Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
127s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
08/12/2023, 01:54
Behavioral task
behavioral1
Sample
eb604e30b417ed070deefd71d6f4b387b66542ec44604ba33d23cc9f3c562f5a.exe
Resource
win7-20231129-en
General
-
Target
eb604e30b417ed070deefd71d6f4b387b66542ec44604ba33d23cc9f3c562f5a.exe
-
Size
3.0MB
-
MD5
ba871bd865a6d6b3c827103c388819d0
-
SHA1
df0da12537fa33acfc8a8a9f308f485bf59c4fd6
-
SHA256
eb604e30b417ed070deefd71d6f4b387b66542ec44604ba33d23cc9f3c562f5a
-
SHA512
e1a78daf7ff92c1a1c09cd32f1104193726c7390ffcd58906958d182e588c8e10863d111733aec49ad076997000efca2e56a0832a79292abda4df3e37d64bb3f
-
SSDEEP
49152:S1HS7p1EZKMnkmWg8LX5prviYDyKS5AypQxbRQAo9JnCmpbu/nRFfjI7L0qbm:SUHTPJg8z1mKnypSbRxo9JCm
Malware Config
Extracted
orcus
Новый тег
31.44.184.52:51972
sudo_srpiqkklx7ep2j58j2i7oyvpd6sx99h3
-
autostart_method
Disable
-
enable_keylogger
false
-
install_path
%appdata%\longpollrequest\httplinux.exe
-
reconnect_delay
10000
-
registry_keyname
Sudik
-
taskscheduler_taskname
sudik
-
watchdog_path
AppData\aga.exe
Signatures
-
Orcus main payload 7 IoCs
resource yara_rule behavioral1/files/0x000900000001410b-10.dat family_orcus behavioral1/files/0x000900000001410b-13.dat family_orcus behavioral1/files/0x000900000001410b-12.dat family_orcus behavioral1/files/0x000900000001410b-15.dat family_orcus behavioral1/files/0x000900000001410b-33.dat family_orcus behavioral1/files/0x000900000001410b-70.dat family_orcus behavioral1/files/0x000900000001410b-75.dat family_orcus -
Orcurs Rat Executable 16 IoCs
resource yara_rule behavioral1/memory/3044-0-0x00000000012E0000-0x00000000015EE000-memory.dmp orcus behavioral1/files/0x000900000001410b-10.dat orcus behavioral1/files/0x000900000001410b-13.dat orcus behavioral1/files/0x000900000001410b-12.dat orcus behavioral1/files/0x000900000001410b-15.dat orcus behavioral1/memory/3024-18-0x0000000000950000-0x0000000000C5E000-memory.dmp orcus behavioral1/memory/2624-25-0x0000000000400000-0x000000000070E000-memory.dmp orcus behavioral1/memory/2624-26-0x0000000000400000-0x000000000070E000-memory.dmp orcus behavioral1/memory/2624-29-0x0000000000400000-0x000000000070E000-memory.dmp orcus behavioral1/memory/2624-32-0x0000000000400000-0x000000000070E000-memory.dmp orcus behavioral1/files/0x000900000001410b-33.dat orcus behavioral1/memory/2632-50-0x0000000000400000-0x000000000070E000-memory.dmp orcus behavioral1/files/0x000900000001410b-70.dat orcus behavioral1/memory/1072-72-0x0000000000140000-0x000000000044E000-memory.dmp orcus behavioral1/files/0x000900000001410b-75.dat orcus behavioral1/memory/1712-76-0x0000000000110000-0x000000000041E000-memory.dmp orcus -
Executes dropped EXE 4 IoCs
pid Process 3024 httplinux.exe 1168 httplinux.exe 1072 httplinux.exe 1712 httplinux.exe -
Loads dropped DLL 1 IoCs
pid Process 3044 eb604e30b417ed070deefd71d6f4b387b66542ec44604ba33d23cc9f3c562f5a.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3024 set thread context of 2624 3024 httplinux.exe 30 PID 1168 set thread context of 2632 1168 httplinux.exe 32 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 3044 eb604e30b417ed070deefd71d6f4b387b66542ec44604ba33d23cc9f3c562f5a.exe 3024 httplinux.exe 3024 httplinux.exe 1168 httplinux.exe 1168 httplinux.exe 2632 installutil.exe 2632 installutil.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3044 eb604e30b417ed070deefd71d6f4b387b66542ec44604ba33d23cc9f3c562f5a.exe Token: SeDebugPrivilege 3024 httplinux.exe Token: SeDebugPrivilege 1168 httplinux.exe Token: SeDebugPrivilege 2632 installutil.exe -
Suspicious use of WriteProcessMemory 37 IoCs
description pid Process procid_target PID 3044 wrote to memory of 3024 3044 eb604e30b417ed070deefd71d6f4b387b66542ec44604ba33d23cc9f3c562f5a.exe 28 PID 3044 wrote to memory of 3024 3044 eb604e30b417ed070deefd71d6f4b387b66542ec44604ba33d23cc9f3c562f5a.exe 28 PID 3044 wrote to memory of 3024 3044 eb604e30b417ed070deefd71d6f4b387b66542ec44604ba33d23cc9f3c562f5a.exe 28 PID 3044 wrote to memory of 3024 3044 eb604e30b417ed070deefd71d6f4b387b66542ec44604ba33d23cc9f3c562f5a.exe 28 PID 3024 wrote to memory of 2624 3024 httplinux.exe 30 PID 3024 wrote to memory of 2624 3024 httplinux.exe 30 PID 3024 wrote to memory of 2624 3024 httplinux.exe 30 PID 3024 wrote to memory of 2624 3024 httplinux.exe 30 PID 3024 wrote to memory of 2624 3024 httplinux.exe 30 PID 3024 wrote to memory of 2624 3024 httplinux.exe 30 PID 3024 wrote to memory of 2624 3024 httplinux.exe 30 PID 3024 wrote to memory of 2624 3024 httplinux.exe 30 PID 3024 wrote to memory of 2624 3024 httplinux.exe 30 PID 2608 wrote to memory of 1168 2608 taskeng.exe 31 PID 2608 wrote to memory of 1168 2608 taskeng.exe 31 PID 2608 wrote to memory of 1168 2608 taskeng.exe 31 PID 2608 wrote to memory of 1168 2608 taskeng.exe 31 PID 1168 wrote to memory of 2632 1168 httplinux.exe 32 PID 1168 wrote to memory of 2632 1168 httplinux.exe 32 PID 1168 wrote to memory of 2632 1168 httplinux.exe 32 PID 1168 wrote to memory of 2632 1168 httplinux.exe 32 PID 1168 wrote to memory of 2632 1168 httplinux.exe 32 PID 1168 wrote to memory of 2632 1168 httplinux.exe 32 PID 1168 wrote to memory of 2632 1168 httplinux.exe 32 PID 1168 wrote to memory of 2632 1168 httplinux.exe 32 PID 1168 wrote to memory of 2632 1168 httplinux.exe 32 PID 1168 wrote to memory of 2632 1168 httplinux.exe 32 PID 1168 wrote to memory of 2632 1168 httplinux.exe 32 PID 1168 wrote to memory of 2632 1168 httplinux.exe 32 PID 2608 wrote to memory of 1072 2608 taskeng.exe 37 PID 2608 wrote to memory of 1072 2608 taskeng.exe 37 PID 2608 wrote to memory of 1072 2608 taskeng.exe 37 PID 2608 wrote to memory of 1072 2608 taskeng.exe 37 PID 2608 wrote to memory of 1712 2608 taskeng.exe 38 PID 2608 wrote to memory of 1712 2608 taskeng.exe 38 PID 2608 wrote to memory of 1712 2608 taskeng.exe 38 PID 2608 wrote to memory of 1712 2608 taskeng.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\eb604e30b417ed070deefd71d6f4b387b66542ec44604ba33d23cc9f3c562f5a.exe"C:\Users\Admin\AppData\Local\Temp\eb604e30b417ed070deefd71d6f4b387b66542ec44604ba33d23cc9f3c562f5a.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Roaming\longpollrequest\httplinux.exe"C:\Users\Admin\AppData\Roaming\longpollrequest\httplinux.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe"3⤵PID:2624
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {1FD1C45C-C83F-4A5A-A82F-24561F49F75E} S-1-5-21-3470981204-343661084-3367201002-1000:GLTGRJAG\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Roaming\longpollrequest\httplinux.exeC:\Users\Admin\AppData\Roaming\longpollrequest\httplinux.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2632
-
-
-
C:\Users\Admin\AppData\Roaming\longpollrequest\httplinux.exeC:\Users\Admin\AppData\Roaming\longpollrequest\httplinux.exe2⤵
- Executes dropped EXE
PID:1072
-
-
C:\Users\Admin\AppData\Roaming\longpollrequest\httplinux.exeC:\Users\Admin\AppData\Roaming\longpollrequest\httplinux.exe2⤵
- Executes dropped EXE
PID:1712
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.0MB
MD5ba871bd865a6d6b3c827103c388819d0
SHA1df0da12537fa33acfc8a8a9f308f485bf59c4fd6
SHA256eb604e30b417ed070deefd71d6f4b387b66542ec44604ba33d23cc9f3c562f5a
SHA512e1a78daf7ff92c1a1c09cd32f1104193726c7390ffcd58906958d182e588c8e10863d111733aec49ad076997000efca2e56a0832a79292abda4df3e37d64bb3f
-
Filesize
3.0MB
MD5ba871bd865a6d6b3c827103c388819d0
SHA1df0da12537fa33acfc8a8a9f308f485bf59c4fd6
SHA256eb604e30b417ed070deefd71d6f4b387b66542ec44604ba33d23cc9f3c562f5a
SHA512e1a78daf7ff92c1a1c09cd32f1104193726c7390ffcd58906958d182e588c8e10863d111733aec49ad076997000efca2e56a0832a79292abda4df3e37d64bb3f
-
Filesize
3.0MB
MD5ba871bd865a6d6b3c827103c388819d0
SHA1df0da12537fa33acfc8a8a9f308f485bf59c4fd6
SHA256eb604e30b417ed070deefd71d6f4b387b66542ec44604ba33d23cc9f3c562f5a
SHA512e1a78daf7ff92c1a1c09cd32f1104193726c7390ffcd58906958d182e588c8e10863d111733aec49ad076997000efca2e56a0832a79292abda4df3e37d64bb3f
-
Filesize
3.0MB
MD5ba871bd865a6d6b3c827103c388819d0
SHA1df0da12537fa33acfc8a8a9f308f485bf59c4fd6
SHA256eb604e30b417ed070deefd71d6f4b387b66542ec44604ba33d23cc9f3c562f5a
SHA512e1a78daf7ff92c1a1c09cd32f1104193726c7390ffcd58906958d182e588c8e10863d111733aec49ad076997000efca2e56a0832a79292abda4df3e37d64bb3f
-
Filesize
3.0MB
MD5ba871bd865a6d6b3c827103c388819d0
SHA1df0da12537fa33acfc8a8a9f308f485bf59c4fd6
SHA256eb604e30b417ed070deefd71d6f4b387b66542ec44604ba33d23cc9f3c562f5a
SHA512e1a78daf7ff92c1a1c09cd32f1104193726c7390ffcd58906958d182e588c8e10863d111733aec49ad076997000efca2e56a0832a79292abda4df3e37d64bb3f
-
Filesize
3.0MB
MD5ba871bd865a6d6b3c827103c388819d0
SHA1df0da12537fa33acfc8a8a9f308f485bf59c4fd6
SHA256eb604e30b417ed070deefd71d6f4b387b66542ec44604ba33d23cc9f3c562f5a
SHA512e1a78daf7ff92c1a1c09cd32f1104193726c7390ffcd58906958d182e588c8e10863d111733aec49ad076997000efca2e56a0832a79292abda4df3e37d64bb3f
-
Filesize
357B
MD5a2b76cea3a59fa9af5ea21ff68139c98
SHA135d76475e6a54c168f536e30206578babff58274
SHA256f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839
SHA512b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad
-
Filesize
3.0MB
MD5ba871bd865a6d6b3c827103c388819d0
SHA1df0da12537fa33acfc8a8a9f308f485bf59c4fd6
SHA256eb604e30b417ed070deefd71d6f4b387b66542ec44604ba33d23cc9f3c562f5a
SHA512e1a78daf7ff92c1a1c09cd32f1104193726c7390ffcd58906958d182e588c8e10863d111733aec49ad076997000efca2e56a0832a79292abda4df3e37d64bb3f