Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04-02-2024 20:17

General

  • Target

    file.exe

  • Size

    916KB

  • MD5

    bdbe50403b411db0e07511e098bdb9ff

  • SHA1

    5772743e950c1c647a5cab202fc3cc29039e2749

  • SHA256

    a758763a7fb30398cbdab370be24c389a1927fb376772fcb31f4017ca942a284

  • SHA512

    9531b3c7572f07aaac342635369732b77c1df58c262e32b21327cd2ac47afe6e3042d79a6a72e30c07b03e420cd9b47b1781bc5ed875b8d7b973b480090261f9

  • SSDEEP

    24576:+cI4MROxnFD3jEsYxrZlI0AilFEvxHiH0h9:+crMiJWrZlI0AilFEvxHi

Malware Config

Extracted

Family

orcus

C2

obfuscated.us:8080

Mutex

0133d229c4e24006957c0e4ab3a52531

Attributes
  • autostart_method

    Registry

  • enable_keylogger

    false

  • install_path

    %programfiles%\Orcus\Orcus.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\OrcusWatchdog.exe

Signatures

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

  • Orcus main payload 1 IoCs
  • Orcurs Rat Executable 2 IoCs
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops desktop.ini file(s) 2 IoCs
  • Drops file in System32 directory 3 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Checks computer location settings
    • Drops desktop.ini file(s)
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:324
    • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\m4ywvehs.cmdline"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1632
      • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC332.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCC321.tmp"
        3⤵
          PID:4172
      • C:\Windows\SysWOW64\WindowsInput.exe
        "C:\Windows\SysWOW64\WindowsInput.exe" --install
        2⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        PID:4900
      • C:\Program Files\Orcus\Orcus.exe
        "C:\Program Files\Orcus\Orcus.exe"
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:2592
        • C:\Users\Admin\AppData\Roaming\OrcusWatchdog.exe
          "C:\Users\Admin\AppData\Roaming\OrcusWatchdog.exe" /launchSelfAndExit "C:\Program Files\Orcus\Orcus.exe" 2592
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3268
          • C:\Users\Admin\AppData\Roaming\OrcusWatchdog.exe
            "C:\Users\Admin\AppData\Roaming\OrcusWatchdog.exe" /watchProcess "C:\Program Files\Orcus\Orcus.exe" 2592
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2920
    • C:\Windows\SysWOW64\WindowsInput.exe
      "C:\Windows\SysWOW64\WindowsInput.exe"
      1⤵
      • Executes dropped EXE
      PID:3568
    • C:\Program Files\Orcus\Orcus.exe
      "C:\Program Files\Orcus\Orcus.exe"
      1⤵
      • Executes dropped EXE
      PID:4996

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files\Orcus\Orcus.exe

      Filesize

      916KB

      MD5

      bdbe50403b411db0e07511e098bdb9ff

      SHA1

      5772743e950c1c647a5cab202fc3cc29039e2749

      SHA256

      a758763a7fb30398cbdab370be24c389a1927fb376772fcb31f4017ca942a284

      SHA512

      9531b3c7572f07aaac342635369732b77c1df58c262e32b21327cd2ac47afe6e3042d79a6a72e30c07b03e420cd9b47b1781bc5ed875b8d7b973b480090261f9

    • C:\Users\Admin\AppData\Local\Temp\RESC332.tmp

      Filesize

      1KB

      MD5

      cb99c0944ec7c4a22942056d69d59229

      SHA1

      75a878aaec47ab5b8faf3f73112b2677e073a596

      SHA256

      800f20caf4a04820be4b8c30353be05e0af819b8f911644b871e266fa72f8f70

      SHA512

      29b31af8c042baa8ba01316b683c0c9a62647a5e0963913aff55d590a63c7475e175346ec42405a18afabf36cc11921a0618a9743c39c4caddc4faff5d51e74b

    • C:\Users\Admin\AppData\Local\Temp\m4ywvehs.dll

      Filesize

      76KB

      MD5

      cd633ddfc0059d959889f0250f0db034

      SHA1

      a8ba6369c216465315031143f342ee3d7e5b4646

      SHA256

      8f08e98b35ed765f35d3af8bbcb18bc5afb7b141c732128477586a5e8226d362

      SHA512

      11e7f1d48c9f7f4d837864576ca019f74ef245b3e1169b52a22492d9ac7e5d0c0e1c23edfcaafe7e512b51a170bf2e2c07cda595b6db7c74dcb30157e7d517c9

    • C:\Users\Admin\AppData\Roaming\OrcusWatchdog.exe

      Filesize

      9KB

      MD5

      913967b216326e36a08010fb70f9dba3

      SHA1

      7b6f8c2eb5b443e03c212b85c2f0edb9c76ad2bf

      SHA256

      8d880758549220154d2ff4ee578f2b49527c5fb76a07d55237b61e30bcc09e3a

      SHA512

      c6fcb98d9fd509e9834fc3fba143bd36d41869cc104fbce5354951f0a6756156e34a30796baaa130dd45de3ed96e039ec14716716f6da4569915c7ef2d2b6c33

    • C:\Windows\SysWOW64\WindowsInput.exe

      Filesize

      21KB

      MD5

      e6fcf516d8ed8d0d4427f86e08d0d435

      SHA1

      c7691731583ab7890086635cb7f3e4c22ca5e409

      SHA256

      8dbe814359391ed6b0b5b182039008cf1d00964da9fbc4747f46242a95c24337

      SHA512

      c496cf8e2e222fe1e19051b291e6860f31aae39f54369c1c5e8c9758c4b56e8af904e3e536e743a0a6fdbbf8478afba4baee92e13fc1b3073376ac6bf4a7948e

    • C:\Windows\SysWOW64\WindowsInput.exe.config

      Filesize

      357B

      MD5

      a2b76cea3a59fa9af5ea21ff68139c98

      SHA1

      35d76475e6a54c168f536e30206578babff58274

      SHA256

      f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839

      SHA512

      b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad

    • \??\c:\Users\Admin\AppData\Local\Temp\CSCC321.tmp

      Filesize

      676B

      MD5

      f26b22f7875178240598501df9d070e9

      SHA1

      5107fec4e5b77b439d5ca6107888aaa0e6137fcf

      SHA256

      75a2c744872699358cc5cdd49770f8e48c5f300b3037ee0a700a182de8fd715f

      SHA512

      8f0813d1d78a3ef543ee99a118ea1278297d79a103f6eaf8ea73431869b618afffee6e63072e9e9c68ea58c4275ddc33c7c5d1a1eb6825712399968ed4973633

    • \??\c:\Users\Admin\AppData\Local\Temp\m4ywvehs.0.cs

      Filesize

      208KB

      MD5

      486ddbcee88dbec70780d0faba2a2650

      SHA1

      7938cacb06db6ff68183e527a4e4d756ded33782

      SHA256

      0115db5d7f9dc999644a204ac269e64cc2d440f52e0fec3709edf19520d1fad5

      SHA512

      49e2c299b82f54d247f46f21e373315dd0cf3677aa56a512e2fbdd659a1b47f8b2ee7e0fea86c8a75ae1380eadaa8ab9b3553ba8868da2a3f06a7d3e1ce417bd

    • \??\c:\Users\Admin\AppData\Local\Temp\m4ywvehs.cmdline

      Filesize

      349B

      MD5

      a6c9750805ebb61abbb42b98b3c9d94c

      SHA1

      a818e2f631e283e520797cf43c8f0d739fa8878c

      SHA256

      6247ae294b0d5fd08ca2e193a271e9c06a3ce48c7fcdbcc8a47fa6ce41b5d86f

      SHA512

      94094ba6ef3d56ebc34c7ff24bfd8b4f20d4c70a7b35f8c70a54692c5c38ca009a4bdb3e4594e9f4ae1a67176978cbd42761792b4dc29d454c56fcde95b339fd

    • memory/324-7-0x000000001C350000-0x000000001C81E000-memory.dmp

      Filesize

      4.8MB

    • memory/324-8-0x000000001C8C0000-0x000000001C95C000-memory.dmp

      Filesize

      624KB

    • memory/324-0-0x00007FFD8F0D0000-0x00007FFD8FA71000-memory.dmp

      Filesize

      9.6MB

    • memory/324-6-0x000000001BE70000-0x000000001BE7E000-memory.dmp

      Filesize

      56KB

    • memory/324-22-0x000000001CF80000-0x000000001CF96000-memory.dmp

      Filesize

      88KB

    • memory/324-24-0x000000001BBE0000-0x000000001BBF2000-memory.dmp

      Filesize

      72KB

    • memory/324-25-0x000000001CFC0000-0x000000001CFE0000-memory.dmp

      Filesize

      128KB

    • memory/324-3-0x000000001BC80000-0x000000001BCDC000-memory.dmp

      Filesize

      368KB

    • memory/324-2-0x0000000001730000-0x0000000001740000-memory.dmp

      Filesize

      64KB

    • memory/324-68-0x00007FFD8F0D0000-0x00007FFD8FA71000-memory.dmp

      Filesize

      9.6MB

    • memory/324-67-0x00007FFD8F0D0000-0x00007FFD8FA71000-memory.dmp

      Filesize

      9.6MB

    • memory/324-1-0x00007FFD8F0D0000-0x00007FFD8FA71000-memory.dmp

      Filesize

      9.6MB

    • memory/1632-14-0x0000000002370000-0x0000000002380000-memory.dmp

      Filesize

      64KB

    • memory/2592-106-0x0000000003170000-0x0000000003180000-memory.dmp

      Filesize

      64KB

    • memory/2592-71-0x0000000003170000-0x0000000003180000-memory.dmp

      Filesize

      64KB

    • memory/2592-78-0x000000001CCB0000-0x000000001CCC0000-memory.dmp

      Filesize

      64KB

    • memory/2592-103-0x000000001DF10000-0x000000001E0D2000-memory.dmp

      Filesize

      1.8MB

    • memory/2592-75-0x000000001CB80000-0x000000001CB98000-memory.dmp

      Filesize

      96KB

    • memory/2592-105-0x00007FFD8C9A0000-0x00007FFD8D461000-memory.dmp

      Filesize

      10.8MB

    • memory/2592-73-0x000000001C9E0000-0x000000001CA2E000-memory.dmp

      Filesize

      312KB

    • memory/2592-69-0x0000000000EC0000-0x0000000000FAA000-memory.dmp

      Filesize

      936KB

    • memory/2592-72-0x000000001BB10000-0x000000001BB22000-memory.dmp

      Filesize

      72KB

    • memory/2592-70-0x00007FFD8C9A0000-0x00007FFD8D461000-memory.dmp

      Filesize

      10.8MB

    • memory/2920-107-0x0000000075180000-0x0000000075930000-memory.dmp

      Filesize

      7.7MB

    • memory/2920-98-0x0000000075180000-0x0000000075930000-memory.dmp

      Filesize

      7.7MB

    • memory/3268-102-0x0000000075180000-0x0000000075930000-memory.dmp

      Filesize

      7.7MB

    • memory/3268-94-0x0000000075180000-0x0000000075930000-memory.dmp

      Filesize

      7.7MB

    • memory/3268-95-0x0000000000620000-0x0000000000628000-memory.dmp

      Filesize

      32KB

    • memory/3568-50-0x000000001A260000-0x000000001A270000-memory.dmp

      Filesize

      64KB

    • memory/3568-104-0x000000001A260000-0x000000001A270000-memory.dmp

      Filesize

      64KB

    • memory/3568-97-0x00007FFD8C9A0000-0x00007FFD8D461000-memory.dmp

      Filesize

      10.8MB

    • memory/3568-51-0x000000001A680000-0x000000001A78A000-memory.dmp

      Filesize

      1.0MB

    • memory/3568-49-0x00007FFD8C9A0000-0x00007FFD8D461000-memory.dmp

      Filesize

      10.8MB

    • memory/4900-47-0x00007FFD8C9A0000-0x00007FFD8D461000-memory.dmp

      Filesize

      10.8MB

    • memory/4900-43-0x000000001ADB0000-0x000000001ADEC000-memory.dmp

      Filesize

      240KB

    • memory/4900-42-0x0000000002200000-0x0000000002212000-memory.dmp

      Filesize

      72KB

    • memory/4900-41-0x000000001AE40000-0x000000001AE50000-memory.dmp

      Filesize

      64KB

    • memory/4900-40-0x00007FFD8C9A0000-0x00007FFD8D461000-memory.dmp

      Filesize

      10.8MB

    • memory/4900-39-0x0000000000170000-0x000000000017C000-memory.dmp

      Filesize

      48KB

    • memory/4996-76-0x00007FFD8C9A0000-0x00007FFD8D461000-memory.dmp

      Filesize

      10.8MB

    • memory/4996-101-0x00007FFD8C9A0000-0x00007FFD8D461000-memory.dmp

      Filesize

      10.8MB

    • memory/4996-77-0x000000001BB40000-0x000000001BB50000-memory.dmp

      Filesize

      64KB