Analysis
-
max time kernel
144s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
26-01-2024 00:29
Static task
static1
Behavioral task
behavioral1
Sample
75e95a530e5fe926bcca7c2c1a008e18.exe
Resource
win7-20231129-en
General
-
Target
75e95a530e5fe926bcca7c2c1a008e18.exe
-
Size
789KB
-
MD5
75e95a530e5fe926bcca7c2c1a008e18
-
SHA1
ff759b9abdd18c05b51509f92146a801f3fae939
-
SHA256
bdca302a43dfd30f874ce13b2a20f4211e7bd88eba40a0c41f30873389133d3d
-
SHA512
ad2cc5878b248cda26e5464dea496ea67ddd9bdf120c56dceee2581a167ae0771d19b68c19b62f4c487d045b0680c7d3892ba8aa99023e93b6391ea8d49821da
-
SSDEEP
24576:eUM7cLQ/K+2KnKNrk/eXIXVXSOUKoNsxcv3:eb7c1NLEVXSOLoew
Malware Config
Extracted
orcus
$
lsdw.dyndns.org:10134
bad69595827c48b5b9b2ea99aaff68b6
-
autostart_method
Disable
-
enable_keylogger
true
-
install_path
%programfiles%\Orcus\Orcus.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
Orcus
-
watchdog_path
AppData\OrcusWatchdog.exe
Signatures
-
Processes:
mydoc.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mydoc.exe -
Orcurs Rat Executable 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4892-15-0x0000000005D60000-0x0000000005E48000-memory.dmp orcus -
Processes:
mydoc.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mydoc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mydoc.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
75e95a530e5fe926bcca7c2c1a008e18.exemydoc.exepid process 1684 75e95a530e5fe926bcca7c2c1a008e18.exe 1684 75e95a530e5fe926bcca7c2c1a008e18.exe 4892 mydoc.exe 4892 mydoc.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
75e95a530e5fe926bcca7c2c1a008e18.exepid process 1684 75e95a530e5fe926bcca7c2c1a008e18.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
75e95a530e5fe926bcca7c2c1a008e18.exemydoc.exedescription pid process Token: SeDebugPrivilege 1684 75e95a530e5fe926bcca7c2c1a008e18.exe Token: SeDebugPrivilege 4892 mydoc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
mydoc.exepid process 4892 mydoc.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
75e95a530e5fe926bcca7c2c1a008e18.execmd.exemydoc.execmd.execmd.exedescription pid process target process PID 1684 wrote to memory of 1764 1684 75e95a530e5fe926bcca7c2c1a008e18.exe cmd.exe PID 1684 wrote to memory of 1764 1684 75e95a530e5fe926bcca7c2c1a008e18.exe cmd.exe PID 1684 wrote to memory of 1764 1684 75e95a530e5fe926bcca7c2c1a008e18.exe cmd.exe PID 1764 wrote to memory of 4892 1764 cmd.exe mydoc.exe PID 1764 wrote to memory of 4892 1764 cmd.exe mydoc.exe PID 1764 wrote to memory of 4892 1764 cmd.exe mydoc.exe PID 4892 wrote to memory of 4160 4892 mydoc.exe cmd.exe PID 4892 wrote to memory of 4160 4892 mydoc.exe cmd.exe PID 4892 wrote to memory of 4160 4892 mydoc.exe cmd.exe PID 4160 wrote to memory of 3128 4160 cmd.exe schtasks.exe PID 4160 wrote to memory of 3128 4160 cmd.exe schtasks.exe PID 4160 wrote to memory of 3128 4160 cmd.exe schtasks.exe PID 4892 wrote to memory of 2560 4892 mydoc.exe cmd.exe PID 4892 wrote to memory of 2560 4892 mydoc.exe cmd.exe PID 4892 wrote to memory of 2560 4892 mydoc.exe cmd.exe PID 2560 wrote to memory of 760 2560 cmd.exe schtasks.exe PID 2560 wrote to memory of 760 2560 cmd.exe schtasks.exe PID 2560 wrote to memory of 760 2560 cmd.exe schtasks.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
mydoc.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mydoc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\75e95a530e5fe926bcca7c2c1a008e18.exe"C:\Users\Admin\AppData\Local\Temp\75e95a530e5fe926bcca7c2c1a008e18.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Videos\show\mydoc.exe"C:\Users\Admin\Videos\show\mydoc.exe"3⤵
- UAC bypass
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\cmd.exe"cmd"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /Create /TN "Update\doc" /XML "C:\Users\Admin\AppData\Local\Temp\1224041128.xml"5⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /Delete /TN "Update\doc" /F1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\1224041128.xmlFilesize
1KB
MD5c542f8e53bf2688b7f66170adccc6921
SHA18d82130718f8f0d8a8a779ef4e788b80ff53724d
SHA2564c4319c45330e7f34179a8f2dde9ed03f78fa8f97ea2e4ce601b07a4a769300f
SHA512ad170014abbcb25d96af95fc905c308626ec3df47b2fae21b374635bdf017e01561b1a3c323a757109a8fa3ab5adc0764af2e8107d9eef424aa9791d4e6bf80c
-
memory/1684-5-0x00000000056F0000-0x00000000057AA000-memory.dmpFilesize
744KB
-
memory/1684-3-0x00000000058B0000-0x0000000005E54000-memory.dmpFilesize
5.6MB
-
memory/1684-2-0x0000000005260000-0x00000000052FC000-memory.dmpFilesize
624KB
-
memory/1684-4-0x0000000005510000-0x00000000055C2000-memory.dmpFilesize
712KB
-
memory/1684-0-0x0000000000820000-0x00000000008EA000-memory.dmpFilesize
808KB
-
memory/1684-6-0x0000000005400000-0x0000000005410000-memory.dmpFilesize
64KB
-
memory/1684-7-0x00000000013C0000-0x00000000013CA000-memory.dmpFilesize
40KB
-
memory/1684-9-0x0000000075000000-0x00000000757B0000-memory.dmpFilesize
7.7MB
-
memory/1684-1-0x0000000075000000-0x00000000757B0000-memory.dmpFilesize
7.7MB
-
memory/4892-15-0x0000000005D60000-0x0000000005E48000-memory.dmpFilesize
928KB
-
memory/4892-25-0x00000000052E0000-0x00000000052F0000-memory.dmpFilesize
64KB
-
memory/4892-16-0x00000000052D0000-0x00000000052DE000-memory.dmpFilesize
56KB
-
memory/4892-10-0x0000000075000000-0x00000000757B0000-memory.dmpFilesize
7.7MB
-
memory/4892-18-0x00000000060F0000-0x0000000006182000-memory.dmpFilesize
584KB
-
memory/4892-17-0x0000000005F90000-0x0000000005FEC000-memory.dmpFilesize
368KB
-
memory/4892-19-0x0000000006030000-0x0000000006042000-memory.dmpFilesize
72KB
-
memory/4892-22-0x0000000006760000-0x0000000006770000-memory.dmpFilesize
64KB
-
memory/4892-21-0x0000000006940000-0x0000000006B02000-memory.dmpFilesize
1.8MB
-
memory/4892-20-0x00000000065D0000-0x00000000065E8000-memory.dmpFilesize
96KB
-
memory/4892-23-0x0000000006860000-0x000000000686A000-memory.dmpFilesize
40KB
-
memory/4892-24-0x0000000075000000-0x00000000757B0000-memory.dmpFilesize
7.7MB
-
memory/4892-11-0x00000000052E0000-0x00000000052F0000-memory.dmpFilesize
64KB