Analysis

  • max time kernel
    149s
  • max time network
    131s
  • platform
    windows10-1703_x64
  • resource
    win10-20231220-en
  • resource tags

    arch:x64arch:x86image:win10-20231220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    04-02-2024 20:17

General

  • Target

    file.exe

  • Size

    916KB

  • MD5

    bdbe50403b411db0e07511e098bdb9ff

  • SHA1

    5772743e950c1c647a5cab202fc3cc29039e2749

  • SHA256

    a758763a7fb30398cbdab370be24c389a1927fb376772fcb31f4017ca942a284

  • SHA512

    9531b3c7572f07aaac342635369732b77c1df58c262e32b21327cd2ac47afe6e3042d79a6a72e30c07b03e420cd9b47b1781bc5ed875b8d7b973b480090261f9

  • SSDEEP

    24576:+cI4MROxnFD3jEsYxrZlI0AilFEvxHiH0h9:+crMiJWrZlI0AilFEvxHi

Malware Config

Extracted

Family

orcus

C2

obfuscated.us:8080

Mutex

0133d229c4e24006957c0e4ab3a52531

Attributes
  • autostart_method

    Registry

  • enable_keylogger

    false

  • install_path

    %programfiles%\Orcus\Orcus.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\OrcusWatchdog.exe

Signatures

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

  • Orcus main payload 3 IoCs
  • Orcurs Rat Executable 4 IoCs
  • Executes dropped EXE 6 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops desktop.ini file(s) 2 IoCs
  • Drops file in System32 directory 3 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:652
    • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0w64no2w.cmdline"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4724
      • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES72FE.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC72FD.tmp"
        3⤵
          PID:2004
      • C:\Windows\SysWOW64\WindowsInput.exe
        "C:\Windows\SysWOW64\WindowsInput.exe" --install
        2⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        PID:4440
      • C:\Program Files\Orcus\Orcus.exe
        "C:\Program Files\Orcus\Orcus.exe"
        2⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:4488
        • C:\Users\Admin\AppData\Roaming\OrcusWatchdog.exe
          "C:\Users\Admin\AppData\Roaming\OrcusWatchdog.exe" /launchSelfAndExit "C:\Program Files\Orcus\Orcus.exe" 4488
          3⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1364
          • C:\Users\Admin\AppData\Roaming\OrcusWatchdog.exe
            "C:\Users\Admin\AppData\Roaming\OrcusWatchdog.exe" /watchProcess "C:\Program Files\Orcus\Orcus.exe" 4488
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1608
    • C:\Windows\SysWOW64\WindowsInput.exe
      "C:\Windows\SysWOW64\WindowsInput.exe"
      1⤵
      • Executes dropped EXE
      PID:3764
    • C:\Program Files\Orcus\Orcus.exe
      "C:\Program Files\Orcus\Orcus.exe"
      1⤵
      • Executes dropped EXE
      PID:1876

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files\Orcus\Orcus.exe

      Filesize

      252KB

      MD5

      32f505b5c4698d7c12cea203932da956

      SHA1

      c7d333abd546d32793acdee9fea0372a5615462a

      SHA256

      bc830a82b052ba7e8168a4fa13be71270911fc152f7626277bb9cfca8e80c00a

      SHA512

      9c8c75336aa90e59bb906d737a78c22996c512f5906f5f057963f44126cf449cc037b56937175ce969580aacbbc1313863bfc036670efd794823f952def64319

    • C:\Program Files\Orcus\Orcus.exe

      Filesize

      230KB

      MD5

      59b8b5ecb53f10e71b44d71892cfa5f6

      SHA1

      1887146baaffa64c9dae672d616054b56ff10524

      SHA256

      be37e496f05537c59dda7f614cdaa6e64128f0f0278fcddf242e897879140649

      SHA512

      be0be78a8425b2c35cb59daa0f868f54f7ecb1ca87066873c7f206ffba00eb60a6c094024b1698f99f85f700f52319b53d42e9659692a6bc46deebee702e9cab

    • C:\Program Files\Orcus\Orcus.exe

      Filesize

      176KB

      MD5

      ef91594b08b4edcad2067c33449ca995

      SHA1

      cbca038ba58db9d3c60b0f3fc5da13f25aa09ec3

      SHA256

      e109f7f574ac2b6538186d21531e7d1272115c2bf5597530d2357c94a2e4b7c9

      SHA512

      cdf8476f884a3f690fbead42034aa0e066b85d58bcd63f144911104e0d7de3f4f91db4920e67c0fdceed90325e5b6d0cb1861a10439cd0fef8ca5083c030db3a

    • C:\Users\Admin\AppData\Local\Temp\0w64no2w.dll

      Filesize

      76KB

      MD5

      eab12e20808c50923c049a941e0fa6d0

      SHA1

      594649c456f0c02cf8a5d58a7959fc28f35cc773

      SHA256

      7347601cd7078684c2cd931d76e97d03ee315f442294a3c4ac7852f519978f00

      SHA512

      046f10b29f04fa549fffbf310b2f1c6c2aa92314e90587c76a8c916d5ccb9ef7a1060c1d7479a4558931acdc68f9ddba1255ebd8c040b0c8d37abb4bf0a5de52

    • C:\Users\Admin\AppData\Local\Temp\RES72FE.tmp

      Filesize

      1KB

      MD5

      f0d1cc05e3e193d5040816cc359c5d73

      SHA1

      5a4ec8a67e69b1d4d144a7dc9100c30d7eddfc1b

      SHA256

      3cf89bb0566ef2f5643ee7bb9d48471b31611bc1e709f74f8878f3dd4186af19

      SHA512

      291bac402d388c3c0d17bc8a0406725152624efcdf23fee9ebf80460da746ed90ec57f748e1138c8a4fd433c79a33c3ef1f60508a582b6e4f1a1c20c6773c0f7

    • C:\Users\Admin\AppData\Roaming\OrcusWatchdog.exe

      Filesize

      9KB

      MD5

      913967b216326e36a08010fb70f9dba3

      SHA1

      7b6f8c2eb5b443e03c212b85c2f0edb9c76ad2bf

      SHA256

      8d880758549220154d2ff4ee578f2b49527c5fb76a07d55237b61e30bcc09e3a

      SHA512

      c6fcb98d9fd509e9834fc3fba143bd36d41869cc104fbce5354951f0a6756156e34a30796baaa130dd45de3ed96e039ec14716716f6da4569915c7ef2d2b6c33

    • C:\Windows\SysWOW64\WindowsInput.exe

      Filesize

      21KB

      MD5

      e6fcf516d8ed8d0d4427f86e08d0d435

      SHA1

      c7691731583ab7890086635cb7f3e4c22ca5e409

      SHA256

      8dbe814359391ed6b0b5b182039008cf1d00964da9fbc4747f46242a95c24337

      SHA512

      c496cf8e2e222fe1e19051b291e6860f31aae39f54369c1c5e8c9758c4b56e8af904e3e536e743a0a6fdbbf8478afba4baee92e13fc1b3073376ac6bf4a7948e

    • C:\Windows\SysWOW64\WindowsInput.exe.config

      Filesize

      357B

      MD5

      a2b76cea3a59fa9af5ea21ff68139c98

      SHA1

      35d76475e6a54c168f536e30206578babff58274

      SHA256

      f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839

      SHA512

      b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad

    • \??\c:\Users\Admin\AppData\Local\Temp\0w64no2w.0.cs

      Filesize

      208KB

      MD5

      2f26a3e125b54e8a003eef10de7a0665

      SHA1

      e1c1d9b14d91b461146b5bed98b880083123ca4b

      SHA256

      2770c8786e5c82f31683c4f5e78393f9a369497e53aa0018b2f26a5d7616f110

      SHA512

      ac8439eaf1e16c51e5b0a5f1668b40cb2e011e172eccceb3825f3a3c018200c82e33d3a67c4974fae9bcbbcab161772172fa14a122aadf89be9cef6ac2876723

    • \??\c:\Users\Admin\AppData\Local\Temp\0w64no2w.cmdline

      Filesize

      349B

      MD5

      1383ca7a34518ec7c77a6b1da4d515b4

      SHA1

      dcedd5c0e4fcef86aa2c4a73544692d9c1828646

      SHA256

      2a63506f17d111d010ca24333890004be5243c8afc9d1b65ca40e871bce86594

      SHA512

      fa3a4fa7915dbc0d19830b6c6b84c56a355df8208c1eca12343a0ba662175c95cba0a25eca62d67092dd347732d108868d8fd50a15a025e38619b26c8f8b2a33

    • \??\c:\Users\Admin\AppData\Local\Temp\CSC72FD.tmp

      Filesize

      676B

      MD5

      2bc7bdb989b2d845ae89bdde495da117

      SHA1

      1ffb95e35c8289057e7af97b3cdec12da4e764fb

      SHA256

      5103d09770638b76775fd632e36e79de141c14db8e35e5d52fe41cdfd2079d8d

      SHA512

      3c844f67b28f915f6e3482c9c5c6589f876dfc56d3f6fd44f5e933a2509bce92d135b42905d513dc89d4fc429eb0533ac74695a825f7e3ec4333872570c48110

    • memory/652-8-0x000000001BDC0000-0x000000001BE5C000-memory.dmp

      Filesize

      624KB

    • memory/652-7-0x000000001B850000-0x000000001BD1E000-memory.dmp

      Filesize

      4.8MB

    • memory/652-1-0x000000001B1F0000-0x000000001B24C000-memory.dmp

      Filesize

      368KB

    • memory/652-25-0x000000001C4C0000-0x000000001C4E0000-memory.dmp

      Filesize

      128KB

    • memory/652-24-0x0000000000AF0000-0x0000000000B02000-memory.dmp

      Filesize

      72KB

    • memory/652-57-0x00007FFC45C40000-0x00007FFC465E0000-memory.dmp

      Filesize

      9.6MB

    • memory/652-6-0x0000000000A00000-0x0000000000A10000-memory.dmp

      Filesize

      64KB

    • memory/652-22-0x000000001BE90000-0x000000001BEA6000-memory.dmp

      Filesize

      88KB

    • memory/652-5-0x00007FFC45C40000-0x00007FFC465E0000-memory.dmp

      Filesize

      9.6MB

    • memory/652-4-0x000000001B320000-0x000000001B32E000-memory.dmp

      Filesize

      56KB

    • memory/652-0-0x00007FFC45C40000-0x00007FFC465E0000-memory.dmp

      Filesize

      9.6MB

    • memory/1364-77-0x0000000073860000-0x0000000073F4E000-memory.dmp

      Filesize

      6.9MB

    • memory/1364-73-0x00000000003C0000-0x00000000003C8000-memory.dmp

      Filesize

      32KB

    • memory/1364-74-0x0000000073860000-0x0000000073F4E000-memory.dmp

      Filesize

      6.9MB

    • memory/1608-78-0x0000000073860000-0x0000000073F4E000-memory.dmp

      Filesize

      6.9MB

    • memory/1608-88-0x0000000073860000-0x0000000073F4E000-memory.dmp

      Filesize

      6.9MB

    • memory/1876-65-0x000000001B3E0000-0x000000001B3F0000-memory.dmp

      Filesize

      64KB

    • memory/1876-83-0x00007FFC34470000-0x00007FFC34E5C000-memory.dmp

      Filesize

      9.9MB

    • memory/1876-64-0x00007FFC34470000-0x00007FFC34E5C000-memory.dmp

      Filesize

      9.9MB

    • memory/3764-43-0x00007FFC34470000-0x00007FFC34E5C000-memory.dmp

      Filesize

      9.9MB

    • memory/3764-85-0x000000001A340000-0x000000001A350000-memory.dmp

      Filesize

      64KB

    • memory/3764-84-0x00007FFC34470000-0x00007FFC34E5C000-memory.dmp

      Filesize

      9.9MB

    • memory/3764-45-0x000000001A760000-0x000000001A86A000-memory.dmp

      Filesize

      1.0MB

    • memory/3764-44-0x000000001A340000-0x000000001A350000-memory.dmp

      Filesize

      64KB

    • memory/4440-35-0x000000001B740000-0x000000001B77E000-memory.dmp

      Filesize

      248KB

    • memory/4440-37-0x000000001B850000-0x000000001B860000-memory.dmp

      Filesize

      64KB

    • memory/4440-33-0x0000000000C70000-0x0000000000C7C000-memory.dmp

      Filesize

      48KB

    • memory/4440-41-0x00007FFC34470000-0x00007FFC34E5C000-memory.dmp

      Filesize

      9.9MB

    • memory/4440-34-0x0000000002CF0000-0x0000000002D02000-memory.dmp

      Filesize

      72KB

    • memory/4440-36-0x00007FFC34470000-0x00007FFC34E5C000-memory.dmp

      Filesize

      9.9MB

    • memory/4488-55-0x0000000000B90000-0x0000000000C7A000-memory.dmp

      Filesize

      936KB

    • memory/4488-62-0x000000001B950000-0x000000001B968000-memory.dmp

      Filesize

      96KB

    • memory/4488-63-0x000000001B970000-0x000000001B980000-memory.dmp

      Filesize

      64KB

    • memory/4488-59-0x0000000002DD0000-0x0000000002DE2000-memory.dmp

      Filesize

      72KB

    • memory/4488-81-0x000000001D140000-0x000000001D302000-memory.dmp

      Filesize

      1.8MB

    • memory/4488-60-0x0000000002DE0000-0x0000000002E2E000-memory.dmp

      Filesize

      312KB

    • memory/4488-58-0x000000001B980000-0x000000001B990000-memory.dmp

      Filesize

      64KB

    • memory/4488-86-0x00007FFC34470000-0x00007FFC34E5C000-memory.dmp

      Filesize

      9.9MB

    • memory/4488-56-0x00007FFC34470000-0x00007FFC34E5C000-memory.dmp

      Filesize

      9.9MB

    • memory/4488-87-0x000000001B980000-0x000000001B990000-memory.dmp

      Filesize

      64KB

    • memory/4724-14-0x0000000002300000-0x0000000002310000-memory.dmp

      Filesize

      64KB