Analysis

  • max time kernel
    149s
  • max time network
    122s
  • platform
    windows11-21h2_x64
  • resource
    win11-20231215-en
  • resource tags

    arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    04-02-2024 20:17

General

  • Target

    file.exe

  • Size

    916KB

  • MD5

    bdbe50403b411db0e07511e098bdb9ff

  • SHA1

    5772743e950c1c647a5cab202fc3cc29039e2749

  • SHA256

    a758763a7fb30398cbdab370be24c389a1927fb376772fcb31f4017ca942a284

  • SHA512

    9531b3c7572f07aaac342635369732b77c1df58c262e32b21327cd2ac47afe6e3042d79a6a72e30c07b03e420cd9b47b1781bc5ed875b8d7b973b480090261f9

  • SSDEEP

    24576:+cI4MROxnFD3jEsYxrZlI0AilFEvxHiH0h9:+crMiJWrZlI0AilFEvxHi

Malware Config

Extracted

Family

orcus

C2

obfuscated.us:8080

Mutex

0133d229c4e24006957c0e4ab3a52531

Attributes
  • autostart_method

    Registry

  • enable_keylogger

    false

  • install_path

    %programfiles%\Orcus\Orcus.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\OrcusWatchdog.exe

Signatures

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

  • Orcus main payload 4 IoCs
  • Orcurs Rat Executable 5 IoCs
  • Executes dropped EXE 6 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops desktop.ini file(s) 2 IoCs
  • Drops file in System32 directory 3 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:944
    • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dr8--g4g.cmdline"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4612
      • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES782E.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC782D.tmp"
        3⤵
          PID:1436
      • C:\Windows\SysWOW64\WindowsInput.exe
        "C:\Windows\SysWOW64\WindowsInput.exe" --install
        2⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        PID:3616
      • C:\Program Files\Orcus\Orcus.exe
        "C:\Program Files\Orcus\Orcus.exe"
        2⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:2400
    • C:\Windows\SysWOW64\WindowsInput.exe
      "C:\Windows\SysWOW64\WindowsInput.exe"
      1⤵
      • Executes dropped EXE
      PID:4792
    • C:\Program Files\Orcus\Orcus.exe
      "C:\Program Files\Orcus\Orcus.exe"
      1⤵
      • Executes dropped EXE
      PID:3860
    • C:\Users\Admin\AppData\Roaming\OrcusWatchdog.exe
      "C:\Users\Admin\AppData\Roaming\OrcusWatchdog.exe" /launchSelfAndExit "C:\Program Files\Orcus\Orcus.exe" 2400
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2092
      • C:\Users\Admin\AppData\Roaming\OrcusWatchdog.exe
        "C:\Users\Admin\AppData\Roaming\OrcusWatchdog.exe" /watchProcess "C:\Program Files\Orcus\Orcus.exe" 2400
        2⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1384

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files\Orcus\Orcus.exe

      Filesize

      225KB

      MD5

      4dc1f3f0c8fd1f69a085a15496d68947

      SHA1

      2b76bd6a9f90bf266b3aed41a999517f2abf1658

      SHA256

      0c200050ac8bb6e68915faa9e22142e47452d2db9e7d49f3805ff04174e001d9

      SHA512

      705aa4e9d694d4880cd1223b1a0bafeb5b7f3e9dda2815ac8684932243d981205dcdfc833275577f3ac278e948d39ae882f427d5d8494225d95e813b0e5600b0

    • C:\Program Files\Orcus\Orcus.exe

      Filesize

      305KB

      MD5

      9035c83f3d0492f35dc96b4ae49defb9

      SHA1

      5bf81099f9741bcda0cb640ed7039fb1eaf471ce

      SHA256

      8e7b1959d62794533a818e2187494203abd9764929c7b761a3b6df96604385d6

      SHA512

      17f1d73a2e579ebff44cc08df5e6be8a44e56ffe6e57a3df4a38804a737fb1e8ff3dcf4cb81440e96a0174be5529c4adcd8c34b46da140586a6b3d9e2f554511

    • C:\Program Files\Orcus\Orcus.exe

      Filesize

      80KB

      MD5

      fed0a26b5d04a60f3a0f9bb2f657faa4

      SHA1

      632004f23dd4b492228b290bfeee497a92807ca6

      SHA256

      63b9e2cb9813e6620e67df2f9621fe78ee9369b44c86de824430adf47270dbbb

      SHA512

      723a36ad7ec71759c5defe6a4e88f521d4028c4e0f11c69eb4306d7725cae7bffa34bc021dbe5dd64b8273ba1f4c8c6b4d1108d24cd1284e74edbc7266befae4

    • C:\Program Files\Orcus\Orcus.exe

      Filesize

      85KB

      MD5

      1442ce2584b137d0c0e441090506be10

      SHA1

      90ec4698b77784667bdd3bf3d69f20bfda4fdfe1

      SHA256

      1430b448163bf6d4dac646d16fbc1e2baf026eb9a2abf46a190c2400fdfe6456

      SHA512

      73b46bf5654a318d2f5384eefedb9eba4764ac25ee60322c0ab5b7f82efd07e16c40b297d99c0f5ec1a4d86a1205eeae75f38808374cab710b7de842d5da0029

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\OrcusWatchdog.exe.log

      Filesize

      425B

      MD5

      bb27934be8860266d478c13f2d65f45e

      SHA1

      a69a0e171864dcac9ade1b04fc0313e6b4024ccb

      SHA256

      85ad0d9909461517acf2e24ff116ca350e9b7000b4eefb23aa3647423c9745b4

      SHA512

      87dd77feac509a25b30c76c119752cc25020cca9c53276c2082aef2a8c75670ef67e1e70024a63d44ae442b64f4bc464aee6691e80c525376bb7421929cfa3bb

    • C:\Users\Admin\AppData\Local\Temp\RES782E.tmp

      Filesize

      1KB

      MD5

      66fdb6422da2fc9d6926b1f5087ac71c

      SHA1

      a5dbb6e1f5517c02b53cca254bf3256e5b83cf2b

      SHA256

      c4618e7fe9fd095908eb5fa577098a1b44014658ea4733150dd45028fd9be0a9

      SHA512

      8e2f5e198a979064b38cd7abcff84c078f7b56ed4c89d2416a53d2ef99dd3c426992b14bdb64ae825f7e07f41cb801fd74fd27a676b34a982ec8127870784cdc

    • C:\Users\Admin\AppData\Local\Temp\dr8--g4g.dll

      Filesize

      76KB

      MD5

      717ece6b58e7c80c16ab7514d6b0209c

      SHA1

      e5961161ce13fc65b8a4f378c9cbfcd8e591b750

      SHA256

      a017a12a1ec094f98e6663fba31f1d073249295484c0e902b36026f16076dcd6

      SHA512

      56a3d8644fcacea077dbeb3c07582959cbf3853e8aa7a9f8ea99e56aafd7814ae496b15319541b8e6f58c51c6ccd13f7c6993258e95fd51a96cc66bef2c74e46

    • C:\Users\Admin\AppData\Roaming\OrcusWatchdog.exe

      Filesize

      9KB

      MD5

      913967b216326e36a08010fb70f9dba3

      SHA1

      7b6f8c2eb5b443e03c212b85c2f0edb9c76ad2bf

      SHA256

      8d880758549220154d2ff4ee578f2b49527c5fb76a07d55237b61e30bcc09e3a

      SHA512

      c6fcb98d9fd509e9834fc3fba143bd36d41869cc104fbce5354951f0a6756156e34a30796baaa130dd45de3ed96e039ec14716716f6da4569915c7ef2d2b6c33

    • C:\Windows\SysWOW64\WindowsInput.exe

      Filesize

      21KB

      MD5

      e6fcf516d8ed8d0d4427f86e08d0d435

      SHA1

      c7691731583ab7890086635cb7f3e4c22ca5e409

      SHA256

      8dbe814359391ed6b0b5b182039008cf1d00964da9fbc4747f46242a95c24337

      SHA512

      c496cf8e2e222fe1e19051b291e6860f31aae39f54369c1c5e8c9758c4b56e8af904e3e536e743a0a6fdbbf8478afba4baee92e13fc1b3073376ac6bf4a7948e

    • C:\Windows\SysWOW64\WindowsInput.exe.config

      Filesize

      357B

      MD5

      a2b76cea3a59fa9af5ea21ff68139c98

      SHA1

      35d76475e6a54c168f536e30206578babff58274

      SHA256

      f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839

      SHA512

      b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad

    • \??\c:\Users\Admin\AppData\Local\Temp\CSC782D.tmp

      Filesize

      676B

      MD5

      2ca2f8e365f7bc5d3804db12879cb8cb

      SHA1

      044ff587d5bd7385f9e87efd9b6ba00a3a86288f

      SHA256

      80953b58a871c56349bbd8f5c961de0d0c07b8e323bf5150afdf9ddf585f653b

      SHA512

      c1dfbf8c3293a85265c6d36ef2dd0d37dfbac601db816adcb4f0cb77df3c0607309221cf8ea29b1b3b32bdcd70a35745b286c667a79703aba24c3bb0e4cedd67

    • \??\c:\Users\Admin\AppData\Local\Temp\dr8--g4g.0.cs

      Filesize

      208KB

      MD5

      ccb9306704948bc3f20bd7777769dc90

      SHA1

      54ceabf8801f5d36f0bc87a19c0735c52b9780c3

      SHA256

      4fe40981c744a18586d716d60053fdf77b5dd90834a395622a04e4d58f2cc66f

      SHA512

      d22613b544feb44254679990be0322acf466bf0b3e5ed4563503effdcbea3c68c886572605dee7b89e704171e65cf0b48c19300d30073c829c1ae2a14a965a50

    • \??\c:\Users\Admin\AppData\Local\Temp\dr8--g4g.cmdline

      Filesize

      349B

      MD5

      51ffbe53b586b3b71601a92a1575f6ee

      SHA1

      50906e43220e3fb762db8608549a0298738ce16c

      SHA256

      a246207cc921c397fb757072df0cbfc67494015fc8f598ccd4bd5ffa651d018c

      SHA512

      052f53c6418cb282a84dd3bec14e74bfd7aa960a9e8f74b1cb189556847f334b2c22e1b3a8279654efd93e3b5d23007429d96149f39494fc5a879950f51b0fbb

    • memory/944-8-0x000000001CCB0000-0x000000001CD4C000-memory.dmp

      Filesize

      624KB

    • memory/944-67-0x00007FF9AFFB0000-0x00007FF9B0951000-memory.dmp

      Filesize

      9.6MB

    • memory/944-25-0x000000001D3B0000-0x000000001D3D0000-memory.dmp

      Filesize

      128KB

    • memory/944-24-0x0000000001A70000-0x0000000001A82000-memory.dmp

      Filesize

      72KB

    • memory/944-22-0x000000001CD80000-0x000000001CD96000-memory.dmp

      Filesize

      88KB

    • memory/944-1-0x0000000001A90000-0x0000000001AA0000-memory.dmp

      Filesize

      64KB

    • memory/944-7-0x000000001C740000-0x000000001CC0E000-memory.dmp

      Filesize

      4.8MB

    • memory/944-2-0x000000001C080000-0x000000001C0DC000-memory.dmp

      Filesize

      368KB

    • memory/944-3-0x00007FF9AFFB0000-0x00007FF9B0951000-memory.dmp

      Filesize

      9.6MB

    • memory/944-6-0x000000001C260000-0x000000001C26E000-memory.dmp

      Filesize

      56KB

    • memory/944-0-0x00007FF9AFFB0000-0x00007FF9B0951000-memory.dmp

      Filesize

      9.6MB

    • memory/1384-108-0x0000000074D90000-0x0000000075541000-memory.dmp

      Filesize

      7.7MB

    • memory/1384-97-0x0000000074D90000-0x0000000075541000-memory.dmp

      Filesize

      7.7MB

    • memory/2092-91-0x00000000006F0000-0x00000000006F8000-memory.dmp

      Filesize

      32KB

    • memory/2092-92-0x0000000074D90000-0x0000000075541000-memory.dmp

      Filesize

      7.7MB

    • memory/2092-96-0x0000000074D90000-0x0000000075541000-memory.dmp

      Filesize

      7.7MB

    • memory/2400-71-0x000000001B840000-0x000000001B852000-memory.dmp

      Filesize

      72KB

    • memory/2400-69-0x0000000000B80000-0x0000000000C6A000-memory.dmp

      Filesize

      936KB

    • memory/2400-70-0x0000000002D60000-0x0000000002D70000-memory.dmp

      Filesize

      64KB

    • memory/2400-68-0x00007FF9ADBB0000-0x00007FF9AE672000-memory.dmp

      Filesize

      10.8MB

    • memory/2400-72-0x000000001B850000-0x000000001B89E000-memory.dmp

      Filesize

      312KB

    • memory/2400-107-0x0000000002D60000-0x0000000002D70000-memory.dmp

      Filesize

      64KB

    • memory/2400-74-0x000000001B8E0000-0x000000001B8F8000-memory.dmp

      Filesize

      96KB

    • memory/2400-75-0x000000001B900000-0x000000001B910000-memory.dmp

      Filesize

      64KB

    • memory/2400-79-0x0000000002D60000-0x0000000002D70000-memory.dmp

      Filesize

      64KB

    • memory/2400-106-0x0000000002D60000-0x0000000002D70000-memory.dmp

      Filesize

      64KB

    • memory/2400-105-0x00007FF9ADBB0000-0x00007FF9AE672000-memory.dmp

      Filesize

      10.8MB

    • memory/2400-100-0x000000001E9B0000-0x000000001EB72000-memory.dmp

      Filesize

      1.8MB

    • memory/3616-41-0x000000001B200000-0x000000001B210000-memory.dmp

      Filesize

      64KB

    • memory/3616-47-0x00007FF9ADBB0000-0x00007FF9AE672000-memory.dmp

      Filesize

      10.8MB

    • memory/3616-42-0x0000000002600000-0x0000000002612000-memory.dmp

      Filesize

      72KB

    • memory/3616-43-0x0000000002660000-0x000000000269C000-memory.dmp

      Filesize

      240KB

    • memory/3616-40-0x00007FF9ADBB0000-0x00007FF9AE672000-memory.dmp

      Filesize

      10.8MB

    • memory/3616-39-0x0000000000500000-0x000000000050C000-memory.dmp

      Filesize

      48KB

    • memory/3860-102-0x00007FF9ADBB0000-0x00007FF9AE672000-memory.dmp

      Filesize

      10.8MB

    • memory/3860-78-0x00007FF9ADBB0000-0x00007FF9AE672000-memory.dmp

      Filesize

      10.8MB

    • memory/4612-14-0x00000000023D0000-0x00000000023E0000-memory.dmp

      Filesize

      64KB

    • memory/4792-50-0x0000000019FC0000-0x0000000019FD0000-memory.dmp

      Filesize

      64KB

    • memory/4792-104-0x0000000019FC0000-0x0000000019FD0000-memory.dmp

      Filesize

      64KB

    • memory/4792-103-0x00007FF9ADBB0000-0x00007FF9AE672000-memory.dmp

      Filesize

      10.8MB

    • memory/4792-49-0x00007FF9ADBB0000-0x00007FF9AE672000-memory.dmp

      Filesize

      10.8MB

    • memory/4792-51-0x000000001A3E0000-0x000000001A4EA000-memory.dmp

      Filesize

      1.0MB