Analysis

  • max time kernel
    150s
  • max time network
    141s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    04-02-2024 20:17

General

  • Target

    file.exe

  • Size

    916KB

  • MD5

    bdbe50403b411db0e07511e098bdb9ff

  • SHA1

    5772743e950c1c647a5cab202fc3cc29039e2749

  • SHA256

    a758763a7fb30398cbdab370be24c389a1927fb376772fcb31f4017ca942a284

  • SHA512

    9531b3c7572f07aaac342635369732b77c1df58c262e32b21327cd2ac47afe6e3042d79a6a72e30c07b03e420cd9b47b1781bc5ed875b8d7b973b480090261f9

  • SSDEEP

    24576:+cI4MROxnFD3jEsYxrZlI0AilFEvxHiH0h9:+crMiJWrZlI0AilFEvxHi

Malware Config

Extracted

Family

orcus

C2

obfuscated.us:8080

Mutex

0133d229c4e24006957c0e4ab3a52531

Attributes
  • autostart_method

    Registry

  • enable_keylogger

    false

  • install_path

    %programfiles%\Orcus\Orcus.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\OrcusWatchdog.exe

Signatures

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

  • Orcus main payload 2 IoCs
  • Orcurs Rat Executable 3 IoCs
  • Executes dropped EXE 6 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 3 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:2224
    • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\1xgjy0uj.cmdline"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2016
      • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA9F6.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCA9F5.tmp"
        3⤵
          PID:2232
      • C:\Windows\SysWOW64\WindowsInput.exe
        "C:\Windows\SysWOW64\WindowsInput.exe" --install
        2⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        PID:2820
      • C:\Program Files\Orcus\Orcus.exe
        "C:\Program Files\Orcus\Orcus.exe"
        2⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:2504
        • C:\Users\Admin\AppData\Roaming\OrcusWatchdog.exe
          "C:\Users\Admin\AppData\Roaming\OrcusWatchdog.exe" /launchSelfAndExit "C:\Program Files\Orcus\Orcus.exe" 2504
          3⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2628
          • C:\Users\Admin\AppData\Roaming\OrcusWatchdog.exe
            "C:\Users\Admin\AppData\Roaming\OrcusWatchdog.exe" /watchProcess "C:\Program Files\Orcus\Orcus.exe" 2504
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2172
    • C:\Windows\SysWOW64\WindowsInput.exe
      "C:\Windows\SysWOW64\WindowsInput.exe"
      1⤵
      • Executes dropped EXE
      PID:2660
    • C:\Windows\system32\taskeng.exe
      taskeng.exe {B8AF6BFB-34C7-4DBF-8716-C1247186631D} S-1-5-21-3427588347-1492276948-3422228430-1000:QVMRJQQO\Admin:Interactive:[1]
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:1492
      • C:\Program Files\Orcus\Orcus.exe
        "C:\Program Files\Orcus\Orcus.exe"
        2⤵
        • Executes dropped EXE
        PID:1612

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files\Orcus\Orcus.exe

      Filesize

      256KB

      MD5

      08d7b239c7a93100e8a3e2a29f4aac8a

      SHA1

      d5994253fa0ea5cf6dfa1c30365a244d0386deb3

      SHA256

      c590ca079cb95e34f9756296876e3579ab17239338fd4306afbeab75a4133059

      SHA512

      495ae5ee2d9794557f5153da95d89ebda5f16e396a2eea4470169d1e11f0dbe43d900512e5cfe2bb1a663f3d82a4fd720504f1806610d66b2bdacce5365e92a2

    • C:\Program Files\Orcus\Orcus.exe

      Filesize

      916KB

      MD5

      bdbe50403b411db0e07511e098bdb9ff

      SHA1

      5772743e950c1c647a5cab202fc3cc29039e2749

      SHA256

      a758763a7fb30398cbdab370be24c389a1927fb376772fcb31f4017ca942a284

      SHA512

      9531b3c7572f07aaac342635369732b77c1df58c262e32b21327cd2ac47afe6e3042d79a6a72e30c07b03e420cd9b47b1781bc5ed875b8d7b973b480090261f9

    • C:\Users\Admin\AppData\Local\Temp\1xgjy0uj.dll

      Filesize

      76KB

      MD5

      ce9fd353e17d3c7d44284156dc6be93d

      SHA1

      6cba99c96d890547161d7897190caba6239eca35

      SHA256

      2f52fb93e54f11a494d67b3d0c93fc4d5efd4d74c4d5634aa2a25330b4bcc764

      SHA512

      952a5c3abde0929a4975b1ebb341682a3b74ac9377a948bea55e32dc9c15d4845c5d2b5219c9d628bade30de5857333223db386cebe39add5c0289e77f0f470b

    • C:\Users\Admin\AppData\Local\Temp\CabD0D8.tmp

      Filesize

      65KB

      MD5

      ac05d27423a85adc1622c714f2cb6184

      SHA1

      b0fe2b1abddb97837ea0195be70ab2ff14d43198

      SHA256

      c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

      SHA512

      6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

    • C:\Users\Admin\AppData\Local\Temp\RESA9F6.tmp

      Filesize

      1KB

      MD5

      0898d958ec474f3e22db11ac130a926b

      SHA1

      36cfb023971319b587b05c6761f5d4be5d1a1b08

      SHA256

      abb5c171bcabbf9243cfae3a44b9a2d87d46a22d5afd5d69d18b7cb2f0ea4f8b

      SHA512

      1b7d12fcd32b8ae7002629090436f21825907c41907a6a7bc37a5af3c17c5390ff7c0fad1e9b315034f865d2fdeae7b622c255a7a152fe414bedb12a9c4c6dbc

    • C:\Users\Admin\AppData\Roaming\OrcusWatchdog.exe

      Filesize

      9KB

      MD5

      913967b216326e36a08010fb70f9dba3

      SHA1

      7b6f8c2eb5b443e03c212b85c2f0edb9c76ad2bf

      SHA256

      8d880758549220154d2ff4ee578f2b49527c5fb76a07d55237b61e30bcc09e3a

      SHA512

      c6fcb98d9fd509e9834fc3fba143bd36d41869cc104fbce5354951f0a6756156e34a30796baaa130dd45de3ed96e039ec14716716f6da4569915c7ef2d2b6c33

    • C:\Windows\SysWOW64\WindowsInput.exe

      Filesize

      21KB

      MD5

      e6fcf516d8ed8d0d4427f86e08d0d435

      SHA1

      c7691731583ab7890086635cb7f3e4c22ca5e409

      SHA256

      8dbe814359391ed6b0b5b182039008cf1d00964da9fbc4747f46242a95c24337

      SHA512

      c496cf8e2e222fe1e19051b291e6860f31aae39f54369c1c5e8c9758c4b56e8af904e3e536e743a0a6fdbbf8478afba4baee92e13fc1b3073376ac6bf4a7948e

    • C:\Windows\SysWOW64\WindowsInput.exe.config

      Filesize

      357B

      MD5

      a2b76cea3a59fa9af5ea21ff68139c98

      SHA1

      35d76475e6a54c168f536e30206578babff58274

      SHA256

      f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839

      SHA512

      b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad

    • \??\c:\Users\Admin\AppData\Local\Temp\1xgjy0uj.0.cs

      Filesize

      208KB

      MD5

      568d7ffc9a98566be8af1fa2176dac14

      SHA1

      92315df4d98746cb07ea146ee10edebd29991398

      SHA256

      d9dbebd739a0e72993b7fa7537c8e9cb18937dd932ddc689965ba532d1cd89bd

      SHA512

      0f2db73015bdb6d337673ed802c1e86b2f089083f502c2fe44bbe31fbeb015f59e6a751ce2897e64e9b126b95b686395699a9e0976838fafe1eb9e6ddc2a0626

    • \??\c:\Users\Admin\AppData\Local\Temp\1xgjy0uj.cmdline

      Filesize

      349B

      MD5

      3bbc072d2fc040d28e8476090630f73a

      SHA1

      63d30dca24e387258ae48255f98ffdf94e8bc0b2

      SHA256

      f78db59a6b092acfbb3bea059464c73b7e16a891b85975dbd82fb4b202253813

      SHA512

      82c15b4f94b1982760c879d9eb0b3931c9b1ef37611ae55330ad20b8bc9d8a23ba3634aa79e8dc0a4552554a8c02d28c1864339fc2d3eb15dd6d994f02c1fc81

    • \??\c:\Users\Admin\AppData\Local\Temp\CSCA9F5.tmp

      Filesize

      676B

      MD5

      81b9ccd9901cad888236050e722562e6

      SHA1

      7b091c63b47a47e217b42beb5a5ddd07eab8aadc

      SHA256

      b674b16ab648f3f969e9ca74b26a23a1325ab662d45e86a899257f3760bd1bdb

      SHA512

      c85196bacf12398b6d84ce7181cc2cdbb2100e9f264bd5983e36fb8bbb3ea0903d3f6a5990d6f0108f45908ce3b0e8267a83b3c661d1b143c1ef6239bd92defe

    • memory/1612-55-0x000000001AF40000-0x000000001AFC0000-memory.dmp

      Filesize

      512KB

    • memory/1612-87-0x000007FEEE3F0000-0x000007FEEEDDC000-memory.dmp

      Filesize

      9.9MB

    • memory/1612-53-0x000007FEEE3F0000-0x000007FEEEDDC000-memory.dmp

      Filesize

      9.9MB

    • memory/2016-10-0x0000000002290000-0x0000000002310000-memory.dmp

      Filesize

      512KB

    • memory/2172-85-0x0000000074960000-0x000000007504E000-memory.dmp

      Filesize

      6.9MB

    • memory/2172-92-0x0000000074960000-0x000000007504E000-memory.dmp

      Filesize

      6.9MB

    • memory/2224-18-0x0000000002420000-0x0000000002436000-memory.dmp

      Filesize

      88KB

    • memory/2224-3-0x0000000000AA0000-0x0000000000B20000-memory.dmp

      Filesize

      512KB

    • memory/2224-1-0x00000000009C0000-0x00000000009CE000-memory.dmp

      Filesize

      56KB

    • memory/2224-2-0x000007FEF5A70000-0x000007FEF640D000-memory.dmp

      Filesize

      9.6MB

    • memory/2224-4-0x000007FEF5A70000-0x000007FEF640D000-memory.dmp

      Filesize

      9.6MB

    • memory/2224-0-0x000000001B020000-0x000000001B07C000-memory.dmp

      Filesize

      368KB

    • memory/2224-45-0x000007FEF5A70000-0x000007FEF640D000-memory.dmp

      Filesize

      9.6MB

    • memory/2224-20-0x00000000009E0000-0x00000000009F2000-memory.dmp

      Filesize

      72KB

    • memory/2504-56-0x000000001AE10000-0x000000001AE90000-memory.dmp

      Filesize

      512KB

    • memory/2504-89-0x000007FEEE3F0000-0x000007FEEEDDC000-memory.dmp

      Filesize

      9.9MB

    • memory/2504-90-0x000000001AE10000-0x000000001AE90000-memory.dmp

      Filesize

      512KB

    • memory/2504-50-0x0000000000910000-0x000000000095E000-memory.dmp

      Filesize

      312KB

    • memory/2504-51-0x0000000002020000-0x0000000002038000-memory.dmp

      Filesize

      96KB

    • memory/2504-47-0x00000000009A0000-0x0000000000A8A000-memory.dmp

      Filesize

      936KB

    • memory/2504-54-0x0000000002050000-0x0000000002060000-memory.dmp

      Filesize

      64KB

    • memory/2504-46-0x000007FEEE3F0000-0x000007FEEEDDC000-memory.dmp

      Filesize

      9.9MB

    • memory/2504-49-0x0000000000900000-0x0000000000912000-memory.dmp

      Filesize

      72KB

    • memory/2504-48-0x000000001AE10000-0x000000001AE90000-memory.dmp

      Filesize

      512KB

    • memory/2504-91-0x000000001AE10000-0x000000001AE90000-memory.dmp

      Filesize

      512KB

    • memory/2628-81-0x0000000000F70000-0x0000000000F78000-memory.dmp

      Filesize

      32KB

    • memory/2628-82-0x0000000074960000-0x000000007504E000-memory.dmp

      Filesize

      6.9MB

    • memory/2628-84-0x0000000074960000-0x000000007504E000-memory.dmp

      Filesize

      6.9MB

    • memory/2660-34-0x0000000000E40000-0x0000000000E4C000-memory.dmp

      Filesize

      48KB

    • memory/2660-86-0x000007FEEE3F0000-0x000007FEEEDDC000-memory.dmp

      Filesize

      9.9MB

    • memory/2660-36-0x0000000019BF0000-0x0000000019C70000-memory.dmp

      Filesize

      512KB

    • memory/2660-88-0x0000000019BF0000-0x0000000019C70000-memory.dmp

      Filesize

      512KB

    • memory/2660-35-0x000007FEEE3F0000-0x000007FEEEDDC000-memory.dmp

      Filesize

      9.9MB

    • memory/2820-28-0x00000000001B0000-0x00000000001BC000-memory.dmp

      Filesize

      48KB

    • memory/2820-32-0x000007FEEEDE0000-0x000007FEEF7CC000-memory.dmp

      Filesize

      9.9MB

    • memory/2820-29-0x000007FEEEDE0000-0x000007FEEF7CC000-memory.dmp

      Filesize

      9.9MB