Analysis

  • max time kernel
    150s
  • max time network
    132s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    04-02-2024 20:17

General

  • Target

    file.exe

  • Size

    916KB

  • MD5

    bdbe50403b411db0e07511e098bdb9ff

  • SHA1

    5772743e950c1c647a5cab202fc3cc29039e2749

  • SHA256

    a758763a7fb30398cbdab370be24c389a1927fb376772fcb31f4017ca942a284

  • SHA512

    9531b3c7572f07aaac342635369732b77c1df58c262e32b21327cd2ac47afe6e3042d79a6a72e30c07b03e420cd9b47b1781bc5ed875b8d7b973b480090261f9

  • SSDEEP

    24576:+cI4MROxnFD3jEsYxrZlI0AilFEvxHiH0h9:+crMiJWrZlI0AilFEvxHi

Malware Config

Extracted

Family

orcus

C2

obfuscated.us:8080

Mutex

0133d229c4e24006957c0e4ab3a52531

Attributes
  • autostart_method

    Registry

  • enable_keylogger

    false

  • install_path

    %programfiles%\Orcus\Orcus.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\OrcusWatchdog.exe

Signatures

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

  • Orcus main payload 1 IoCs
  • Orcurs Rat Executable 2 IoCs
  • Executes dropped EXE 6 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 3 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:1516
    • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\tvghrsus.cmdline"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2100
      • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4A2B.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC4A1A.tmp"
        3⤵
          PID:2764
      • C:\Windows\SysWOW64\WindowsInput.exe
        "C:\Windows\SysWOW64\WindowsInput.exe" --install
        2⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        PID:2744
      • C:\Program Files\Orcus\Orcus.exe
        "C:\Program Files\Orcus\Orcus.exe"
        2⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:2288
        • C:\Users\Admin\AppData\Roaming\OrcusWatchdog.exe
          "C:\Users\Admin\AppData\Roaming\OrcusWatchdog.exe" /launchSelfAndExit "C:\Program Files\Orcus\Orcus.exe" 2288
          3⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2872
          • C:\Users\Admin\AppData\Roaming\OrcusWatchdog.exe
            "C:\Users\Admin\AppData\Roaming\OrcusWatchdog.exe" /watchProcess "C:\Program Files\Orcus\Orcus.exe" 2288
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1860
    • C:\Windows\SysWOW64\WindowsInput.exe
      "C:\Windows\SysWOW64\WindowsInput.exe"
      1⤵
      • Executes dropped EXE
      PID:2804
    • C:\Windows\system32\taskeng.exe
      taskeng.exe {BA5A95B8-3CC2-44CA-84FD-37BB0CADBA5E} S-1-5-21-1603059206-2004189698-4139800220-1000:AILVMYUM\Admin:Interactive:[1]
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:1600
      • C:\Program Files\Orcus\Orcus.exe
        "C:\Program Files\Orcus\Orcus.exe"
        2⤵
        • Executes dropped EXE
        PID:2732

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files\Orcus\Orcus.exe

      Filesize

      916KB

      MD5

      bdbe50403b411db0e07511e098bdb9ff

      SHA1

      5772743e950c1c647a5cab202fc3cc29039e2749

      SHA256

      a758763a7fb30398cbdab370be24c389a1927fb376772fcb31f4017ca942a284

      SHA512

      9531b3c7572f07aaac342635369732b77c1df58c262e32b21327cd2ac47afe6e3042d79a6a72e30c07b03e420cd9b47b1781bc5ed875b8d7b973b480090261f9

    • C:\Users\Admin\AppData\Local\Temp\Cab64BE.tmp

      Filesize

      65KB

      MD5

      ac05d27423a85adc1622c714f2cb6184

      SHA1

      b0fe2b1abddb97837ea0195be70ab2ff14d43198

      SHA256

      c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

      SHA512

      6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

    • C:\Users\Admin\AppData\Local\Temp\RES4A2B.tmp

      Filesize

      1KB

      MD5

      de153a3c129ee9d436dd6d703e23ffbb

      SHA1

      1ec85e3634533f2d8638cf1989d2cbfab2a0dd99

      SHA256

      f7140ac1f77e36f3c1bfabb82e36d2079042c2d47ffd4b3ab3b8defcfc90620c

      SHA512

      feb96f6bd58f8a567b84a27632c2b6e0123a09834ea96aae3ed1a473323d13ccb72231654d5ab3fbeab77b78f860a40ce043424022cd16a7f3573a446aa6b4ba

    • C:\Users\Admin\AppData\Local\Temp\tvghrsus.dll

      Filesize

      76KB

      MD5

      e8f545bc8bd70bf73ea5bb685cc9c403

      SHA1

      f2baf3264d4a38a5b2ca7cb58781edbab0ff5e67

      SHA256

      fa2cb3f1b5daa335c3350dc2aba8f8ea26828b28e33fd22b6d31325cb294e97f

      SHA512

      ff45225c67c71755179046432c6bf901a41186674fbde0e7b0d198a8b9644804d623f61e27dc46d36ab9d698be8774c04a0cbd17561ee2b79597d086afe10989

    • C:\Users\Admin\AppData\Roaming\OrcusWatchdog.exe

      Filesize

      9KB

      MD5

      913967b216326e36a08010fb70f9dba3

      SHA1

      7b6f8c2eb5b443e03c212b85c2f0edb9c76ad2bf

      SHA256

      8d880758549220154d2ff4ee578f2b49527c5fb76a07d55237b61e30bcc09e3a

      SHA512

      c6fcb98d9fd509e9834fc3fba143bd36d41869cc104fbce5354951f0a6756156e34a30796baaa130dd45de3ed96e039ec14716716f6da4569915c7ef2d2b6c33

    • C:\Windows\SysWOW64\WindowsInput.exe

      Filesize

      21KB

      MD5

      e6fcf516d8ed8d0d4427f86e08d0d435

      SHA1

      c7691731583ab7890086635cb7f3e4c22ca5e409

      SHA256

      8dbe814359391ed6b0b5b182039008cf1d00964da9fbc4747f46242a95c24337

      SHA512

      c496cf8e2e222fe1e19051b291e6860f31aae39f54369c1c5e8c9758c4b56e8af904e3e536e743a0a6fdbbf8478afba4baee92e13fc1b3073376ac6bf4a7948e

    • C:\Windows\SysWOW64\WindowsInput.exe.config

      Filesize

      357B

      MD5

      a2b76cea3a59fa9af5ea21ff68139c98

      SHA1

      35d76475e6a54c168f536e30206578babff58274

      SHA256

      f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839

      SHA512

      b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad

    • \??\c:\Users\Admin\AppData\Local\Temp\CSC4A1A.tmp

      Filesize

      676B

      MD5

      f33962d7d09d8b2789bbd6977c34a784

      SHA1

      b421d2b8a132f396c15591889420ded0d4746c41

      SHA256

      7875ffca7f7fc56cdd2e1667b6c0726689589644e8c802d58dd3b225669a4f71

      SHA512

      10591f62aa756536814186351c5eccc1beba2b8f411b10b5e2d013721231902b43605b0ff56ae7ff3250b4e1c911a514e08ed68a4cab49388cf33640c031c3f9

    • \??\c:\Users\Admin\AppData\Local\Temp\tvghrsus.0.cs

      Filesize

      208KB

      MD5

      c555d9796194c1d9a1310a05a2264e08

      SHA1

      82641fc4938680519c3b2e925e05e1001cbd71d7

      SHA256

      ccbb8fd27ab2f27fbbd871793886ff52ff1fbd9117c98b8d190c1a96b67e498a

      SHA512

      0b85ca22878998c7697c589739905b218f9b264a32c8f99a9f9dd73d0687a5de46cc7e851697ee16424baf94d301e411648aa2d061ac149a6d2e06b085e07090

    • \??\c:\Users\Admin\AppData\Local\Temp\tvghrsus.cmdline

      Filesize

      349B

      MD5

      d1ab971daae1b254d1c48eeadf7c71ad

      SHA1

      0fcfbca2a0801d1439369b6672c30f8495d1240e

      SHA256

      42ab5f3a5bfe45ae90a34df0ad97559320cde29acd0b18889547f4ebebcb46ce

      SHA512

      4e1bb31e08321ab20d734a78fa411f0a762428d48d21731331ed7a30d30507b2eba986194de412f581206f90602e0991790e3cbeca40a16828aea2ba9ef7a97e

    • memory/1516-4-0x000007FEF5AF0000-0x000007FEF648D000-memory.dmp

      Filesize

      9.6MB

    • memory/1516-18-0x0000000000B50000-0x0000000000B66000-memory.dmp

      Filesize

      88KB

    • memory/1516-20-0x0000000000330000-0x0000000000342000-memory.dmp

      Filesize

      72KB

    • memory/1516-2-0x000007FEF5AF0000-0x000007FEF648D000-memory.dmp

      Filesize

      9.6MB

    • memory/1516-0-0x0000000002170000-0x00000000021CC000-memory.dmp

      Filesize

      368KB

    • memory/1516-1-0x0000000000300000-0x000000000030E000-memory.dmp

      Filesize

      56KB

    • memory/1516-46-0x000007FEF5AF0000-0x000007FEF648D000-memory.dmp

      Filesize

      9.6MB

    • memory/1516-3-0x0000000002220000-0x00000000022A0000-memory.dmp

      Filesize

      512KB

    • memory/1860-89-0x00000000747D0000-0x0000000074EBE000-memory.dmp

      Filesize

      6.9MB

    • memory/1860-82-0x00000000747D0000-0x0000000074EBE000-memory.dmp

      Filesize

      6.9MB

    • memory/2100-10-0x00000000021B0000-0x0000000002230000-memory.dmp

      Filesize

      512KB

    • memory/2288-86-0x00000000022E0000-0x0000000002360000-memory.dmp

      Filesize

      512KB

    • memory/2288-45-0x0000000000DC0000-0x0000000000EAA000-memory.dmp

      Filesize

      936KB

    • memory/2288-47-0x000007FEEEA10000-0x000007FEEF3FC000-memory.dmp

      Filesize

      9.9MB

    • memory/2288-85-0x000007FEEEA10000-0x000007FEEF3FC000-memory.dmp

      Filesize

      9.9MB

    • memory/2288-48-0x0000000000C10000-0x0000000000C5E000-memory.dmp

      Filesize

      312KB

    • memory/2288-49-0x0000000000D80000-0x0000000000D98000-memory.dmp

      Filesize

      96KB

    • memory/2288-51-0x00000000005E0000-0x00000000005F0000-memory.dmp

      Filesize

      64KB

    • memory/2288-87-0x00000000022E0000-0x0000000002360000-memory.dmp

      Filesize

      512KB

    • memory/2288-55-0x00000000022E0000-0x0000000002360000-memory.dmp

      Filesize

      512KB

    • memory/2732-56-0x000000001AF90000-0x000000001B010000-memory.dmp

      Filesize

      512KB

    • memory/2732-52-0x000007FEEEA10000-0x000007FEEF3FC000-memory.dmp

      Filesize

      9.9MB

    • memory/2732-84-0x000007FEEEA10000-0x000007FEEF3FC000-memory.dmp

      Filesize

      9.9MB

    • memory/2744-33-0x000007FEEF400000-0x000007FEEFDEC000-memory.dmp

      Filesize

      9.9MB

    • memory/2744-30-0x000000001ADE0000-0x000000001AE60000-memory.dmp

      Filesize

      512KB

    • memory/2744-29-0x000007FEEF400000-0x000007FEEFDEC000-memory.dmp

      Filesize

      9.9MB

    • memory/2744-28-0x0000000000900000-0x000000000090C000-memory.dmp

      Filesize

      48KB

    • memory/2804-36-0x000007FEEEA10000-0x000007FEEF3FC000-memory.dmp

      Filesize

      9.9MB

    • memory/2804-35-0x0000000001350000-0x000000000135C000-memory.dmp

      Filesize

      48KB

    • memory/2804-83-0x000007FEEEA10000-0x000007FEEF3FC000-memory.dmp

      Filesize

      9.9MB

    • memory/2872-63-0x0000000000850000-0x0000000000858000-memory.dmp

      Filesize

      32KB

    • memory/2872-64-0x00000000747D0000-0x0000000074EBE000-memory.dmp

      Filesize

      6.9MB

    • memory/2872-88-0x00000000747D0000-0x0000000074EBE000-memory.dmp

      Filesize

      6.9MB