Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231127-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/12/2023, 01:01

General

  • Target

    57212bc8c5e6629b148ac5b71eb9b5cf339788cf3711ec75a93bb6df9f76d517.exe

  • Size

    3.0MB

  • MD5

    7d5a7a107e4ce99413bdc952655d4677

  • SHA1

    62b36c10c00461478954ee799a5d414da29c9e57

  • SHA256

    57212bc8c5e6629b148ac5b71eb9b5cf339788cf3711ec75a93bb6df9f76d517

  • SHA512

    114daf79a8c283198915a240595b68306add1dfc6c10864793310bc11ac6be9d6175cab2dea115cd1629183847163b81194249f9959e57ba22cae760073fa227

  • SSDEEP

    49152:ZGX87p1EZKMnkmWg8LX5prviYDyKS5AypQxbRQAo9JnCmpKu/nRFfjI7L0qb:ZLHTPJg8z1mKnypSbRxo9JCm

Malware Config

Extracted

Family

orcus

Botnet

Новый тег

C2

31.44.184.52:41931

Mutex

sudo_brh9yfqrylsu32h30zbtl42nzp7y8woo

Attributes
  • autostart_method

    Disable

  • enable_keylogger

    false

  • install_path

    %appdata%\providerjs\bigloadgeo.exe

  • reconnect_delay

    10000

  • registry_keyname

    Sudik

  • taskscheduler_taskname

    sudik

  • watchdog_path

    AppData\aga.exe

Signatures

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

  • Orcus main payload 6 IoCs
  • Orcurs Rat Executable 7 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\57212bc8c5e6629b148ac5b71eb9b5cf339788cf3711ec75a93bb6df9f76d517.exe
    "C:\Users\Admin\AppData\Local\Temp\57212bc8c5e6629b148ac5b71eb9b5cf339788cf3711ec75a93bb6df9f76d517.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3132
    • C:\Users\Admin\AppData\Roaming\providerjs\bigloadgeo.exe
      "C:\Users\Admin\AppData\Roaming\providerjs\bigloadgeo.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4728
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2892
  • C:\Users\Admin\AppData\Roaming\providerjs\bigloadgeo.exe
    C:\Users\Admin\AppData\Roaming\providerjs\bigloadgeo.exe
    1⤵
    • Executes dropped EXE
    PID:4108
  • C:\Users\Admin\AppData\Roaming\providerjs\bigloadgeo.exe
    C:\Users\Admin\AppData\Roaming\providerjs\bigloadgeo.exe
    1⤵
    • Executes dropped EXE
    PID:936
  • C:\Users\Admin\AppData\Roaming\providerjs\bigloadgeo.exe
    C:\Users\Admin\AppData\Roaming\providerjs\bigloadgeo.exe
    1⤵
    • Executes dropped EXE
    PID:2668

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\bigloadgeo.exe.log

    Filesize

    1KB

    MD5

    663b8d5469caa4489d463aa9bc18124f

    SHA1

    e57123a7d969115853ea631a3b33826335025d28

    SHA256

    7b4fa505452f0b8ac74bb31f5a03b13342836318018fb18d224ae2ff11b1a7e8

    SHA512

    45e373295125a629fcc0b19609608d969c9106514918bfac5d6b8e340e407434577b825741b8fa6a043c8f3f5c1a030ba8857da5f4e8ef15a551ce3c5fe03b55

  • C:\Users\Admin\AppData\Roaming\providerjs\bigloadgeo.exe

    Filesize

    3.0MB

    MD5

    7d5a7a107e4ce99413bdc952655d4677

    SHA1

    62b36c10c00461478954ee799a5d414da29c9e57

    SHA256

    57212bc8c5e6629b148ac5b71eb9b5cf339788cf3711ec75a93bb6df9f76d517

    SHA512

    114daf79a8c283198915a240595b68306add1dfc6c10864793310bc11ac6be9d6175cab2dea115cd1629183847163b81194249f9959e57ba22cae760073fa227

  • C:\Users\Admin\AppData\Roaming\providerjs\bigloadgeo.exe

    Filesize

    3.0MB

    MD5

    7d5a7a107e4ce99413bdc952655d4677

    SHA1

    62b36c10c00461478954ee799a5d414da29c9e57

    SHA256

    57212bc8c5e6629b148ac5b71eb9b5cf339788cf3711ec75a93bb6df9f76d517

    SHA512

    114daf79a8c283198915a240595b68306add1dfc6c10864793310bc11ac6be9d6175cab2dea115cd1629183847163b81194249f9959e57ba22cae760073fa227

  • C:\Users\Admin\AppData\Roaming\providerjs\bigloadgeo.exe

    Filesize

    3.0MB

    MD5

    7d5a7a107e4ce99413bdc952655d4677

    SHA1

    62b36c10c00461478954ee799a5d414da29c9e57

    SHA256

    57212bc8c5e6629b148ac5b71eb9b5cf339788cf3711ec75a93bb6df9f76d517

    SHA512

    114daf79a8c283198915a240595b68306add1dfc6c10864793310bc11ac6be9d6175cab2dea115cd1629183847163b81194249f9959e57ba22cae760073fa227

  • C:\Users\Admin\AppData\Roaming\providerjs\bigloadgeo.exe

    Filesize

    3.0MB

    MD5

    7d5a7a107e4ce99413bdc952655d4677

    SHA1

    62b36c10c00461478954ee799a5d414da29c9e57

    SHA256

    57212bc8c5e6629b148ac5b71eb9b5cf339788cf3711ec75a93bb6df9f76d517

    SHA512

    114daf79a8c283198915a240595b68306add1dfc6c10864793310bc11ac6be9d6175cab2dea115cd1629183847163b81194249f9959e57ba22cae760073fa227

  • C:\Users\Admin\AppData\Roaming\providerjs\bigloadgeo.exe

    Filesize

    3.0MB

    MD5

    7d5a7a107e4ce99413bdc952655d4677

    SHA1

    62b36c10c00461478954ee799a5d414da29c9e57

    SHA256

    57212bc8c5e6629b148ac5b71eb9b5cf339788cf3711ec75a93bb6df9f76d517

    SHA512

    114daf79a8c283198915a240595b68306add1dfc6c10864793310bc11ac6be9d6175cab2dea115cd1629183847163b81194249f9959e57ba22cae760073fa227

  • C:\Users\Admin\AppData\Roaming\providerjs\bigloadgeo.exe

    Filesize

    3.0MB

    MD5

    7d5a7a107e4ce99413bdc952655d4677

    SHA1

    62b36c10c00461478954ee799a5d414da29c9e57

    SHA256

    57212bc8c5e6629b148ac5b71eb9b5cf339788cf3711ec75a93bb6df9f76d517

    SHA512

    114daf79a8c283198915a240595b68306add1dfc6c10864793310bc11ac6be9d6175cab2dea115cd1629183847163b81194249f9959e57ba22cae760073fa227

  • C:\Users\Admin\AppData\Roaming\providerjs\bigloadgeo.exe.config

    Filesize

    357B

    MD5

    a2b76cea3a59fa9af5ea21ff68139c98

    SHA1

    35d76475e6a54c168f536e30206578babff58274

    SHA256

    f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839

    SHA512

    b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad

  • memory/936-57-0x0000000005180000-0x0000000005190000-memory.dmp

    Filesize

    64KB

  • memory/936-56-0x0000000074DF0000-0x00000000755A0000-memory.dmp

    Filesize

    7.7MB

  • memory/936-58-0x0000000074DF0000-0x00000000755A0000-memory.dmp

    Filesize

    7.7MB

  • memory/2668-60-0x0000000074DF0000-0x00000000755A0000-memory.dmp

    Filesize

    7.7MB

  • memory/2668-61-0x0000000002B20000-0x0000000002B30000-memory.dmp

    Filesize

    64KB

  • memory/2668-62-0x0000000074DF0000-0x00000000755A0000-memory.dmp

    Filesize

    7.7MB

  • memory/2892-51-0x00000000075B0000-0x00000000075BE000-memory.dmp

    Filesize

    56KB

  • memory/2892-46-0x0000000007400000-0x000000000743C000-memory.dmp

    Filesize

    240KB

  • memory/2892-54-0x0000000074DF0000-0x00000000755A0000-memory.dmp

    Filesize

    7.7MB

  • memory/2892-53-0x00000000054B0000-0x00000000054C0000-memory.dmp

    Filesize

    64KB

  • memory/2892-52-0x0000000008420000-0x0000000008470000-memory.dmp

    Filesize

    320KB

  • memory/2892-33-0x00000000054B0000-0x00000000054C0000-memory.dmp

    Filesize

    64KB

  • memory/2892-50-0x0000000007FB0000-0x0000000008172000-memory.dmp

    Filesize

    1.8MB

  • memory/2892-34-0x0000000074DF0000-0x00000000755A0000-memory.dmp

    Filesize

    7.7MB

  • memory/2892-37-0x0000000005D30000-0x0000000005D48000-memory.dmp

    Filesize

    96KB

  • memory/2892-36-0x00000000056E0000-0x00000000056F2000-memory.dmp

    Filesize

    72KB

  • memory/2892-48-0x00000000075F0000-0x00000000076FA000-memory.dmp

    Filesize

    1.0MB

  • memory/2892-38-0x0000000005DC0000-0x0000000005DD0000-memory.dmp

    Filesize

    64KB

  • memory/2892-40-0x00000000069F0000-0x00000000069FA000-memory.dmp

    Filesize

    40KB

  • memory/2892-47-0x0000000007440000-0x000000000748C000-memory.dmp

    Filesize

    304KB

  • memory/2892-43-0x0000000007300000-0x0000000007366000-memory.dmp

    Filesize

    408KB

  • memory/2892-44-0x0000000007990000-0x0000000007FA8000-memory.dmp

    Filesize

    6.1MB

  • memory/2892-45-0x00000000073A0000-0x00000000073B2000-memory.dmp

    Filesize

    72KB

  • memory/3132-6-0x0000000005D70000-0x0000000005E02000-memory.dmp

    Filesize

    584KB

  • memory/3132-4-0x0000000005990000-0x00000000059EC000-memory.dmp

    Filesize

    368KB

  • memory/3132-0-0x0000000000DF0000-0x00000000010EE000-memory.dmp

    Filesize

    3.0MB

  • memory/3132-2-0x00000000059F0000-0x0000000005A00000-memory.dmp

    Filesize

    64KB

  • memory/3132-3-0x0000000003260000-0x000000000326E000-memory.dmp

    Filesize

    56KB

  • memory/3132-1-0x0000000074DF0000-0x00000000755A0000-memory.dmp

    Filesize

    7.7MB

  • memory/3132-7-0x0000000005BE0000-0x0000000005BF2000-memory.dmp

    Filesize

    72KB

  • memory/3132-5-0x0000000006280000-0x0000000006824000-memory.dmp

    Filesize

    5.6MB

  • memory/3132-23-0x0000000074DF0000-0x00000000755A0000-memory.dmp

    Filesize

    7.7MB

  • memory/4108-39-0x0000000003250000-0x0000000003260000-memory.dmp

    Filesize

    64KB

  • memory/4108-31-0x0000000074DF0000-0x00000000755A0000-memory.dmp

    Filesize

    7.7MB

  • memory/4108-49-0x0000000074DF0000-0x00000000755A0000-memory.dmp

    Filesize

    7.7MB

  • memory/4728-24-0x0000000074DF0000-0x00000000755A0000-memory.dmp

    Filesize

    7.7MB

  • memory/4728-27-0x0000000006420000-0x00000000064BC000-memory.dmp

    Filesize

    624KB

  • memory/4728-26-0x0000000005AC0000-0x0000000005B0E000-memory.dmp

    Filesize

    312KB

  • memory/4728-32-0x0000000074DF0000-0x00000000755A0000-memory.dmp

    Filesize

    7.7MB

  • memory/4728-25-0x00000000052A0000-0x00000000052B0000-memory.dmp

    Filesize

    64KB