Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
131s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
27/01/2024, 01:19
General
-
Target
5a7e4eb21012621383ec2a556e63202d42334c02da350c1eaa7af7d1c9088691.exe
-
Size
3.0MB
-
MD5
f210202bfa18db14c6ec346037e4cb64
-
SHA1
be0a794a92753d152eebf2c9478da14156d1084f
-
SHA256
5a7e4eb21012621383ec2a556e63202d42334c02da350c1eaa7af7d1c9088691
-
SHA512
a6b5d64679a0a52a1357ae23890ee324788c2fedfcb03059f9d083ae423df060a93983053a277a3f577b296821754596cd0b876d160a309b888569cde738a49d
-
SSDEEP
49152:Y1HS7p1EZKMnkmWg8LX5prviYDyKS5AypQxbRQAo9JnCmpbu/nRFfjI7L0qb:YUHTPJg8z1mKnypSbRxo9JCm
Malware Config
Extracted
orcus
Новый тег
31.44.184.52:23303
sudo_ofcp37vv54izlwrf1h65z8l5gj4mqi71
-
autostart_method
Disable
-
enable_keylogger
false
-
install_path
%appdata%\toprocessorcdn\local_.exe
-
reconnect_delay
10000
-
registry_keyname
Sudik
-
taskscheduler_taskname
sudik
-
watchdog_path
AppData\aga.exe
Signatures
-
Orcus
Orcus is a Remote Access Trojan that is being sold on underground forums.
-
Orcus main payload 4 IoCs
-
Orcurs Rat Executable 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 4 IoCs
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5a7e4eb21012621383ec2a556e63202d42334c02da350c1eaa7af7d1c9088691.exe"C:\Users\Admin\AppData\Local\Temp\5a7e4eb21012621383ec2a556e63202d42334c02da350c1eaa7af7d1c9088691.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\toprocessorcdn\local_.exe"C:\Users\Admin\AppData\Roaming\toprocessorcdn\local_.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\toprocessorcdn\local_.exeC:\Users\Admin\AppData\Roaming\toprocessorcdn\local_.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\toprocessorcdn\local_.exeC:\Users\Admin\AppData\Roaming\toprocessorcdn\local_.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\toprocessorcdn\local_.exeC:\Users\Admin\AppData\Roaming\toprocessorcdn\local_.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5663b8d5469caa4489d463aa9bc18124f
SHA1e57123a7d969115853ea631a3b33826335025d28
SHA2567b4fa505452f0b8ac74bb31f5a03b13342836318018fb18d224ae2ff11b1a7e8
SHA51245e373295125a629fcc0b19609608d969c9106514918bfac5d6b8e340e407434577b825741b8fa6a043c8f3f5c1a030ba8857da5f4e8ef15a551ce3c5fe03b55
-
Filesize
3.0MB
MD5f210202bfa18db14c6ec346037e4cb64
SHA1be0a794a92753d152eebf2c9478da14156d1084f
SHA2565a7e4eb21012621383ec2a556e63202d42334c02da350c1eaa7af7d1c9088691
SHA512a6b5d64679a0a52a1357ae23890ee324788c2fedfcb03059f9d083ae423df060a93983053a277a3f577b296821754596cd0b876d160a309b888569cde738a49d
-
Filesize
1.9MB
MD5225315bf7ee6c35099a12247cb0ca27d
SHA18c6835006c901e0e02b49dbb0d810c70c1d47d7f
SHA25632a71e387f660534e4c4ee90ecd04ac691463d987af3f5739bc01851a8d26a69
SHA51240f86119a0c416142fcc6815a30530d73a762144c2a6138e859c0f7377864437dc3602abf8ac021e55af7f262dc76598e3dd5cadd56710af0f7ed2ab243fd2af
-
Filesize
1.9MB
MD50083007cda01a473f4a165b78ee383f2
SHA1302037c853ee70693c840ca38e85a8b7587e0f22
SHA2563e15dd6cdfb9d8e944b3e00f40495368689ea0e06825d4daef209d112f304456
SHA512f68498e7bdb6145913e186907c14cde635cbe6916fb6927aa4631679e5b6b7e51a644745754f4f90c15a6f56b32bd02da7e7279b91f88fdad29e07d96970fd1d
-
Filesize
1.0MB
MD5ff8679fdafc86d590fcd5fd1a50bfb2a
SHA1b618cbe62c66251d8c29ba2849c97574a54dcbec
SHA25696b0e0d22ec247573920cc3457a1dceb63a13802f7f558f45f25a036caf72d22
SHA5121b0f9cbf1f75165af109aff0094a12ed21f0808fc1a7c06c6595c892aac345d64f08362a8e274f38edc636d4af64d1dfae3656d9a062f51f0f7d732464e92fbb
-
Filesize
357B
MD5a2b76cea3a59fa9af5ea21ff68139c98
SHA135d76475e6a54c168f536e30206578babff58274
SHA256f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839
SHA512b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad
-
Filesize
312KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
624KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
56KB
-
Filesize
72KB
-
Filesize
368KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
5.6MB
-
Filesize
3.0MB
-
Filesize
584KB
-
Filesize
64KB
-
Filesize
1.0MB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
96KB
-
Filesize
64KB
-
Filesize
40KB
-
Filesize
408KB
-
Filesize
6.1MB
-
Filesize
72KB
-
Filesize
240KB
-
Filesize
304KB
-
Filesize
320KB
-
Filesize
7.7MB
-
Filesize
1.8MB
-
Filesize
56KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
7.7MB