Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
05-01-2024 01:02
Behavioral task
behavioral1
Sample
23e97c543db02964647d9adf354be9fc4506be3fb6a600fc4d77f69480659bc4.exe
Resource
win7-20231129-en
General
-
Target
23e97c543db02964647d9adf354be9fc4506be3fb6a600fc4d77f69480659bc4.exe
-
Size
920KB
-
MD5
753505f665835e0f8542f83252d8251c
-
SHA1
880a37b15bec07ce4ff748fb2e8d138754c8b636
-
SHA256
23e97c543db02964647d9adf354be9fc4506be3fb6a600fc4d77f69480659bc4
-
SHA512
91d69bcd0b6dd9e096a31db9c3778432088c69e6d329c12bba7e1803bf0dd7325338d42c76d0b6cb6a8e954a0e931754a3c7cc2f07b7c8b21700ac9b6ad9137c
-
SSDEEP
24576:iD54MROxnFt34cirrcI0AilFEvxHPf8oom:iSMijgrrcI0AilFEvxHP
Malware Config
Extracted
orcus
777
10.86.6.129:3333
bc671c436af448dd952335335bfcb715
-
autostart_method
TaskScheduler
-
enable_keylogger
true
-
install_path
%programfiles%\Orcus\Orcus.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
Windows Start
-
watchdog_path
AppData\WindowsUpdate.exe
Signatures
-
Orcus main payload 4 IoCs
Processes:
resource yara_rule C:\Program Files (x86)\Orcus\Orcus.exe family_orcus C:\Program Files (x86)\Orcus\Orcus.exe family_orcus C:\Program Files (x86)\Orcus\Orcus.exe family_orcus C:\Program Files (x86)\Orcus\Orcus.exe family_orcus -
Orcurs Rat Executable 6 IoCs
Processes:
resource yara_rule behavioral2/memory/1680-0-0x0000000000FA0000-0x000000000108C000-memory.dmp orcus C:\Program Files (x86)\Orcus\Orcus.exe orcus behavioral2/memory/1640-53-0x0000000004AC0000-0x0000000004AD0000-memory.dmp orcus C:\Program Files (x86)\Orcus\Orcus.exe orcus C:\Program Files (x86)\Orcus\Orcus.exe orcus C:\Program Files (x86)\Orcus\Orcus.exe orcus -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Orcus.exeWindowsUpdate.exe23e97c543db02964647d9adf354be9fc4506be3fb6a600fc4d77f69480659bc4.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation Orcus.exe Key value queried \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation WindowsUpdate.exe Key value queried \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation 23e97c543db02964647d9adf354be9fc4506be3fb6a600fc4d77f69480659bc4.exe -
Executes dropped EXE 6 IoCs
Processes:
WindowsInput.exeWindowsInput.exeOrcus.exeOrcus.exeWindowsUpdate.exeWindowsUpdate.exepid process 3684 WindowsInput.exe 4980 WindowsInput.exe 1640 Orcus.exe 1928 Orcus.exe 3848 WindowsUpdate.exe 3548 WindowsUpdate.exe -
Drops file in System32 directory 3 IoCs
Processes:
23e97c543db02964647d9adf354be9fc4506be3fb6a600fc4d77f69480659bc4.exeWindowsInput.exedescription ioc process File created C:\Windows\SysWOW64\WindowsInput.exe 23e97c543db02964647d9adf354be9fc4506be3fb6a600fc4d77f69480659bc4.exe File created C:\Windows\SysWOW64\WindowsInput.exe.config 23e97c543db02964647d9adf354be9fc4506be3fb6a600fc4d77f69480659bc4.exe File created C:\Windows\SysWOW64\WindowsInput.InstallState WindowsInput.exe -
Drops file in Program Files directory 3 IoCs
Processes:
23e97c543db02964647d9adf354be9fc4506be3fb6a600fc4d77f69480659bc4.exedescription ioc process File created C:\Program Files (x86)\Orcus\Orcus.exe 23e97c543db02964647d9adf354be9fc4506be3fb6a600fc4d77f69480659bc4.exe File opened for modification C:\Program Files (x86)\Orcus\Orcus.exe 23e97c543db02964647d9adf354be9fc4506be3fb6a600fc4d77f69480659bc4.exe File created C:\Program Files (x86)\Orcus\Orcus.exe.config 23e97c543db02964647d9adf354be9fc4506be3fb6a600fc4d77f69480659bc4.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
WindowsUpdate.exeOrcus.exepid process 3548 WindowsUpdate.exe 3548 WindowsUpdate.exe 1640 Orcus.exe 1640 Orcus.exe 3548 WindowsUpdate.exe 1640 Orcus.exe 1640 Orcus.exe 3548 WindowsUpdate.exe 3548 WindowsUpdate.exe 1640 Orcus.exe 1640 Orcus.exe 3548 WindowsUpdate.exe 3548 WindowsUpdate.exe 1640 Orcus.exe 1640 Orcus.exe 3548 WindowsUpdate.exe 3548 WindowsUpdate.exe 1640 Orcus.exe 1640 Orcus.exe 3548 WindowsUpdate.exe 3548 WindowsUpdate.exe 1640 Orcus.exe 1640 Orcus.exe 3548 WindowsUpdate.exe 1640 Orcus.exe 3548 WindowsUpdate.exe 1640 Orcus.exe 3548 WindowsUpdate.exe 1640 Orcus.exe 3548 WindowsUpdate.exe 1640 Orcus.exe 3548 WindowsUpdate.exe 1640 Orcus.exe 3548 WindowsUpdate.exe 3548 WindowsUpdate.exe 1640 Orcus.exe 3548 WindowsUpdate.exe 1640 Orcus.exe 1640 Orcus.exe 3548 WindowsUpdate.exe 3548 WindowsUpdate.exe 1640 Orcus.exe 3548 WindowsUpdate.exe 1640 Orcus.exe 3548 WindowsUpdate.exe 1640 Orcus.exe 1640 Orcus.exe 3548 WindowsUpdate.exe 3548 WindowsUpdate.exe 1640 Orcus.exe 1640 Orcus.exe 3548 WindowsUpdate.exe 1640 Orcus.exe 3548 WindowsUpdate.exe 1640 Orcus.exe 3548 WindowsUpdate.exe 3548 WindowsUpdate.exe 1640 Orcus.exe 1640 Orcus.exe 3548 WindowsUpdate.exe 3548 WindowsUpdate.exe 1640 Orcus.exe 3548 WindowsUpdate.exe 1640 Orcus.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Orcus.exeWindowsUpdate.exeWindowsUpdate.exedescription pid process Token: SeDebugPrivilege 1640 Orcus.exe Token: SeDebugPrivilege 3848 WindowsUpdate.exe Token: SeDebugPrivilege 3548 WindowsUpdate.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
Orcus.exepid process 1640 Orcus.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
Orcus.exepid process 1640 Orcus.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Orcus.exepid process 1640 Orcus.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
23e97c543db02964647d9adf354be9fc4506be3fb6a600fc4d77f69480659bc4.exeOrcus.exeWindowsUpdate.exedescription pid process target process PID 1680 wrote to memory of 3684 1680 23e97c543db02964647d9adf354be9fc4506be3fb6a600fc4d77f69480659bc4.exe WindowsInput.exe PID 1680 wrote to memory of 3684 1680 23e97c543db02964647d9adf354be9fc4506be3fb6a600fc4d77f69480659bc4.exe WindowsInput.exe PID 1680 wrote to memory of 1640 1680 23e97c543db02964647d9adf354be9fc4506be3fb6a600fc4d77f69480659bc4.exe Orcus.exe PID 1680 wrote to memory of 1640 1680 23e97c543db02964647d9adf354be9fc4506be3fb6a600fc4d77f69480659bc4.exe Orcus.exe PID 1680 wrote to memory of 1640 1680 23e97c543db02964647d9adf354be9fc4506be3fb6a600fc4d77f69480659bc4.exe Orcus.exe PID 1640 wrote to memory of 3848 1640 Orcus.exe WindowsUpdate.exe PID 1640 wrote to memory of 3848 1640 Orcus.exe WindowsUpdate.exe PID 1640 wrote to memory of 3848 1640 Orcus.exe WindowsUpdate.exe PID 3848 wrote to memory of 3548 3848 WindowsUpdate.exe WindowsUpdate.exe PID 3848 wrote to memory of 3548 3848 WindowsUpdate.exe WindowsUpdate.exe PID 3848 wrote to memory of 3548 3848 WindowsUpdate.exe WindowsUpdate.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\23e97c543db02964647d9adf354be9fc4506be3fb6a600fc4d77f69480659bc4.exe"C:\Users\Admin\AppData\Local\Temp\23e97c543db02964647d9adf354be9fc4506be3fb6a600fc4d77f69480659bc4.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsInput.exe"C:\Windows\SysWOW64\WindowsInput.exe" --install2⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Program Files (x86)\Orcus\Orcus.exe"C:\Program Files (x86)\Orcus\Orcus.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\WindowsUpdate.exe"C:\Users\Admin\AppData\Roaming\WindowsUpdate.exe" /launchSelfAndExit "C:\Program Files (x86)\Orcus\Orcus.exe" 1640 /protectFile3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsInput.exe"C:\Windows\SysWOW64\WindowsInput.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\WindowsUpdate.exe"C:\Users\Admin\AppData\Roaming\WindowsUpdate.exe" /watchProcess "C:\Program Files (x86)\Orcus\Orcus.exe" 1640 "/protectFile"1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Orcus\Orcus.exe"C:\Program Files (x86)\Orcus\Orcus.exe"1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Orcus\Orcus.exeFilesize
652KB
MD5d170cb41663519b7d62ceb9b46f3dc60
SHA10b63124a8f4830368b213544e12efd6820fc0fa8
SHA2565ad765a0620b83f3ea41eaeef318842b5081fff6b5dcb903b629500ff45691da
SHA512671ce83ddd246a4d8f941670ebe49820e4cf22a670fe992acf47ec18a5d5b12d5739ff2a95d6fa28c8d529067a68d4b3ec3505cbe88726dcada273b1a1baf84b
-
C:\Program Files (x86)\Orcus\Orcus.exeFilesize
516KB
MD505a85feb6a64e7bea76a5e62d4bac280
SHA16d5091f8e14ef66adfbcefb64f6c295511903baa
SHA2564029b12013ced488cabaee9b0eff5813d9d181850f598963ca0513ed90947c74
SHA51278d21644521a22a47a701053ca195bde9c22e5c1924ecd83afb1ad0a4038886ac1b3bd2405c13890ba289a29fd8cb42e346785f7700f41989339edf5f2fe4b0d
-
C:\Program Files (x86)\Orcus\Orcus.exeFilesize
38KB
MD595fb8dcde6ed1c23d7368fca327afa4f
SHA1065be48aa51bed8cec9a84eff21365638c200a1f
SHA256167d11bc988abc6eeb16500179edde5160189dc1467c1a500e0222bd744d7d2d
SHA5125d7cdbe779b0f73a1d5897168bbb844c1f522e84029206305a9ee56269931746874beed62a145a7f716835d1cc6ba62d8fca4093a52ebfffc2f0ac7e344cabdd
-
C:\Program Files (x86)\Orcus\Orcus.exeFilesize
347KB
MD5bd9ec5d01bd0c80eb06890e2235305f2
SHA1b58944e77853b3d285d66c13057618c9d69ebcda
SHA25620aaa34b68eba4f2edca3539926a270507e0dbfaf8958ba85198bee1f5c24ac7
SHA51218e0b5f78c959e00836aeb4f082b8fc8f81506746c529fdbfef1c2dd97e75ace8e38e08221d150d685552b6a4a23e3aa139af12a72630ea77d5f830ec041f348
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\WindowsUpdate.exe.logFilesize
425B
MD54eaca4566b22b01cd3bc115b9b0b2196
SHA1e743e0792c19f71740416e7b3c061d9f1336bf94
SHA25634ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb
SHA512bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1
-
C:\Users\Admin\AppData\Roaming\WindowsUpdate.exeFilesize
9KB
MD5913967b216326e36a08010fb70f9dba3
SHA17b6f8c2eb5b443e03c212b85c2f0edb9c76ad2bf
SHA2568d880758549220154d2ff4ee578f2b49527c5fb76a07d55237b61e30bcc09e3a
SHA512c6fcb98d9fd509e9834fc3fba143bd36d41869cc104fbce5354951f0a6756156e34a30796baaa130dd45de3ed96e039ec14716716f6da4569915c7ef2d2b6c33
-
C:\Windows\SysWOW64\WindowsInput.exeFilesize
21KB
MD5e6fcf516d8ed8d0d4427f86e08d0d435
SHA1c7691731583ab7890086635cb7f3e4c22ca5e409
SHA2568dbe814359391ed6b0b5b182039008cf1d00964da9fbc4747f46242a95c24337
SHA512c496cf8e2e222fe1e19051b291e6860f31aae39f54369c1c5e8c9758c4b56e8af904e3e536e743a0a6fdbbf8478afba4baee92e13fc1b3073376ac6bf4a7948e
-
C:\Windows\SysWOW64\WindowsInput.exe.configFilesize
357B
MD5a2b76cea3a59fa9af5ea21ff68139c98
SHA135d76475e6a54c168f536e30206578babff58274
SHA256f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839
SHA512b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad
-
memory/1640-55-0x0000000005810000-0x0000000005828000-memory.dmpFilesize
96KB
-
memory/1640-53-0x0000000004AC0000-0x0000000004AD0000-memory.dmpFilesize
64KB
-
memory/1640-60-0x0000000005BB0000-0x0000000005BC0000-memory.dmpFilesize
64KB
-
memory/1640-54-0x00000000050D0000-0x000000000511E000-memory.dmpFilesize
312KB
-
memory/1640-51-0x0000000074ED0000-0x0000000075680000-memory.dmpFilesize
7.7MB
-
memory/1640-62-0x00000000060B0000-0x00000000060BA000-memory.dmpFilesize
40KB
-
memory/1640-88-0x0000000004AC0000-0x0000000004AD0000-memory.dmpFilesize
64KB
-
memory/1640-87-0x0000000074ED0000-0x0000000075680000-memory.dmpFilesize
7.7MB
-
memory/1640-57-0x00000000059E0000-0x00000000059F8000-memory.dmpFilesize
96KB
-
memory/1640-58-0x0000000005D90000-0x0000000005F52000-memory.dmpFilesize
1.8MB
-
memory/1680-52-0x0000000074ED0000-0x0000000075680000-memory.dmpFilesize
7.7MB
-
memory/1680-8-0x0000000005B90000-0x0000000005B98000-memory.dmpFilesize
32KB
-
memory/1680-1-0x0000000074ED0000-0x0000000075680000-memory.dmpFilesize
7.7MB
-
memory/1680-2-0x0000000005A60000-0x0000000005A70000-memory.dmpFilesize
64KB
-
memory/1680-0-0x0000000000FA0000-0x000000000108C000-memory.dmpFilesize
944KB
-
memory/1680-9-0x0000000006000000-0x0000000006022000-memory.dmpFilesize
136KB
-
memory/1680-3-0x0000000003390000-0x000000000339E000-memory.dmpFilesize
56KB
-
memory/1680-4-0x0000000005A70000-0x0000000005ACC000-memory.dmpFilesize
368KB
-
memory/1680-7-0x0000000005B80000-0x0000000005B92000-memory.dmpFilesize
72KB
-
memory/1680-6-0x0000000005BA0000-0x0000000005C32000-memory.dmpFilesize
584KB
-
memory/1680-5-0x0000000006080000-0x0000000006624000-memory.dmpFilesize
5.6MB
-
memory/1928-84-0x0000000074ED0000-0x0000000075680000-memory.dmpFilesize
7.7MB
-
memory/1928-59-0x0000000074ED0000-0x0000000075680000-memory.dmpFilesize
7.7MB
-
memory/1928-61-0x00000000058D0000-0x00000000058E0000-memory.dmpFilesize
64KB
-
memory/3548-89-0x0000000074ED0000-0x0000000075680000-memory.dmpFilesize
7.7MB
-
memory/3548-82-0x0000000074ED0000-0x0000000075680000-memory.dmpFilesize
7.7MB
-
memory/3684-23-0x0000000000450000-0x000000000045C000-memory.dmpFilesize
48KB
-
memory/3684-24-0x0000000002600000-0x0000000002612000-memory.dmpFilesize
72KB
-
memory/3684-26-0x000000001C120000-0x000000001C15C000-memory.dmpFilesize
240KB
-
memory/3684-25-0x00007FFCA03F0000-0x00007FFCA0EB1000-memory.dmpFilesize
10.8MB
-
memory/3684-31-0x00007FFCA03F0000-0x00007FFCA0EB1000-memory.dmpFilesize
10.8MB
-
memory/3684-27-0x000000001B020000-0x000000001B030000-memory.dmpFilesize
64KB
-
memory/3848-81-0x0000000074ED0000-0x0000000075680000-memory.dmpFilesize
7.7MB
-
memory/3848-76-0x0000000000C20000-0x0000000000C28000-memory.dmpFilesize
32KB
-
memory/3848-77-0x0000000074ED0000-0x0000000075680000-memory.dmpFilesize
7.7MB
-
memory/4980-33-0x00007FFCA03F0000-0x00007FFCA0EB1000-memory.dmpFilesize
10.8MB
-
memory/4980-86-0x000000001A230000-0x000000001A240000-memory.dmpFilesize
64KB
-
memory/4980-85-0x00007FFCA03F0000-0x00007FFCA0EB1000-memory.dmpFilesize
10.8MB
-
memory/4980-34-0x000000001A230000-0x000000001A240000-memory.dmpFilesize
64KB
-
memory/4980-35-0x000000001A650000-0x000000001A75A000-memory.dmpFilesize
1.0MB