Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system -
submitted
08/12/2023, 01:54
Behavioral task
behavioral1
Sample
eb604e30b417ed070deefd71d6f4b387b66542ec44604ba33d23cc9f3c562f5a.exe
Resource
win7-20231129-en
General
-
Target
eb604e30b417ed070deefd71d6f4b387b66542ec44604ba33d23cc9f3c562f5a.exe
-
Size
3.0MB
-
MD5
ba871bd865a6d6b3c827103c388819d0
-
SHA1
df0da12537fa33acfc8a8a9f308f485bf59c4fd6
-
SHA256
eb604e30b417ed070deefd71d6f4b387b66542ec44604ba33d23cc9f3c562f5a
-
SHA512
e1a78daf7ff92c1a1c09cd32f1104193726c7390ffcd58906958d182e588c8e10863d111733aec49ad076997000efca2e56a0832a79292abda4df3e37d64bb3f
-
SSDEEP
49152:S1HS7p1EZKMnkmWg8LX5prviYDyKS5AypQxbRQAo9JnCmpbu/nRFfjI7L0qbm:SUHTPJg8z1mKnypSbRxo9JCm
Malware Config
Extracted
orcus
Новый тег
31.44.184.52:51972
sudo_srpiqkklx7ep2j58j2i7oyvpd6sx99h3
-
autostart_method
Disable
-
enable_keylogger
false
-
install_path
%appdata%\longpollrequest\httplinux.exe
-
reconnect_delay
10000
-
registry_keyname
Sudik
-
taskscheduler_taskname
sudik
-
watchdog_path
AppData\aga.exe
Signatures
-
Orcus main payload 6 IoCs
resource yara_rule behavioral2/files/0x0007000000023206-13.dat family_orcus behavioral2/files/0x0007000000023206-19.dat family_orcus behavioral2/files/0x0007000000023206-21.dat family_orcus behavioral2/files/0x0007000000023206-27.dat family_orcus behavioral2/files/0x0007000000023206-54.dat family_orcus behavioral2/files/0x0007000000023206-58.dat family_orcus -
Orcurs Rat Executable 7 IoCs
resource yara_rule behavioral2/memory/4748-0-0x0000000000F10000-0x000000000121E000-memory.dmp orcus behavioral2/files/0x0007000000023206-13.dat orcus behavioral2/files/0x0007000000023206-19.dat orcus behavioral2/files/0x0007000000023206-21.dat orcus behavioral2/files/0x0007000000023206-27.dat orcus behavioral2/files/0x0007000000023206-54.dat orcus behavioral2/files/0x0007000000023206-58.dat orcus -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2013768333-4045878716-2922883000-1000\Control Panel\International\Geo\Nation eb604e30b417ed070deefd71d6f4b387b66542ec44604ba33d23cc9f3c562f5a.exe -
Executes dropped EXE 4 IoCs
pid Process 1364 httplinux.exe 4724 httplinux.exe 1884 httplinux.exe 436 httplinux.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1364 set thread context of 4812 1364 httplinux.exe 95 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 4748 eb604e30b417ed070deefd71d6f4b387b66542ec44604ba33d23cc9f3c562f5a.exe 1364 httplinux.exe 1364 httplinux.exe 1364 httplinux.exe 1364 httplinux.exe 4812 installutil.exe 4812 installutil.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4748 eb604e30b417ed070deefd71d6f4b387b66542ec44604ba33d23cc9f3c562f5a.exe Token: SeDebugPrivilege 1364 httplinux.exe Token: SeDebugPrivilege 4812 installutil.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 4748 wrote to memory of 1364 4748 eb604e30b417ed070deefd71d6f4b387b66542ec44604ba33d23cc9f3c562f5a.exe 89 PID 4748 wrote to memory of 1364 4748 eb604e30b417ed070deefd71d6f4b387b66542ec44604ba33d23cc9f3c562f5a.exe 89 PID 4748 wrote to memory of 1364 4748 eb604e30b417ed070deefd71d6f4b387b66542ec44604ba33d23cc9f3c562f5a.exe 89 PID 1364 wrote to memory of 3572 1364 httplinux.exe 94 PID 1364 wrote to memory of 3572 1364 httplinux.exe 94 PID 1364 wrote to memory of 3572 1364 httplinux.exe 94 PID 1364 wrote to memory of 4812 1364 httplinux.exe 95 PID 1364 wrote to memory of 4812 1364 httplinux.exe 95 PID 1364 wrote to memory of 4812 1364 httplinux.exe 95 PID 1364 wrote to memory of 4812 1364 httplinux.exe 95 PID 1364 wrote to memory of 4812 1364 httplinux.exe 95 PID 1364 wrote to memory of 4812 1364 httplinux.exe 95 PID 1364 wrote to memory of 4812 1364 httplinux.exe 95 PID 1364 wrote to memory of 4812 1364 httplinux.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\eb604e30b417ed070deefd71d6f4b387b66542ec44604ba33d23cc9f3c562f5a.exe"C:\Users\Admin\AppData\Local\Temp\eb604e30b417ed070deefd71d6f4b387b66542ec44604ba33d23cc9f3c562f5a.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Users\Admin\AppData\Roaming\longpollrequest\httplinux.exe"C:\Users\Admin\AppData\Roaming\longpollrequest\httplinux.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"3⤵PID:3572
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4812
-
-
-
C:\Users\Admin\AppData\Roaming\longpollrequest\httplinux.exeC:\Users\Admin\AppData\Roaming\longpollrequest\httplinux.exe1⤵
- Executes dropped EXE
PID:4724
-
C:\Users\Admin\AppData\Roaming\longpollrequest\httplinux.exeC:\Users\Admin\AppData\Roaming\longpollrequest\httplinux.exe1⤵
- Executes dropped EXE
PID:1884
-
C:\Users\Admin\AppData\Roaming\longpollrequest\httplinux.exeC:\Users\Admin\AppData\Roaming\longpollrequest\httplinux.exe1⤵
- Executes dropped EXE
PID:436
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5663b8d5469caa4489d463aa9bc18124f
SHA1e57123a7d969115853ea631a3b33826335025d28
SHA2567b4fa505452f0b8ac74bb31f5a03b13342836318018fb18d224ae2ff11b1a7e8
SHA51245e373295125a629fcc0b19609608d969c9106514918bfac5d6b8e340e407434577b825741b8fa6a043c8f3f5c1a030ba8857da5f4e8ef15a551ce3c5fe03b55
-
Filesize
3.0MB
MD5ba871bd865a6d6b3c827103c388819d0
SHA1df0da12537fa33acfc8a8a9f308f485bf59c4fd6
SHA256eb604e30b417ed070deefd71d6f4b387b66542ec44604ba33d23cc9f3c562f5a
SHA512e1a78daf7ff92c1a1c09cd32f1104193726c7390ffcd58906958d182e588c8e10863d111733aec49ad076997000efca2e56a0832a79292abda4df3e37d64bb3f
-
Filesize
3.0MB
MD5ba871bd865a6d6b3c827103c388819d0
SHA1df0da12537fa33acfc8a8a9f308f485bf59c4fd6
SHA256eb604e30b417ed070deefd71d6f4b387b66542ec44604ba33d23cc9f3c562f5a
SHA512e1a78daf7ff92c1a1c09cd32f1104193726c7390ffcd58906958d182e588c8e10863d111733aec49ad076997000efca2e56a0832a79292abda4df3e37d64bb3f
-
Filesize
3.0MB
MD5ba871bd865a6d6b3c827103c388819d0
SHA1df0da12537fa33acfc8a8a9f308f485bf59c4fd6
SHA256eb604e30b417ed070deefd71d6f4b387b66542ec44604ba33d23cc9f3c562f5a
SHA512e1a78daf7ff92c1a1c09cd32f1104193726c7390ffcd58906958d182e588c8e10863d111733aec49ad076997000efca2e56a0832a79292abda4df3e37d64bb3f
-
Filesize
3.0MB
MD5ba871bd865a6d6b3c827103c388819d0
SHA1df0da12537fa33acfc8a8a9f308f485bf59c4fd6
SHA256eb604e30b417ed070deefd71d6f4b387b66542ec44604ba33d23cc9f3c562f5a
SHA512e1a78daf7ff92c1a1c09cd32f1104193726c7390ffcd58906958d182e588c8e10863d111733aec49ad076997000efca2e56a0832a79292abda4df3e37d64bb3f
-
Filesize
3.0MB
MD5ba871bd865a6d6b3c827103c388819d0
SHA1df0da12537fa33acfc8a8a9f308f485bf59c4fd6
SHA256eb604e30b417ed070deefd71d6f4b387b66542ec44604ba33d23cc9f3c562f5a
SHA512e1a78daf7ff92c1a1c09cd32f1104193726c7390ffcd58906958d182e588c8e10863d111733aec49ad076997000efca2e56a0832a79292abda4df3e37d64bb3f
-
Filesize
3.0MB
MD5ba871bd865a6d6b3c827103c388819d0
SHA1df0da12537fa33acfc8a8a9f308f485bf59c4fd6
SHA256eb604e30b417ed070deefd71d6f4b387b66542ec44604ba33d23cc9f3c562f5a
SHA512e1a78daf7ff92c1a1c09cd32f1104193726c7390ffcd58906958d182e588c8e10863d111733aec49ad076997000efca2e56a0832a79292abda4df3e37d64bb3f
-
Filesize
357B
MD5a2b76cea3a59fa9af5ea21ff68139c98
SHA135d76475e6a54c168f536e30206578babff58274
SHA256f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839
SHA512b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad