Analysis
-
max time kernel
145s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
26-01-2024 00:29
Static task
static1
Behavioral task
behavioral1
Sample
75e95a530e5fe926bcca7c2c1a008e18.exe
Resource
win7-20231129-en
General
-
Target
75e95a530e5fe926bcca7c2c1a008e18.exe
-
Size
789KB
-
MD5
75e95a530e5fe926bcca7c2c1a008e18
-
SHA1
ff759b9abdd18c05b51509f92146a801f3fae939
-
SHA256
bdca302a43dfd30f874ce13b2a20f4211e7bd88eba40a0c41f30873389133d3d
-
SHA512
ad2cc5878b248cda26e5464dea496ea67ddd9bdf120c56dceee2581a167ae0771d19b68c19b62f4c487d045b0680c7d3892ba8aa99023e93b6391ea8d49821da
-
SSDEEP
24576:eUM7cLQ/K+2KnKNrk/eXIXVXSOUKoNsxcv3:eb7c1NLEVXSOLoew
Malware Config
Extracted
orcus
$
lsdw.dyndns.org:10134
bad69595827c48b5b9b2ea99aaff68b6
-
autostart_method
Disable
-
enable_keylogger
true
-
install_path
%programfiles%\Orcus\Orcus.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
Orcus
-
watchdog_path
AppData\OrcusWatchdog.exe
Signatures
-
Processes:
mydoc.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mydoc.exe -
Orcurs Rat Executable 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2176-18-0x0000000004F70000-0x0000000005052000-memory.dmp orcus behavioral1/memory/2176-17-0x0000000004F70000-0x0000000005058000-memory.dmp orcus -
Processes:
mydoc.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mydoc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mydoc.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
75e95a530e5fe926bcca7c2c1a008e18.exemydoc.exepid process 2936 75e95a530e5fe926bcca7c2c1a008e18.exe 2936 75e95a530e5fe926bcca7c2c1a008e18.exe 2176 mydoc.exe 2176 mydoc.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
75e95a530e5fe926bcca7c2c1a008e18.exepid process 2936 75e95a530e5fe926bcca7c2c1a008e18.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
75e95a530e5fe926bcca7c2c1a008e18.exemydoc.exedescription pid process Token: SeDebugPrivilege 2936 75e95a530e5fe926bcca7c2c1a008e18.exe Token: SeDebugPrivilege 2176 mydoc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
mydoc.exepid process 2176 mydoc.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
75e95a530e5fe926bcca7c2c1a008e18.execmd.exemydoc.execmd.execmd.exedescription pid process target process PID 2936 wrote to memory of 3064 2936 75e95a530e5fe926bcca7c2c1a008e18.exe cmd.exe PID 2936 wrote to memory of 3064 2936 75e95a530e5fe926bcca7c2c1a008e18.exe cmd.exe PID 2936 wrote to memory of 3064 2936 75e95a530e5fe926bcca7c2c1a008e18.exe cmd.exe PID 2936 wrote to memory of 3064 2936 75e95a530e5fe926bcca7c2c1a008e18.exe cmd.exe PID 3064 wrote to memory of 2176 3064 cmd.exe mydoc.exe PID 3064 wrote to memory of 2176 3064 cmd.exe mydoc.exe PID 3064 wrote to memory of 2176 3064 cmd.exe mydoc.exe PID 3064 wrote to memory of 2176 3064 cmd.exe mydoc.exe PID 2176 wrote to memory of 2612 2176 mydoc.exe cmd.exe PID 2176 wrote to memory of 2612 2176 mydoc.exe cmd.exe PID 2176 wrote to memory of 2612 2176 mydoc.exe cmd.exe PID 2176 wrote to memory of 2612 2176 mydoc.exe cmd.exe PID 2612 wrote to memory of 2672 2612 cmd.exe schtasks.exe PID 2612 wrote to memory of 2672 2612 cmd.exe schtasks.exe PID 2612 wrote to memory of 2672 2612 cmd.exe schtasks.exe PID 2612 wrote to memory of 2672 2612 cmd.exe schtasks.exe PID 2176 wrote to memory of 2748 2176 mydoc.exe cmd.exe PID 2176 wrote to memory of 2748 2176 mydoc.exe cmd.exe PID 2176 wrote to memory of 2748 2176 mydoc.exe cmd.exe PID 2176 wrote to memory of 2748 2176 mydoc.exe cmd.exe PID 2748 wrote to memory of 2892 2748 cmd.exe schtasks.exe PID 2748 wrote to memory of 2892 2748 cmd.exe schtasks.exe PID 2748 wrote to memory of 2892 2748 cmd.exe schtasks.exe PID 2748 wrote to memory of 2892 2748 cmd.exe schtasks.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
mydoc.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mydoc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\75e95a530e5fe926bcca7c2c1a008e18.exe"C:\Users\Admin\AppData\Local\Temp\75e95a530e5fe926bcca7c2c1a008e18.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Videos\show\mydoc.exe"C:\Users\Admin\Videos\show\mydoc.exe"3⤵
- UAC bypass
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /Create /TN "Update\doc" /XML "C:\Users\Admin\AppData\Local\Temp\1023345752.xml"1⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /Delete /TN "Update\doc" /F1⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd"1⤵
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\1023345752.xmlFilesize
1KB
MD5504faf2eec3da638def3d5d29af63d3b
SHA124691548689fadcf6f865af9c02884bdf9e9d181
SHA256e8b2c6e06485746ebfec64819bd85f3bd578e4144d17548624b65544a52b85e0
SHA51263f0c9f260c24bfdfac24bd8cc46e3d370d80172bae44314361cfe143f574d5e6aaeaafc25c2104fdc03490de7eef7a0ca99419ad68691b400b67a1cd436b99e
-
memory/2176-22-0x00000000004E0000-0x00000000004F2000-memory.dmpFilesize
72KB
-
memory/2176-25-0x00000000747B0000-0x0000000074E9E000-memory.dmpFilesize
6.9MB
-
memory/2176-20-0x0000000000460000-0x000000000046E000-memory.dmpFilesize
56KB
-
memory/2176-21-0x0000000000B80000-0x0000000000BDC000-memory.dmpFilesize
368KB
-
memory/2176-11-0x0000000004B20000-0x0000000004B60000-memory.dmpFilesize
256KB
-
memory/2176-10-0x0000000000D00000-0x0000000000DB2000-memory.dmpFilesize
712KB
-
memory/2176-9-0x00000000747B0000-0x0000000074E9E000-memory.dmpFilesize
6.9MB
-
memory/2176-24-0x0000000000AB0000-0x0000000000AC0000-memory.dmpFilesize
64KB
-
memory/2176-23-0x00000000009C0000-0x00000000009D8000-memory.dmpFilesize
96KB
-
memory/2176-18-0x0000000004F70000-0x0000000005052000-memory.dmpFilesize
904KB
-
memory/2176-17-0x0000000004F70000-0x0000000005058000-memory.dmpFilesize
928KB
-
memory/2936-2-0x0000000004970000-0x0000000004A22000-memory.dmpFilesize
712KB
-
memory/2936-3-0x0000000006FE0000-0x000000000709A000-memory.dmpFilesize
744KB
-
memory/2936-1-0x00000000747B0000-0x0000000074E9E000-memory.dmpFilesize
6.9MB
-
memory/2936-0-0x0000000000DB0000-0x0000000000E7A000-memory.dmpFilesize
808KB
-
memory/2936-8-0x00000000747B0000-0x0000000074E9E000-memory.dmpFilesize
6.9MB
-
memory/2936-6-0x0000000000900000-0x0000000000904000-memory.dmpFilesize
16KB
-
memory/2936-5-0x0000000000900000-0x000000000090A000-memory.dmpFilesize
40KB
-
memory/2936-4-0x0000000004AC0000-0x0000000004B00000-memory.dmpFilesize
256KB