Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04-02-2024 20:17

General

  • Target

    file.exe

  • Size

    916KB

  • MD5

    bdbe50403b411db0e07511e098bdb9ff

  • SHA1

    5772743e950c1c647a5cab202fc3cc29039e2749

  • SHA256

    a758763a7fb30398cbdab370be24c389a1927fb376772fcb31f4017ca942a284

  • SHA512

    9531b3c7572f07aaac342635369732b77c1df58c262e32b21327cd2ac47afe6e3042d79a6a72e30c07b03e420cd9b47b1781bc5ed875b8d7b973b480090261f9

  • SSDEEP

    24576:+cI4MROxnFD3jEsYxrZlI0AilFEvxHiH0h9:+crMiJWrZlI0AilFEvxHi

Malware Config

Extracted

Family

orcus

C2

obfuscated.us:8080

Mutex

0133d229c4e24006957c0e4ab3a52531

Attributes
  • autostart_method

    Registry

  • enable_keylogger

    false

  • install_path

    %programfiles%\Orcus\Orcus.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\OrcusWatchdog.exe

Signatures

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

  • Orcus main payload 4 IoCs
  • Orcurs Rat Executable 5 IoCs
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops desktop.ini file(s) 2 IoCs
  • Drops file in System32 directory 3 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Checks computer location settings
    • Drops desktop.ini file(s)
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:4160
    • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\5lhlun0o.cmdline"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3748
      • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4DB3.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC4DB2.tmp"
        3⤵
          PID:2308
      • C:\Windows\SysWOW64\WindowsInput.exe
        "C:\Windows\SysWOW64\WindowsInput.exe" --install
        2⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        PID:2012
      • C:\Program Files\Orcus\Orcus.exe
        "C:\Program Files\Orcus\Orcus.exe"
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:3120
        • C:\Users\Admin\AppData\Roaming\OrcusWatchdog.exe
          "C:\Users\Admin\AppData\Roaming\OrcusWatchdog.exe" /launchSelfAndExit "C:\Program Files\Orcus\Orcus.exe" 3120
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2940
          • C:\Users\Admin\AppData\Roaming\OrcusWatchdog.exe
            "C:\Users\Admin\AppData\Roaming\OrcusWatchdog.exe" /watchProcess "C:\Program Files\Orcus\Orcus.exe" 3120
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1760
    • C:\Windows\SysWOW64\WindowsInput.exe
      "C:\Windows\SysWOW64\WindowsInput.exe"
      1⤵
      • Executes dropped EXE
      PID:2008
    • C:\Program Files\Orcus\Orcus.exe
      "C:\Program Files\Orcus\Orcus.exe"
      1⤵
      • Executes dropped EXE
      PID:3152

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files\Orcus\Orcus.exe

      Filesize

      123KB

      MD5

      ce3f7034563c490bccc6c2de62bfeaa5

      SHA1

      eaf37815e57356f3738b389375242eeef6e62e99

      SHA256

      36d4111303b09eb9e5f86d25fcbd7f5e5717b763da199315cc05f305fe9c62da

      SHA512

      93ae4d76f0234fa3eb5e4f5c4935bd6d20896c27b560b9efa9fac2a768373c4b37f89346c586327cd7765d85700e54809201245dd73fc1f6d39d03931ab1cd8f

    • C:\Program Files\Orcus\Orcus.exe

      Filesize

      182KB

      MD5

      d27820e8a8ef8ba8a4819a02d83e3747

      SHA1

      db61b885eac771246b26e7a12a67ec348bb10e70

      SHA256

      1b7083cb4e78821792aef28f1667b3f104de4efb6611301bf5f3db534ba08959

      SHA512

      2c383e64d6b6d6876de7738e267fdd42d931ea417b9f14afb0cd0d009fa007de81af72289d0a7b17b1fc41afad18e6047d7788a2c4cb051f7562f4affef6eda2

    • C:\Program Files\Orcus\Orcus.exe

      Filesize

      85KB

      MD5

      17f3405c2a93ed6405423e35e10c6756

      SHA1

      91300933e6ecdbb5123c1e5820c03a21bab14781

      SHA256

      d92774df195c75c7caa22906075e53bcca325686de50518ab00aeef3d928066c

      SHA512

      0ca652dab3381acdb57456211727e46214059b827fb7a388dce7c51e4512dfd53da0fdfbb2fc287c5b037d648200b38018960dd20293e9f4628703fde54e6125

    • C:\Program Files\Orcus\Orcus.exe

      Filesize

      37KB

      MD5

      3bd85de5e14149af07514536ae2798be

      SHA1

      2df51c015d17f57bd5fe62c1ad87eb6b702df8e5

      SHA256

      e1600a55935a63cdfd41762c8c4a7f186792359e00b6692da2274e255ee91deb

      SHA512

      99573a80851520582ce09fd85b6ab336dffa1f637869f32ee4ef4c809a33c64a833dc06e05c1f4c00952032ceb5ee3f0f9ab50ebfc8cbb48903e59f068d3bdd3

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\OrcusWatchdog.exe.log

      Filesize

      425B

      MD5

      4eaca4566b22b01cd3bc115b9b0b2196

      SHA1

      e743e0792c19f71740416e7b3c061d9f1336bf94

      SHA256

      34ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb

      SHA512

      bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1

    • C:\Users\Admin\AppData\Local\Temp\5lhlun0o.dll

      Filesize

      76KB

      MD5

      d338849f33c4d8f4001909e038c3a2ff

      SHA1

      8b8ec6dd22cbd0038000d2af3f09a71079b3fd7b

      SHA256

      25ec91954d7a37256bffbe9d3b192c9e99e2c4fc007bc235dd9b59abdf716d34

      SHA512

      04a75139cc4cc0049e8d3aa9c6b7073cda49c6b9f96cf0b881b899f02dfe082671dad26eb1c5159dd2f6a8be057b65da71724e0affab4c8b7b9ea0ea107ac52e

    • C:\Users\Admin\AppData\Local\Temp\RES4DB3.tmp

      Filesize

      1KB

      MD5

      9cdc91049a62eb0b0ca7d93d7e678d77

      SHA1

      a8a0dcccdd3560a515971a5fce121665594148b0

      SHA256

      7169942138765ed9e457f9fc335fdd6308b83649c75dddaa28671b0c604122e5

      SHA512

      27b380ea8099a44ef755a0b48fbed2994096b52ca072918be79537939d025cd516573b31449dce35c3b7d4c0140478911829f1817dbef52731d766b7e50177da

    • C:\Users\Admin\AppData\Roaming\OrcusWatchdog.exe

      Filesize

      9KB

      MD5

      913967b216326e36a08010fb70f9dba3

      SHA1

      7b6f8c2eb5b443e03c212b85c2f0edb9c76ad2bf

      SHA256

      8d880758549220154d2ff4ee578f2b49527c5fb76a07d55237b61e30bcc09e3a

      SHA512

      c6fcb98d9fd509e9834fc3fba143bd36d41869cc104fbce5354951f0a6756156e34a30796baaa130dd45de3ed96e039ec14716716f6da4569915c7ef2d2b6c33

    • C:\Windows\SysWOW64\WindowsInput.exe

      Filesize

      21KB

      MD5

      e6fcf516d8ed8d0d4427f86e08d0d435

      SHA1

      c7691731583ab7890086635cb7f3e4c22ca5e409

      SHA256

      8dbe814359391ed6b0b5b182039008cf1d00964da9fbc4747f46242a95c24337

      SHA512

      c496cf8e2e222fe1e19051b291e6860f31aae39f54369c1c5e8c9758c4b56e8af904e3e536e743a0a6fdbbf8478afba4baee92e13fc1b3073376ac6bf4a7948e

    • C:\Windows\SysWOW64\WindowsInput.exe.config

      Filesize

      357B

      MD5

      a2b76cea3a59fa9af5ea21ff68139c98

      SHA1

      35d76475e6a54c168f536e30206578babff58274

      SHA256

      f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839

      SHA512

      b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad

    • \??\c:\Users\Admin\AppData\Local\Temp\5lhlun0o.0.cs

      Filesize

      208KB

      MD5

      1c51133523657fb9797b5a3dcd86e292

      SHA1

      fec53d42b1e142a57180b61cae1f80c2300f8407

      SHA256

      985dffb1e6b644064ccac128a8590cbed6cbf119964ebe3d6a396c4cd68e54be

      SHA512

      cafdec469dc6f5f7da4576404f9f03da2ed3b86282a80ca4dcd358d16e779bff096f298ed97e194a32a1a62402a4ad35ce2196a1f33dc470974767a02e2ccd6e

    • \??\c:\Users\Admin\AppData\Local\Temp\5lhlun0o.cmdline

      Filesize

      349B

      MD5

      ee2a9c253688baa62dfb0bc9f617624f

      SHA1

      ef378e6ffd13bbd95e644c6104825ccff677f9ff

      SHA256

      ed8bfb5540760ccdaf1cd06d274549e13c684c2b851a619130dcf9a63ff860bd

      SHA512

      4a8215a9a2ffbc3b2c59409c8db4d0d61aa804f7ddc0ed2071a1333323c10e58412f6da8500aaaa4965b1e9f26f85ad7b67b326353715a06924a17b37b0a8903

    • \??\c:\Users\Admin\AppData\Local\Temp\CSC4DB2.tmp

      Filesize

      676B

      MD5

      37860063532ef5ea41ec9c89543c114d

      SHA1

      789279fe9cf093174d6e837844deb578aa70bd55

      SHA256

      02f55e3db8e6f553ef0054e485e224b7305e3c99a776614f49edba97cffd1664

      SHA512

      1d7cf48df901b747b96ebad3d1ffe6c6721fece3889a212d2b35eed2d0e85d13566d6608718fef844ce3eacc716ced9f567dab17fff04f811c35a3cbf608e1da

    • memory/1760-105-0x0000000074880000-0x0000000075030000-memory.dmp

      Filesize

      7.7MB

    • memory/1760-96-0x0000000074880000-0x0000000075030000-memory.dmp

      Filesize

      7.7MB

    • memory/2008-101-0x0000000001020000-0x0000000001030000-memory.dmp

      Filesize

      64KB

    • memory/2008-100-0x00007FFA2EBB0000-0x00007FFA2F671000-memory.dmp

      Filesize

      10.8MB

    • memory/2008-51-0x000000001A010000-0x000000001A11A000-memory.dmp

      Filesize

      1.0MB

    • memory/2008-49-0x00007FFA2EBB0000-0x00007FFA2F671000-memory.dmp

      Filesize

      10.8MB

    • memory/2008-50-0x0000000001020000-0x0000000001030000-memory.dmp

      Filesize

      64KB

    • memory/2012-39-0x0000000000DD0000-0x0000000000DDC000-memory.dmp

      Filesize

      48KB

    • memory/2012-40-0x00007FFA2EBB0000-0x00007FFA2F671000-memory.dmp

      Filesize

      10.8MB

    • memory/2012-47-0x00007FFA2EBB0000-0x00007FFA2F671000-memory.dmp

      Filesize

      10.8MB

    • memory/2012-42-0x00000000015B0000-0x00000000015C2000-memory.dmp

      Filesize

      72KB

    • memory/2012-43-0x0000000003010000-0x000000000304C000-memory.dmp

      Filesize

      240KB

    • memory/2012-41-0x00000000015F0000-0x0000000001600000-memory.dmp

      Filesize

      64KB

    • memory/2940-91-0x00000000006B0000-0x00000000006B8000-memory.dmp

      Filesize

      32KB

    • memory/2940-104-0x0000000074880000-0x0000000075030000-memory.dmp

      Filesize

      7.7MB

    • memory/2940-92-0x0000000074880000-0x0000000075030000-memory.dmp

      Filesize

      7.7MB

    • memory/3120-71-0x0000000000C10000-0x0000000000C22000-memory.dmp

      Filesize

      72KB

    • memory/3120-76-0x000000001B190000-0x000000001B1A0000-memory.dmp

      Filesize

      64KB

    • memory/3120-67-0x0000000000230000-0x000000000031A000-memory.dmp

      Filesize

      936KB

    • memory/3120-103-0x000000001B1E0000-0x000000001B1F0000-memory.dmp

      Filesize

      64KB

    • memory/3120-72-0x000000001AFA0000-0x000000001AFEE000-memory.dmp

      Filesize

      312KB

    • memory/3120-74-0x000000001B170000-0x000000001B188000-memory.dmp

      Filesize

      96KB

    • memory/3120-102-0x00007FFA2EBB0000-0x00007FFA2F671000-memory.dmp

      Filesize

      10.8MB

    • memory/3120-97-0x000000001D1C0000-0x000000001D382000-memory.dmp

      Filesize

      1.8MB

    • memory/3120-68-0x00007FFA2EBB0000-0x00007FFA2F671000-memory.dmp

      Filesize

      10.8MB

    • memory/3120-70-0x000000001B1E0000-0x000000001B1F0000-memory.dmp

      Filesize

      64KB

    • memory/3152-75-0x00007FFA2EBB0000-0x00007FFA2F671000-memory.dmp

      Filesize

      10.8MB

    • memory/3152-99-0x00007FFA2EBB0000-0x00007FFA2F671000-memory.dmp

      Filesize

      10.8MB

    • memory/3152-77-0x000000001B860000-0x000000001B870000-memory.dmp

      Filesize

      64KB

    • memory/3748-14-0x0000000000930000-0x0000000000940000-memory.dmp

      Filesize

      64KB

    • memory/4160-6-0x000000001C0B0000-0x000000001C0BE000-memory.dmp

      Filesize

      56KB

    • memory/4160-7-0x000000001C5A0000-0x000000001CA6E000-memory.dmp

      Filesize

      4.8MB

    • memory/4160-1-0x0000000001710000-0x0000000001720000-memory.dmp

      Filesize

      64KB

    • memory/4160-3-0x00007FFA314D0000-0x00007FFA31E71000-memory.dmp

      Filesize

      9.6MB

    • memory/4160-69-0x00007FFA314D0000-0x00007FFA31E71000-memory.dmp

      Filesize

      9.6MB

    • memory/4160-0-0x00007FFA314D0000-0x00007FFA31E71000-memory.dmp

      Filesize

      9.6MB

    • memory/4160-2-0x000000001BED0000-0x000000001BF2C000-memory.dmp

      Filesize

      368KB

    • memory/4160-8-0x000000001CB10000-0x000000001CBAC000-memory.dmp

      Filesize

      624KB

    • memory/4160-24-0x000000001BE30000-0x000000001BE42000-memory.dmp

      Filesize

      72KB

    • memory/4160-22-0x000000001D1D0000-0x000000001D1E6000-memory.dmp

      Filesize

      88KB

    • memory/4160-25-0x000000001D210000-0x000000001D230000-memory.dmp

      Filesize

      128KB