Analysis Overview
SHA256
6de6597f716784711ab5fc1963876d14a35cdb94e1be89bb63d18292819bf300
Threat Level: Known bad
The file 2532-3-0x00000000048F0000-0x00000000049D8000-memory.dmp was found to be: Known bad.
Malicious Activity Summary
Orcurs Rat Executable
Orcus family
Orcus main payload
Orcus
Orcurs Rat Executable
Unsigned PE
Suspicious use of AdjustPrivilegeToken
MITRE ATT&CK
Analysis: static1
Detonation Overview
Reported
2023-12-21 20:40
Signatures
Orcurs Rat Executable
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Orcus family
Orcus main payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2023-12-21 20:40
Reported
2023-12-21 20:44
Platform
win7-20231215-en
Max time kernel
122s
Max time network
214s
Command Line
Signatures
Orcus
Orcurs Rat Executable
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\2532-3-0x00000000048F0000-0x00000000049D8000-memory.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\2532-3-0x00000000048F0000-0x00000000049D8000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\2532-3-0x00000000048F0000-0x00000000049D8000-memory.exe"
Network
| Country | Destination | Domain | Proto |
| HK | 27.124.3.19:6606 | tcp | |
| HK | 27.124.3.19:6606 | tcp | |
| HK | 27.124.3.19:6606 | tcp |
Files
memory/2888-0-0x0000000001130000-0x0000000001218000-memory.dmp
memory/2888-1-0x000007FEF5BC0000-0x000007FEF65AC000-memory.dmp
memory/2888-2-0x000000001B1C0000-0x000000001B240000-memory.dmp
memory/2888-3-0x0000000000640000-0x000000000069C000-memory.dmp
memory/2888-4-0x00000000002A0000-0x00000000002AE000-memory.dmp
memory/2888-5-0x0000000000360000-0x0000000000372000-memory.dmp
memory/2888-6-0x0000000000370000-0x0000000000388000-memory.dmp
memory/2888-7-0x0000000000350000-0x0000000000360000-memory.dmp
memory/2888-8-0x000007FEF5BC0000-0x000007FEF65AC000-memory.dmp
memory/2888-9-0x000000001B1C0000-0x000000001B240000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\CabD7FA.tmp
| MD5 | ac05d27423a85adc1622c714f2cb6184 |
| SHA1 | b0fe2b1abddb97837ea0195be70ab2ff14d43198 |
| SHA256 | c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d |
| SHA512 | 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d |
Analysis: behavioral2
Detonation Overview
Submitted
2023-12-21 20:40
Reported
2023-12-21 20:43
Platform
win10v2004-20231215-en
Max time kernel
149s
Max time network
163s
Command Line
Signatures
Orcus
Orcurs Rat Executable
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\2532-3-0x00000000048F0000-0x00000000049D8000-memory.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\2532-3-0x00000000048F0000-0x00000000049D8000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\2532-3-0x00000000048F0000-0x00000000049D8000-memory.exe"
Network
| Country | Destination | Domain | Proto |
| HK | 27.124.3.19:6606 | tcp | |
| US | 8.8.8.8:53 | 22.177.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 180.178.17.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.154.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 204.79.197.200:443 | g.bing.com | tcp |
| US | 8.8.8.8:53 | 45.19.74.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 167.109.18.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 19.3.124.27.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 57.110.18.2.in-addr.arpa | udp |
| HK | 27.124.3.19:6606 | tcp | |
| US | 8.8.8.8:53 | 86.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 171.39.242.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 217.135.221.88.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 19.229.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 81.171.91.138.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 173.178.17.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 90.65.42.20.in-addr.arpa | udp |
Files
memory/4240-0-0x0000000000480000-0x0000000000568000-memory.dmp
memory/4240-1-0x0000000000D50000-0x0000000000DAC000-memory.dmp
memory/4240-2-0x0000000000D10000-0x0000000000D1E000-memory.dmp
memory/4240-3-0x00007FFAD8270000-0x00007FFAD8D31000-memory.dmp
memory/4240-4-0x0000000000DB0000-0x0000000000DC0000-memory.dmp
memory/4240-5-0x000000001BD80000-0x000000001BD92000-memory.dmp
memory/4240-6-0x000000001BD90000-0x000000001BDA8000-memory.dmp
memory/4240-7-0x000000001BD70000-0x000000001BD80000-memory.dmp
memory/4240-8-0x00007FFAD8270000-0x00007FFAD8D31000-memory.dmp
memory/4240-9-0x000000001C160000-0x000000001C172000-memory.dmp
memory/4240-10-0x000000001C1C0000-0x000000001C1FC000-memory.dmp
memory/4240-11-0x000000001C790000-0x000000001C89A000-memory.dmp
memory/4240-12-0x000000001C8A0000-0x000000001CA0A000-memory.dmp
memory/4240-13-0x000000001CBE0000-0x000000001CDA2000-memory.dmp
memory/4240-14-0x0000000000DB0000-0x0000000000DC0000-memory.dmp