe Token: SeDebugPrivilege 2744 regasm.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 1728 wrote to memory of 2696 1728 a73df758241b27144774e86fc91a3006f37f867cff7aef89da0a1de89ab51a16.exe 28 PID 1728 wrote to memory of 2696 1728 a73df758241b27144774e86fc91a3006f37f867cff7aef89da0a1de89ab51a16.exe 28 PID 1728 wrote to memory of 2696 1728 a73df758241b27144774e86fc91a3006f37f867cff7aef89da0a1de89ab51a16.exe 28 PID 1728 wrote to memory of 2696 1728 a73df758241b27144774e86fc91a3006f37f867cff7aef89da0a1de89ab51a16.exe 28 PID 2696 wrote to memory of 2744 2696 sqldb.exe 30 PID 2696 wrote to memory of 2744 2696 sqldb.exe 30 PID 2696 wrote to memory of 2744 2696 sqldb.exe 30 PID 2696 wrote to memory of 2744 2696 sqldb.exe 30 PID 2696 wrote to memory of 2744 2696 sqldb.exe 30 PID 2696 wrote to memory of 2744 2696 sqldb.exe 30 PID 2696 wrote to memory of 2744 2696 sqldb.exe 30 PID 2696 wrote to memory of 2744 2696 sqldb.exe 30 PID 2696 wrote to memory of 2744 2696 sqldb.exe 30 PID 2696 wrote to memory of 2744 2696 sqldb.exe 30 PID 2696 wrote to memory of 2744 2696 sqldb.exe 30 PID 2696 wrote to memory of 2744 2696 sqldb.exe 30 PID 2784 wrote to memory of 2612 2784 taskeng.exe 31 PID 2784 wrote to memory of 2612 2784 taskeng.exe 31 PID 2784 wrote to memory of 2612 2784 taskeng.exe 31 PID 2784 wrote to memory of 2612 2784 taskeng.exe 31 PID 2784 wrote to memory of 2068 2784 taskeng.exe 36 PID 2784 wrote to memory of 2068 2784 taskeng.exe 36 PID 2784 wrote to memory of 2068 2784 taskeng.exe 36 PID 2784 wrote to memory of 2068 2784 taskeng.exe 36 PID 2784 wrote to memory of 1604 2784 taskeng.exe 37 PID 2784 wrote to memory of 1604 2784 taskeng.exe 37 PID 2784 wrote to memory of 1604 2784 taskeng.exe 37 PID 2784 wrote to memory of 1604 2784 taskeng.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\a73df758241b27144774e86fc91a3006f37f867cff7aef89da0a1de89ab51a16.exe"C:\Users\Admin\AppData\Local\Temp\a73df758241b27144774e86fc91a3006f37f867cff7aef89da0a1de89ab51a16.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Users\Admin\AppData\Roaming\phpdb\sqldb.exe"C:\Users\Admin\AppData\Roaming\phpdb\sqldb.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2744
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {98F72091-A208-426B-BF6F-8F94065519B4} S-1-5-21-1502336823-1680518048-858510903-1000:XARGEIVJ\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Roaming\phpdb\sqldb.exeC:\Users\Admin\AppData\Roaming\phpdb\sqldb.exe2⤵
- Executes dropped EXE
PID:2612
-
-
C:\Users\Admin\AppData\Roaming\phpdb\sqldb.exeC:\Users\Admin\AppData\Roaming\phpdb\sqldb.exe2⤵
- Executes dropped EXE
PID:2068
-
-
C:\Users\Admin\AppData\Roaming\phpdb\sqldb.exeC:\Users\Admin\AppData\Roaming\phpdb\sqldb.exe2⤵
- Executes dropped EXE
PID:1604
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
3.0MB
MD546c99087ac08294ad362ad6e78f9a2f2
SHA1d813fdcb345b6aa77a788168cc9d93e4ca4f1de6
SHA256a73df758241b27144774e86fc91a3006f37f867cff7aef89da0a1de89ab51a16
SHA512594572c4f73ac4f9fa85e088eef61014cd93d96f27a7a6c7556bfd958d951395b43ce90ed20010262bbedfa5a5e35853475cf7455b1a5c408a39f3e10f5e5bf4
-
Filesize
3.0MB
MD546c99087ac08294ad362ad6e78f9a2f2
SHA1d813fdcb345b6aa77a788168cc9d93e4ca4f1de6
SHA256a73df758241b27144774e86fc91a3006f37f867cff7aef89da0a1de89ab51a16
SHA512594572c4f73ac4f9fa85e088eef61014cd93d96f27a7a6c7556bfd958d951395b43ce90ed20010262bbedfa5a5e35853475cf7455b1a5c408a39f3e10f5e5bf4
-
Filesize
3.0MB
MD546c99087ac08294ad362ad6e78f9a2f2
SHA1d813fdcb345b6aa77a788168cc9d93e4ca4f1de6
SHA256a73df758241b27144774e86fc91a3006f37f867cff7aef89da0a1de89ab51a16
SHA512594572c4f73ac4f9fa85e088eef61014cd93d96f27a7a6c7556bfd958d951395b43ce90ed20010262bbedfa5a5e35853475cf7455b1a5c408a39f3e10f5e5bf4
-
Filesize
3.0MB
MD546c99087ac08294ad362ad6e78f9a2f2
SHA1d813fdcb345b6aa77a788168cc9d93e4ca4f1de6
SHA256a73df758241b27144774e86fc91a3006f37f867cff7aef89da0a1de89ab51a16
SHA512594572c4f73ac4f9fa85e088eef61014cd93d96f27a7a6c7556bfd958d951395b43ce90ed20010262bbedfa5a5e35853475cf7455b1a5c408a39f3e10f5e5bf4
-
Filesize
3.0MB
MD546c99087ac08294ad362ad6e78f9a2f2
SHA1d813fdcb345b6aa77a788168cc9d93e4ca4f1de6
SHA256a73df758241b27144774e86fc91a3006f37f867cff7aef89da0a1de89ab51a16
SHA512594572c4f73ac4f9fa85e088eef61014cd93d96f27a7a6c7556bfd958d951395b43ce90ed20010262bbedfa5a5e35853475cf7455b1a5c408a39f3e10f5e5bf4
-
Filesize
3.0MB
MD546c99087ac08294ad362ad6e78f9a2f2
SHA1d813fdcb345b6aa77a788168cc9d93e4ca4f1de6
SHA256a73df758241b27144774e86fc91a3006f37f867cff7aef89da0a1de89ab51a16
SHA512594572c4f73ac4f9fa85e088eef61014cd93d96f27a7a6c7556bfd958d951395b43ce90ed20010262bbedfa5a5e35853475cf7455b1a5c408a39f3e10f5e5bf4
-
Filesize
357B
MD5a2b76cea3a59fa9af5ea21ff68139c98
SHA135d76475e6a54c168f536e30206578babff58274
SHA256f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839
SHA512b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad
-
Filesize
3.0MB
MD546c99087ac08294ad362ad6e78f9a2f2
SHA1d813fdcb345b6aa77a788168cc9d93e4ca4f1de6
SHA256a73df758241b27144774e86fc91a3006f37f867cff7aef89da0a1de89ab51a16
SHA512594572c4f73ac4f9fa85e088eef61014cd93d96f27a7a6c7556bfd958d951395b43ce90ed20010262bbedfa5a5e35853475cf7455b1a5c408a39f3e10f5e5bf4