Analysis
- max time kernel
148s - max time network
137s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
- submitted
08/01/2024, 01:11
General
- Target 029e1ac599d7cce9e16d0eaba1e35bfb8622c38e59e09e6e3bf7a7fcdb30118d.exe
- Size 913KB
- Sample240108-bke4yshebl
- SHA256 029e1ac599d7cce9e16d0eaba1e35bfb8622c38e59e09e6e3bf7a7fcdb30118d
Malware Config
Extracted
-
orcus
-
nonamedc.mcv.kr:8080
-
fcca7214f2cf43aa90403230957e4103
-
autostart_method
Disable
-
enable_keylogger
true
-
install_path
%programfiles%\Orcus\Orcus.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
Orcus
-
watchdog_path
AppData\OrcusWatchdog.exe
Signatures
- Orcus
Orcus is a Remote Access Trojan that is being sold on underground forums.
- Orcurs Rat Executable 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\029e1ac599d7cce9e16d0eaba1e35bfb8622c38e59e09e6e3bf7a7fcdb30118d.exe"C:\Users\Admin\AppData\Local\Temp\029e1ac599d7cce9e16d0eaba1e35bfb8622c38e59e09e6e3bf7a7fcdb30118d.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1776-0-0x0000000000C80000-0x0000000000D6A000-memory.dmp
memory/1776-1-0x00007FFDCF590000-0x00007FFDD0051000-memory.dmp
memory/1776-3-0x000000001B8B0000-0x000000001B90C000-memory.dmp
memory/1776-4-0x0000000001510000-0x000000000151E000-memory.dmp
memory/1776-2-0x000000001B9E0000-0x000000001B9F0000-memory.dmp
memory/1776-5-0x0000000002E10000-0x0000000002E22000-memory.dmp
memory/1776-7-0x0000000002E20000-0x0000000002E28000-memory.dmp
memory/1776-6-0x0000000002E00000-0x0000000002E08000-memory.dmp
memory/1776-9-0x000000001B970000-0x000000001B9AC000-memory.dmp
memory/1776-8-0x000000001B910000-0x000000001B922000-memory.dmp
memory/1776-10-0x000000001C250000-0x000000001C35A000-memory.dmp
memory/1776-12-0x000000001B9C0000-0x000000001B9D8000-memory.dmp
memory/1776-14-0x000000001C560000-0x000000001C570000-memory.dmp
memory/1776-13-0x000000001C790000-0x000000001C952000-memory.dmp
memory/1776-15-0x00007FFDCF590000-0x00007FFDD0051000-memory.dmp
memory/1776-16-0x000000001B9E0000-0x000000001B9F0000-memory.dmp