Analysis

  • max time kernel
    149s
  • max time network
    120s
  • platform
    windows11-21h2_x64
  • resource
    win11-20231222-en
  • resource tags

    arch:x64arch:x86image:win11-20231222-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    04-02-2024 20:17

General

  • Target

    file.exe

  • Size

    916KB

  • MD5

    bdbe50403b411db0e07511e098bdb9ff

  • SHA1

    5772743e950c1c647a5cab202fc3cc29039e2749

  • SHA256

    a758763a7fb30398cbdab370be24c389a1927fb376772fcb31f4017ca942a284

  • SHA512

    9531b3c7572f07aaac342635369732b77c1df58c262e32b21327cd2ac47afe6e3042d79a6a72e30c07b03e420cd9b47b1781bc5ed875b8d7b973b480090261f9

  • SSDEEP

    24576:+cI4MROxnFD3jEsYxrZlI0AilFEvxHiH0h9:+crMiJWrZlI0AilFEvxHi

Malware Config

Extracted

Family

orcus

C2

obfuscated.us:8080

Mutex

0133d229c4e24006957c0e4ab3a52531

Attributes
  • autostart_method

    Registry

  • enable_keylogger

    false

  • install_path

    %programfiles%\Orcus\Orcus.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\OrcusWatchdog.exe

Signatures

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

  • Orcus main payload 4 IoCs
  • Orcurs Rat Executable 5 IoCs
  • Executes dropped EXE 6 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops desktop.ini file(s) 2 IoCs
  • Drops file in System32 directory 3 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:1164
    • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jngxey_p.cmdline"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2780
      • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4AC5.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC4AC4.tmp"
        3⤵
          PID:2036
      • C:\Windows\SysWOW64\WindowsInput.exe
        "C:\Windows\SysWOW64\WindowsInput.exe" --install
        2⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        PID:1572
      • C:\Program Files\Orcus\Orcus.exe
        "C:\Program Files\Orcus\Orcus.exe"
        2⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:1832
    • C:\Windows\SysWOW64\WindowsInput.exe
      "C:\Windows\SysWOW64\WindowsInput.exe"
      1⤵
      • Executes dropped EXE
      PID:2396
    • C:\Program Files\Orcus\Orcus.exe
      "C:\Program Files\Orcus\Orcus.exe"
      1⤵
      • Executes dropped EXE
      PID:448
    • C:\Users\Admin\AppData\Roaming\OrcusWatchdog.exe
      "C:\Users\Admin\AppData\Roaming\OrcusWatchdog.exe" /launchSelfAndExit "C:\Program Files\Orcus\Orcus.exe" 1832
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4408
      • C:\Users\Admin\AppData\Roaming\OrcusWatchdog.exe
        "C:\Users\Admin\AppData\Roaming\OrcusWatchdog.exe" /watchProcess "C:\Program Files\Orcus\Orcus.exe" 1832
        2⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1820

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files\Orcus\Orcus.exe

      Filesize

      120KB

      MD5

      4821175f5c0939a6215f3e86d60b1568

      SHA1

      521dae8ced8fd86b0352cfefebb3d1e0bdd9f3ce

      SHA256

      c1d63a301d38230577f9840e22a27f17cc99bdde668aa73007e3acf49d328d36

      SHA512

      bdcff2c4c13506209ab531e2f75958d0a5db92cacda7a34a8af06e1ba7200f6fe37bb211177b57d3b04172780ae870ca3053e3439eea3f07ba47d61fe7a673ad

    • C:\Program Files\Orcus\Orcus.exe

      Filesize

      138KB

      MD5

      ec11769d10795289443f69e65112dcc9

      SHA1

      58ad7c4d18d428ac7b63c70074014c5384484f05

      SHA256

      afabce7550c50da87b04bd8bac53cee2beb1769e80f3ca2f2985019133a5ce57

      SHA512

      9ba9798039f1dac2c9afa11f3f65d0888615cb7e2c5d559e51f6054e41f713bcc1970394d1662139e45957183851f88678380cc105e532f7d6868e89e36d5677

    • C:\Program Files\Orcus\Orcus.exe

      Filesize

      115KB

      MD5

      69953e7ea09818a5fcabf3b4e1aafc81

      SHA1

      455e94f3c1c314321fcb986156668a6de9ca2933

      SHA256

      e7a7adfdc478c4b3bcf1beafa37c07c3a5e69ef1941eff99e1229f27c9acc1a8

      SHA512

      033b654f6e7a84a33a107e3de6525b649c89ef2df3220d5d2fd262ed8d3efb32a06b345e7eec07d155cb106e1291c62d3e8e067fc8bf61e9dcbdd9d10345a08f

    • C:\Program Files\Orcus\Orcus.exe

      Filesize

      68KB

      MD5

      52989421657b5c806ce886d0adf03196

      SHA1

      013adb6c45a699bc96c5f18cf3bd0b90e038b4cc

      SHA256

      ef4b097703a3e7323eb292ca4c63580d5ce56e1b1d87e8d4c79756b04be59cc6

      SHA512

      d47a1cb2e5754bd16fdaba4d028c5d73068fe9336c4506d3f0e25abd2a08d0bc9758df6972e7405b57173594b9f73f755f127ba873948922b4f3fbb3201ba34d

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\OrcusWatchdog.exe.log

      Filesize

      425B

      MD5

      bb27934be8860266d478c13f2d65f45e

      SHA1

      a69a0e171864dcac9ade1b04fc0313e6b4024ccb

      SHA256

      85ad0d9909461517acf2e24ff116ca350e9b7000b4eefb23aa3647423c9745b4

      SHA512

      87dd77feac509a25b30c76c119752cc25020cca9c53276c2082aef2a8c75670ef67e1e70024a63d44ae442b64f4bc464aee6691e80c525376bb7421929cfa3bb

    • C:\Users\Admin\AppData\Local\Temp\RES4AC5.tmp

      Filesize

      1KB

      MD5

      cfe35af97a21f410a519176bed3bb190

      SHA1

      1a3ea97b778215e185021317812ab3acba5594df

      SHA256

      f432933a1c4e9a2e4421a2f3702f6ad6683b5ac35c8c092d22524f3818691d49

      SHA512

      c57591eadc9bb79eba497e481b07392d5951b9abf090b1069fb264a33e3dc72e9881c9619554dd5526e7f9c7ec04780bd12a17208385135419711250acc19a49

    • C:\Users\Admin\AppData\Local\Temp\jngxey_p.dll

      Filesize

      76KB

      MD5

      6926d7e6a114bb6c05afd994d0c1b4dc

      SHA1

      38ca2cde176be7dde985791ca188efbd6bdcf2d8

      SHA256

      b05638192154d816ddd3f67f19fbe5e53dddce905c4be117c6740cb4e5bec2ed

      SHA512

      2bc347af6d485983dad97bf79f6c255d7a9d99d9ac7d895ec75565bd8035c0cf5da89fc62fdd0be9f63aa3feaaab76877e74e14bbef7397f3276b8c77676118b

    • C:\Users\Admin\AppData\Roaming\OrcusWatchdog.exe

      Filesize

      9KB

      MD5

      913967b216326e36a08010fb70f9dba3

      SHA1

      7b6f8c2eb5b443e03c212b85c2f0edb9c76ad2bf

      SHA256

      8d880758549220154d2ff4ee578f2b49527c5fb76a07d55237b61e30bcc09e3a

      SHA512

      c6fcb98d9fd509e9834fc3fba143bd36d41869cc104fbce5354951f0a6756156e34a30796baaa130dd45de3ed96e039ec14716716f6da4569915c7ef2d2b6c33

    • C:\Windows\SysWOW64\WindowsInput.exe

      Filesize

      21KB

      MD5

      e6fcf516d8ed8d0d4427f86e08d0d435

      SHA1

      c7691731583ab7890086635cb7f3e4c22ca5e409

      SHA256

      8dbe814359391ed6b0b5b182039008cf1d00964da9fbc4747f46242a95c24337

      SHA512

      c496cf8e2e222fe1e19051b291e6860f31aae39f54369c1c5e8c9758c4b56e8af904e3e536e743a0a6fdbbf8478afba4baee92e13fc1b3073376ac6bf4a7948e

    • C:\Windows\SysWOW64\WindowsInput.exe.config

      Filesize

      357B

      MD5

      a2b76cea3a59fa9af5ea21ff68139c98

      SHA1

      35d76475e6a54c168f536e30206578babff58274

      SHA256

      f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839

      SHA512

      b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad

    • \??\c:\Users\Admin\AppData\Local\Temp\CSC4AC4.tmp

      Filesize

      676B

      MD5

      0e0e79f12b421a2b9d81d8a102842ffe

      SHA1

      4df5876f5bd477f7b0dad596fb8d4343836e34cb

      SHA256

      0c284696f54faa6d54ccb816eb7369bb0e7ef0e9bab7efb3e4392e1978ec2bba

      SHA512

      1d41ff9c327bc34116be4c7dde139b8f2711ba8e028c3f6cea065c9070f59cabd7f22adac1a04a22531760be58d0f81f7ed24a2f4d8b1ac19a72a20bef25d9c8

    • \??\c:\Users\Admin\AppData\Local\Temp\jngxey_p.0.cs

      Filesize

      208KB

      MD5

      c705d204b823c3ba754037202df38901

      SHA1

      4bca76258d5b56eb864309e2818b024eeb021f26

      SHA256

      b724548785a5308db7719519326ab7b4c94dfe320090cf7958a1c3586978bc1b

      SHA512

      235b38e9e60aafd619254d8fdc94cfe5cb80c1a89929196283ef880a994840e639a10036bd87246406b5644fb9a38048663bec13a2f4f05b0f53ed9a74455e65

    • \??\c:\Users\Admin\AppData\Local\Temp\jngxey_p.cmdline

      Filesize

      349B

      MD5

      9ccd114686243dfce30cee4a26c9a7b5

      SHA1

      0a96f4b5382979aa709558680e5ca94a49ab5139

      SHA256

      e685b9a2f01c8f9b5bdf7ef72ba28750e90b2d7840d6f5a2abc3789ef0cf6b17

      SHA512

      98a17677b1f882df5f1c66b0f6636b0b651768ec5a47906f127d40290c7123b945051252ebc779a1afa926a01921162c8c25ded1738ed6f8b9fb699cf8ef88b5

    • memory/448-76-0x00007FFF571B0000-0x00007FFF57C72000-memory.dmp

      Filesize

      10.8MB

    • memory/448-103-0x00007FFF571B0000-0x00007FFF57C72000-memory.dmp

      Filesize

      10.8MB

    • memory/448-89-0x000000001BA90000-0x000000001BAA0000-memory.dmp

      Filesize

      64KB

    • memory/1164-3-0x000000001BFA0000-0x000000001BFFC000-memory.dmp

      Filesize

      368KB

    • memory/1164-8-0x000000001CBA0000-0x000000001CC3C000-memory.dmp

      Filesize

      624KB

    • memory/1164-2-0x00007FFF59D60000-0x00007FFF5A701000-memory.dmp

      Filesize

      9.6MB

    • memory/1164-1-0x00000000016D0000-0x00000000016E0000-memory.dmp

      Filesize

      64KB

    • memory/1164-24-0x000000001BEB0000-0x000000001BEC2000-memory.dmp

      Filesize

      72KB

    • memory/1164-6-0x000000001C150000-0x000000001C15E000-memory.dmp

      Filesize

      56KB

    • memory/1164-0-0x00007FFF59D60000-0x00007FFF5A701000-memory.dmp

      Filesize

      9.6MB

    • memory/1164-7-0x000000001C630000-0x000000001CAFE000-memory.dmp

      Filesize

      4.8MB

    • memory/1164-25-0x000000001D2A0000-0x000000001D2C0000-memory.dmp

      Filesize

      128KB

    • memory/1164-68-0x00007FFF59D60000-0x00007FFF5A701000-memory.dmp

      Filesize

      9.6MB

    • memory/1164-22-0x000000001CC70000-0x000000001CC86000-memory.dmp

      Filesize

      88KB

    • memory/1572-40-0x00007FFF571B0000-0x00007FFF57C72000-memory.dmp

      Filesize

      10.8MB

    • memory/1572-47-0x00007FFF571B0000-0x00007FFF57C72000-memory.dmp

      Filesize

      10.8MB

    • memory/1572-39-0x0000000000C30000-0x0000000000C3C000-memory.dmp

      Filesize

      48KB

    • memory/1572-42-0x000000001B9A0000-0x000000001B9B0000-memory.dmp

      Filesize

      64KB

    • memory/1572-41-0x0000000002D30000-0x0000000002D42000-memory.dmp

      Filesize

      72KB

    • memory/1572-43-0x0000000002DB0000-0x0000000002DEC000-memory.dmp

      Filesize

      240KB

    • memory/1820-108-0x0000000074740000-0x0000000074EF1000-memory.dmp

      Filesize

      7.7MB

    • memory/1820-98-0x0000000074740000-0x0000000074EF1000-memory.dmp

      Filesize

      7.7MB

    • memory/1832-74-0x000000001BF00000-0x000000001BF18000-memory.dmp

      Filesize

      96KB

    • memory/1832-72-0x000000001BEA0000-0x000000001BEEE000-memory.dmp

      Filesize

      312KB

    • memory/1832-69-0x0000000000F90000-0x000000000107A000-memory.dmp

      Filesize

      936KB

    • memory/1832-107-0x000000001BF60000-0x000000001BF70000-memory.dmp

      Filesize

      64KB

    • memory/1832-67-0x00007FFF571B0000-0x00007FFF57C72000-memory.dmp

      Filesize

      10.8MB

    • memory/1832-75-0x000000001BF40000-0x000000001BF50000-memory.dmp

      Filesize

      64KB

    • memory/1832-71-0x00000000030F0000-0x0000000003102000-memory.dmp

      Filesize

      72KB

    • memory/1832-106-0x00007FFF571B0000-0x00007FFF57C72000-memory.dmp

      Filesize

      10.8MB

    • memory/1832-101-0x000000001D560000-0x000000001D722000-memory.dmp

      Filesize

      1.8MB

    • memory/1832-79-0x000000001BF60000-0x000000001BF70000-memory.dmp

      Filesize

      64KB

    • memory/1832-70-0x000000001BF60000-0x000000001BF70000-memory.dmp

      Filesize

      64KB

    • memory/2396-51-0x000000001A2B0000-0x000000001A3BA000-memory.dmp

      Filesize

      1.0MB

    • memory/2396-104-0x00007FFF571B0000-0x00007FFF57C72000-memory.dmp

      Filesize

      10.8MB

    • memory/2396-105-0x0000000019D90000-0x0000000019DA0000-memory.dmp

      Filesize

      64KB

    • memory/2396-49-0x00007FFF571B0000-0x00007FFF57C72000-memory.dmp

      Filesize

      10.8MB

    • memory/2396-50-0x0000000019D90000-0x0000000019DA0000-memory.dmp

      Filesize

      64KB

    • memory/2780-14-0x0000000002530000-0x0000000002540000-memory.dmp

      Filesize

      64KB

    • memory/4408-97-0x0000000074740000-0x0000000074EF1000-memory.dmp

      Filesize

      7.7MB

    • memory/4408-92-0x00000000008A0000-0x00000000008A8000-memory.dmp

      Filesize

      32KB

    • memory/4408-93-0x0000000074740000-0x0000000074EF1000-memory.dmp

      Filesize

      7.7MB