Analysis Overview
SHA256
e2f52bc6eadf8f6152e848f6e42ffdafa4e34718b205e7189767c21f262a1cd8
Threat Level: Known bad
The file @O45_204_82_103_x64CEcc.exe.1 was found to be: Known bad.
Malicious Activity Summary
Orcus
Orcurs Rat Executable
Suspicious use of AdjustPrivilegeToken
MITRE ATT&CK
Analysis: static1
Detonation Overview
Reported
2023-12-24 14:46
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2023-12-24 14:46
Reported
2023-12-24 14:49
Platform
win7-20231129-en
Max time kernel
120s
Max time network
144s
Command Line
Signatures
Orcus
Orcurs Rat Executable
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\@O45_204_82_103_x64CEcc.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\@O45_204_82_103_x64CEcc.exe
"C:\Users\Admin\AppData\Local\Temp\@O45_204_82_103_x64CEcc.exe"
Network
| Country | Destination | Domain | Proto |
| HK | 45.204.82.103:6606 | tcp | |
| HK | 45.204.82.103:6606 | tcp | |
| US | 8.8.8.8:53 | www.microsoft.com | udp |
| HK | 45.204.82.103:6606 | tcp |
Files
memory/2208-0-0x000000013FEA0000-0x000000013FF96000-memory.dmp
memory/2208-1-0x000007FEF5EE0000-0x000007FEF68CC000-memory.dmp
memory/2208-2-0x000007FEF5EE0000-0x000007FEF68CC000-memory.dmp
memory/2208-3-0x0000000077B90000-0x0000000077D39000-memory.dmp
memory/2208-4-0x000000001B9E0000-0x000000001BAC8000-memory.dmp
memory/2208-5-0x000000001BE10000-0x000000001BE90000-memory.dmp
memory/2208-6-0x0000000000870000-0x00000000008CC000-memory.dmp
memory/2208-7-0x0000000000160000-0x000000000016E000-memory.dmp
memory/2208-9-0x0000000000620000-0x0000000000638000-memory.dmp
memory/2208-10-0x0000000000600000-0x0000000000610000-memory.dmp
memory/2208-8-0x0000000000610000-0x0000000000622000-memory.dmp
memory/2208-11-0x0000000077B90000-0x0000000077D39000-memory.dmp
memory/2208-24-0x000000001BE10000-0x000000001BE90000-memory.dmp
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
| MD5 | ac05d27423a85adc1622c714f2cb6184 |
| SHA1 | b0fe2b1abddb97837ea0195be70ab2ff14d43198 |
| SHA256 | c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d |
| SHA512 | 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d |
C:\Users\Admin\AppData\Local\Temp\TarB89A.tmp
| MD5 | 9c0c641c06238516f27941aa1166d427 |
| SHA1 | 64cd549fb8cf014fcd9312aa7a5b023847b6c977 |
| SHA256 | 4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f |
| SHA512 | 936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06 |
Analysis: behavioral2
Detonation Overview
Submitted
2023-12-24 14:46
Reported
2023-12-24 14:49
Platform
win10v2004-20231215-en
Max time kernel
61s
Max time network
143s
Command Line
Signatures
Orcus
Orcurs Rat Executable
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\@O45_204_82_103_x64CEcc.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\@O45_204_82_103_x64CEcc.exe
"C:\Users\Admin\AppData\Local\Temp\@O45_204_82_103_x64CEcc.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 2.136.104.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 22.177.190.20.in-addr.arpa | udp |
| US | 138.91.171.81:80 | tcp | |
| US | 8.8.8.8:53 | 173.178.17.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.154.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 41.110.16.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.165.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 158.240.127.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 18.31.95.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 100.5.17.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 59.128.231.4.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 119.110.54.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 217.135.221.88.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 176.178.17.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 0.205.248.87.in-addr.arpa | udp |
| US | 8.8.8.8:53 | udp | |
| GB | 96.16.110.114:80 | tcp | |
| US | 8.8.8.8:53 | udp | |
| US | 8.8.8.8:53 | udp | |
| GB | 88.221.134.32:80 | tcp | |
| US | 138.91.171.81:80 | tcp | |
| US | 8.8.8.8:53 | udp | |
| GB | 88.221.134.32:80 | tcp | |
| GB | 88.221.134.32:80 | tcp | |
| GB | 88.221.134.32:80 | tcp | |
| GB | 88.221.134.32:80 | tcp | |
| GB | 88.221.134.32:80 | tcp | |
| GB | 88.221.134.32:80 | tcp | |
| GB | 88.221.134.32:80 | tcp | |
| GB | 88.221.134.32:80 | tcp | |
| GB | 88.221.134.32:80 | tcp | |
| GB | 88.221.134.32:80 | tcp | |
| HK | 45.204.82.103:6606 | tcp | |
| US | 8.8.8.8:53 | 180.178.17.96.in-addr.arpa | udp |
| US | 138.91.171.81:80 | tcp | |
| US | 8.8.8.8:53 | 211.135.221.88.in-addr.arpa | udp |
| GB | 88.221.135.211:80 | tcp | |
| GB | 96.16.110.114:80 | tcp | |
| US | 8.8.8.8:53 | 18.134.221.88.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 14.227.111.52.in-addr.arpa | udp |
| NL | 52.142.223.178:80 | tcp | |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 200.197.79.204.in-addr.arpa | udp |
| US | 8.8.8.8:53 | udp | |
| US | 8.8.8.8:53 | udp | |
| US | 8.8.8.8:53 | udp | |
| N/A | 96.17.178.180:80 | tcp | |
| GB | 96.16.110.114:80 | tcp | |
| US | 8.8.8.8:53 | udp | |
| GB | 96.17.178.209:80 | tcp | |
| GB | 96.17.178.209:80 | tcp | |
| GB | 96.17.178.209:80 | tcp |
Files
memory/1616-0-0x0000020BFBE10000-0x0000020BFBF06000-memory.dmp
memory/1616-1-0x00007FFD02490000-0x00007FFD02F51000-memory.dmp
memory/1616-2-0x00007FFD02490000-0x00007FFD02F51000-memory.dmp
memory/1616-3-0x0000020BFE360000-0x0000020BFE448000-memory.dmp
memory/1616-5-0x0000020BFE450000-0x0000020BFE4AC000-memory.dmp
memory/1616-4-0x0000020BFDA70000-0x0000020BFDA80000-memory.dmp
memory/1616-6-0x0000020BFDA60000-0x0000020BFDA6E000-memory.dmp
memory/1616-8-0x0000020BFDBF0000-0x0000020BFDC08000-memory.dmp
memory/1616-9-0x0000020BFDBD0000-0x0000020BFDBE0000-memory.dmp
memory/1616-7-0x0000020BFDBE0000-0x0000020BFDBF2000-memory.dmp
memory/1616-10-0x00007FFD20730000-0x00007FFD20925000-memory.dmp
memory/1616-14-0x0000020BFE9F0000-0x0000020BFEA2C000-memory.dmp
memory/1616-13-0x0000020BFE990000-0x0000020BFE9A2000-memory.dmp
memory/1616-15-0x0000020BFEB40000-0x0000020BFEC4A000-memory.dmp
memory/1616-16-0x0000020BFEE20000-0x0000020BFEFE2000-memory.dmp
memory/1616-17-0x0000020BFDA70000-0x0000020BFDA80000-memory.dmp
memory/1616-18-0x00007FFD20730000-0x00007FFD20925000-memory.dmp