Analysis

  • max time kernel
    149s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    04-02-2024 20:18

General

  • Target

    file.bin.exe

  • Size

    916KB

  • MD5

    bdbe50403b411db0e07511e098bdb9ff

  • SHA1

    5772743e950c1c647a5cab202fc3cc29039e2749

  • SHA256

    a758763a7fb30398cbdab370be24c389a1927fb376772fcb31f4017ca942a284

  • SHA512

    9531b3c7572f07aaac342635369732b77c1df58c262e32b21327cd2ac47afe6e3042d79a6a72e30c07b03e420cd9b47b1781bc5ed875b8d7b973b480090261f9

  • SSDEEP

    24576:+cI4MROxnFD3jEsYxrZlI0AilFEvxHiH0h9:+crMiJWrZlI0AilFEvxHi

Malware Config

Extracted

Family

orcus

C2

obfuscated.us:8080

Mutex

0133d229c4e24006957c0e4ab3a52531

Attributes
  • autostart_method

    Registry

  • enable_keylogger

    false

  • install_path

    %programfiles%\Orcus\Orcus.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\OrcusWatchdog.exe

Signatures

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

  • Orcus main payload 3 IoCs
  • Orcurs Rat Executable 4 IoCs
  • Executes dropped EXE 6 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 3 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.bin.exe
    "C:\Users\Admin\AppData\Local\Temp\file.bin.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:2376
    • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zw26fhyn.cmdline"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2668
      • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1259.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC1249.tmp"
        3⤵
          PID:2796
      • C:\Windows\SysWOW64\WindowsInput.exe
        "C:\Windows\SysWOW64\WindowsInput.exe" --install
        2⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        PID:2264
      • C:\Program Files\Orcus\Orcus.exe
        "C:\Program Files\Orcus\Orcus.exe"
        2⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:2992
        • C:\Users\Admin\AppData\Roaming\OrcusWatchdog.exe
          "C:\Users\Admin\AppData\Roaming\OrcusWatchdog.exe" /launchSelfAndExit "C:\Program Files\Orcus\Orcus.exe" 2992
          3⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2028
    • C:\Windows\SysWOW64\WindowsInput.exe
      "C:\Windows\SysWOW64\WindowsInput.exe"
      1⤵
      • Executes dropped EXE
      PID:2788
    • C:\Windows\system32\taskeng.exe
      taskeng.exe {AD24D73C-5E14-47AC-A9A3-3296DAB5DA5B} S-1-5-21-3818056530-936619650-3554021955-1000:SFVRQGEO\Admin:Interactive:[1]
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:2552
      • C:\Program Files\Orcus\Orcus.exe
        "C:\Program Files\Orcus\Orcus.exe"
        2⤵
        • Executes dropped EXE
        PID:1788
    • C:\Users\Admin\AppData\Roaming\OrcusWatchdog.exe
      "C:\Users\Admin\AppData\Roaming\OrcusWatchdog.exe" /watchProcess "C:\Program Files\Orcus\Orcus.exe" 2992
      1⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2012

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files\Orcus\Orcus.exe

      Filesize

      116KB

      MD5

      6b189fdad2da1a54c7495be53995dd31

      SHA1

      f6a0fc07362de59dffb8c9ee78db35325b6c311c

      SHA256

      d3c5817feb841079ed570bbd5c4dd0f74b564d18f001a648d8407d8aa9587a3f

      SHA512

      c25669add23604cd2711acc142cbf7031f6051d14c924d087c5c547289a953de4f045a305aaf22cfec217184a42575466ddbc06fe46eda64ef01433fece4b787

    • C:\Program Files\Orcus\Orcus.exe

      Filesize

      228KB

      MD5

      3e5c7eee76cbabdfd7bae6cbb88237d6

      SHA1

      d40e049c684bba8a1ddd89c2c73cbbf5d760a0f4

      SHA256

      90e8884c964a34c85793e1a4180f1f87fd62e87b71595af61a345db09d75e45c

      SHA512

      60920aa68faa58a59d246a74fe4cde8708fae7d418fce9320e22376193cdada0930bf32f7ee723126fbdbe819429d0f1e926013381b926c0452bf33260c38cff

    • C:\Program Files\Orcus\Orcus.exe

      Filesize

      31KB

      MD5

      281e2039ac4d55a34fb7c76e7262cd2f

      SHA1

      f9b89e896eb0aa2b9ac49fefe6592a9ddc4f3bbc

      SHA256

      afd03aa7c79c85249e729fb9cf70eaacc1cb7cc47c8a4613856dc6cc91098992

      SHA512

      318fdee15a205b7f14936d2254aacb8ea0347a5c7639e65facd81e30bfb18416ec0495bbdc14085b3fc139f53f926d490672f8a61aedb37675a7bd46a284b06b

    • C:\Users\Admin\AppData\Local\Temp\Cab1B5F.tmp

      Filesize

      65KB

      MD5

      ac05d27423a85adc1622c714f2cb6184

      SHA1

      b0fe2b1abddb97837ea0195be70ab2ff14d43198

      SHA256

      c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

      SHA512

      6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

    • C:\Users\Admin\AppData\Local\Temp\RES1259.tmp

      Filesize

      1KB

      MD5

      6e83b8ca80aae296c2bcf79a23b76055

      SHA1

      d9b855ec317535f7360a34b73ba16e95cb4877ce

      SHA256

      cc76a6e096e3ebb4aa4fc04daa20618b60874bba3c4f800fddc42843374ad018

      SHA512

      7af12a258d085477ce464bab5acbfa0d89747cb7a0df89a926701b0d2610b7670998c1fe54f29907910782e955450bfc4b135f8ddbd7b43352e194a319ffeb86

    • C:\Users\Admin\AppData\Local\Temp\zw26fhyn.dll

      Filesize

      76KB

      MD5

      c22fd101b2617e06d514ce709423615d

      SHA1

      b14201e1c33c7c6d10a0ffdbcbddda82fe179785

      SHA256

      78e93cc132108bd8c498b48793e2f3687608f69beec5ec475fad488d8fb4d4c7

      SHA512

      58c7b7fe6ec88998f694086fe033da094002faf08ba01c13fd96d3bccf0ff620d81f0186f331d75e8ff9b1da8067583011e49cbb459da78fb676c99362640ba3

    • C:\Users\Admin\AppData\Roaming\OrcusWatchdog.exe

      Filesize

      9KB

      MD5

      913967b216326e36a08010fb70f9dba3

      SHA1

      7b6f8c2eb5b443e03c212b85c2f0edb9c76ad2bf

      SHA256

      8d880758549220154d2ff4ee578f2b49527c5fb76a07d55237b61e30bcc09e3a

      SHA512

      c6fcb98d9fd509e9834fc3fba143bd36d41869cc104fbce5354951f0a6756156e34a30796baaa130dd45de3ed96e039ec14716716f6da4569915c7ef2d2b6c33

    • C:\Windows\SysWOW64\WindowsInput.exe

      Filesize

      21KB

      MD5

      e6fcf516d8ed8d0d4427f86e08d0d435

      SHA1

      c7691731583ab7890086635cb7f3e4c22ca5e409

      SHA256

      8dbe814359391ed6b0b5b182039008cf1d00964da9fbc4747f46242a95c24337

      SHA512

      c496cf8e2e222fe1e19051b291e6860f31aae39f54369c1c5e8c9758c4b56e8af904e3e536e743a0a6fdbbf8478afba4baee92e13fc1b3073376ac6bf4a7948e

    • C:\Windows\SysWOW64\WindowsInput.exe.config

      Filesize

      357B

      MD5

      a2b76cea3a59fa9af5ea21ff68139c98

      SHA1

      35d76475e6a54c168f536e30206578babff58274

      SHA256

      f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839

      SHA512

      b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad

    • \??\c:\Users\Admin\AppData\Local\Temp\CSC1249.tmp

      Filesize

      676B

      MD5

      9b1f392c6400412799350d1a718fbb8c

      SHA1

      6230c588f461affeaf16b35acd8ba2d2898ddd3d

      SHA256

      7567468ec75450cac751eb8e0770e01f1b3af5713880f3b406936478e45e2d94

      SHA512

      9440a01ad88412dcf520e1c4c5e83d8cfa0e4e0fadf5de73b945212ea2337df29df78b7ec29c2abb4a6d148e3bd72b5665ed1cc14143984be3693f9a6ff3b74b

    • \??\c:\Users\Admin\AppData\Local\Temp\zw26fhyn.0.cs

      Filesize

      208KB

      MD5

      6011503497b1b9250a05debf9690e52c

      SHA1

      897aea61e9bffc82d7031f1b3da12fb83efc6d82

      SHA256

      08f42b8d57bb61bc8f9628c8a80953b06ca4149d50108083fca6dc26bdd49434

      SHA512

      604c33e82e8b5bb5c54389c2899c81e5482a06e69db08268173a5b4574327ee5de656d312011d07e50a2e398a4c9b0cd79029013f76e05e18cf67ce5a916ffd9

    • \??\c:\Users\Admin\AppData\Local\Temp\zw26fhyn.cmdline

      Filesize

      349B

      MD5

      176b3f0fb81f02476fac90400534436d

      SHA1

      5eb409c9455fa80766b1cc089e445af9b39cf8de

      SHA256

      f9757e942ca4cb5fa2738980ee7ea8e2790eb359fd47c5ac9a26a281cbb16451

      SHA512

      bc0b5e5fd7acac3452925f4b72a41c84eb1ae1a654e7e463c1be1070ec58d3b1a85397fd2a6bc973f40dcd363a38268f8e774e6b26b24d5fb48cf2ae75a078f5

    • memory/1788-84-0x000007FEEDCC0000-0x000007FEEE6AC000-memory.dmp

      Filesize

      9.9MB

    • memory/1788-62-0x000007FEEDCC0000-0x000007FEEE6AC000-memory.dmp

      Filesize

      9.9MB

    • memory/1788-63-0x000000001AEC0000-0x000000001AF40000-memory.dmp

      Filesize

      512KB

    • memory/2012-67-0x0000000074400000-0x0000000074AEE000-memory.dmp

      Filesize

      6.9MB

    • memory/2012-88-0x0000000074400000-0x0000000074AEE000-memory.dmp

      Filesize

      6.9MB

    • memory/2028-64-0x0000000074400000-0x0000000074AEE000-memory.dmp

      Filesize

      6.9MB

    • memory/2028-66-0x0000000074400000-0x0000000074AEE000-memory.dmp

      Filesize

      6.9MB

    • memory/2028-61-0x0000000001070000-0x0000000001078000-memory.dmp

      Filesize

      32KB

    • memory/2264-32-0x000007FEEE6B0000-0x000007FEEF09C000-memory.dmp

      Filesize

      9.9MB

    • memory/2264-29-0x0000000002180000-0x0000000002200000-memory.dmp

      Filesize

      512KB

    • memory/2264-28-0x000007FEEE6B0000-0x000007FEEF09C000-memory.dmp

      Filesize

      9.9MB

    • memory/2264-27-0x0000000000320000-0x000000000032C000-memory.dmp

      Filesize

      48KB

    • memory/2376-19-0x00000000004A0000-0x00000000004B2000-memory.dmp

      Filesize

      72KB

    • memory/2376-0-0x0000000002170000-0x00000000021CC000-memory.dmp

      Filesize

      368KB

    • memory/2376-1-0x0000000000390000-0x000000000039E000-memory.dmp

      Filesize

      56KB

    • memory/2376-3-0x00000000021F0000-0x0000000002270000-memory.dmp

      Filesize

      512KB

    • memory/2376-2-0x000007FEF5750000-0x000007FEF60ED000-memory.dmp

      Filesize

      9.6MB

    • memory/2376-4-0x000007FEF5750000-0x000007FEF60ED000-memory.dmp

      Filesize

      9.6MB

    • memory/2376-17-0x0000000002480000-0x0000000002496000-memory.dmp

      Filesize

      88KB

    • memory/2376-44-0x000007FEF5750000-0x000007FEF60ED000-memory.dmp

      Filesize

      9.6MB

    • memory/2788-34-0x0000000000CB0000-0x0000000000CBC000-memory.dmp

      Filesize

      48KB

    • memory/2788-35-0x000007FEEDCC0000-0x000007FEEE6AC000-memory.dmp

      Filesize

      9.9MB

    • memory/2788-85-0x000007FEEDCC0000-0x000007FEEE6AC000-memory.dmp

      Filesize

      9.9MB

    • memory/2992-46-0x000007FEEDCC0000-0x000007FEEE6AC000-memory.dmp

      Filesize

      9.9MB

    • memory/2992-45-0x00000000012C0000-0x00000000013AA000-memory.dmp

      Filesize

      936KB

    • memory/2992-47-0x000000001AF00000-0x000000001AF80000-memory.dmp

      Filesize

      512KB

    • memory/2992-51-0x0000000000D50000-0x0000000000D60000-memory.dmp

      Filesize

      64KB

    • memory/2992-50-0x0000000000D30000-0x0000000000D48000-memory.dmp

      Filesize

      96KB

    • memory/2992-48-0x0000000000480000-0x0000000000492000-memory.dmp

      Filesize

      72KB

    • memory/2992-86-0x000007FEEDCC0000-0x000007FEEE6AC000-memory.dmp

      Filesize

      9.9MB

    • memory/2992-87-0x000000001AF00000-0x000000001AF80000-memory.dmp

      Filesize

      512KB

    • memory/2992-49-0x00000000005A0000-0x00000000005EE000-memory.dmp

      Filesize

      312KB