Analysis

  • max time kernel
    150s
  • max time network
    131s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    04-02-2024 20:19

General

  • Target

    file.exe

  • Size

    916KB

  • MD5

    bdbe50403b411db0e07511e098bdb9ff

  • SHA1

    5772743e950c1c647a5cab202fc3cc29039e2749

  • SHA256

    a758763a7fb30398cbdab370be24c389a1927fb376772fcb31f4017ca942a284

  • SHA512

    9531b3c7572f07aaac342635369732b77c1df58c262e32b21327cd2ac47afe6e3042d79a6a72e30c07b03e420cd9b47b1781bc5ed875b8d7b973b480090261f9

  • SSDEEP

    24576:+cI4MROxnFD3jEsYxrZlI0AilFEvxHiH0h9:+crMiJWrZlI0AilFEvxHi

Malware Config

Extracted

Family

orcus

C2

obfuscated.us:8080

Mutex

0133d229c4e24006957c0e4ab3a52531

Attributes
  • autostart_method

    Registry

  • enable_keylogger

    false

  • install_path

    %programfiles%\Orcus\Orcus.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\OrcusWatchdog.exe

Signatures

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

  • Orcus main payload 1 IoCs
  • Orcurs Rat Executable 2 IoCs
  • Executes dropped EXE 6 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 3 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:2364
    • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\z0vlj3gd.cmdline"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2456
      • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5948.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC5947.tmp"
        3⤵
          PID:2768
      • C:\Windows\SysWOW64\WindowsInput.exe
        "C:\Windows\SysWOW64\WindowsInput.exe" --install
        2⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        PID:2816
      • C:\Program Files\Orcus\Orcus.exe
        "C:\Program Files\Orcus\Orcus.exe"
        2⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:296
        • C:\Users\Admin\AppData\Roaming\OrcusWatchdog.exe
          "C:\Users\Admin\AppData\Roaming\OrcusWatchdog.exe" /launchSelfAndExit "C:\Program Files\Orcus\Orcus.exe" 296
          3⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2132
          • C:\Users\Admin\AppData\Roaming\OrcusWatchdog.exe
            "C:\Users\Admin\AppData\Roaming\OrcusWatchdog.exe" /watchProcess "C:\Program Files\Orcus\Orcus.exe" 296
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1748
    • C:\Windows\SysWOW64\WindowsInput.exe
      "C:\Windows\SysWOW64\WindowsInput.exe"
      1⤵
      • Executes dropped EXE
      PID:2564
    • C:\Windows\system32\taskeng.exe
      taskeng.exe {7B767EDB-B6F5-4086-98CC-50195EA5C5B1} S-1-5-21-1603059206-2004189698-4139800220-1000:AILVMYUM\Admin:Interactive:[1]
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:872
      • C:\Program Files\Orcus\Orcus.exe
        "C:\Program Files\Orcus\Orcus.exe"
        2⤵
        • Executes dropped EXE
        PID:924

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files\Orcus\Orcus.exe

      Filesize

      916KB

      MD5

      bdbe50403b411db0e07511e098bdb9ff

      SHA1

      5772743e950c1c647a5cab202fc3cc29039e2749

      SHA256

      a758763a7fb30398cbdab370be24c389a1927fb376772fcb31f4017ca942a284

      SHA512

      9531b3c7572f07aaac342635369732b77c1df58c262e32b21327cd2ac47afe6e3042d79a6a72e30c07b03e420cd9b47b1781bc5ed875b8d7b973b480090261f9

    • C:\Users\Admin\AppData\Local\Temp\Cab784D.tmp

      Filesize

      65KB

      MD5

      ac05d27423a85adc1622c714f2cb6184

      SHA1

      b0fe2b1abddb97837ea0195be70ab2ff14d43198

      SHA256

      c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

      SHA512

      6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

    • C:\Users\Admin\AppData\Local\Temp\RES5948.tmp

      Filesize

      1KB

      MD5

      4ca48ec15cad2b1351e7502294680031

      SHA1

      176cccb9d91c98805071414e225970f91d45933d

      SHA256

      e708810275fcc76197d8fd4acaf10f9b3036cc9e715f4996b96715ad47604ffc

      SHA512

      da1df85fbed50068845169626342c9d88248b032bc7b63ecd160e4651fb2bcf26a6a3b5a28351b5bf9557dddff9005a2ad879e7f6d74f4ee0575c4ff4f4dd7d7

    • C:\Users\Admin\AppData\Local\Temp\TarB456.tmp

      Filesize

      171KB

      MD5

      9c0c641c06238516f27941aa1166d427

      SHA1

      64cd549fb8cf014fcd9312aa7a5b023847b6c977

      SHA256

      4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

      SHA512

      936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

    • C:\Users\Admin\AppData\Local\Temp\z0vlj3gd.dll

      Filesize

      76KB

      MD5

      22a27e4db7d0afb5c68fbf1cd4275994

      SHA1

      d235384876c2d800a608e4491e7c9edc87bf8bbd

      SHA256

      a64e035fb6839c36065fd9d080cae92f0f85b1df812e9db5cb2956ae7fbf97d5

      SHA512

      fd8586e49f995ad4fdf8f891ce7f19a7aea257daea9f98c1f0855f50dc5d20f9d67159ada0c953716907cba70587027272abb30b551504d248345157569640c7

    • C:\Users\Admin\AppData\Roaming\OrcusWatchdog.exe

      Filesize

      9KB

      MD5

      913967b216326e36a08010fb70f9dba3

      SHA1

      7b6f8c2eb5b443e03c212b85c2f0edb9c76ad2bf

      SHA256

      8d880758549220154d2ff4ee578f2b49527c5fb76a07d55237b61e30bcc09e3a

      SHA512

      c6fcb98d9fd509e9834fc3fba143bd36d41869cc104fbce5354951f0a6756156e34a30796baaa130dd45de3ed96e039ec14716716f6da4569915c7ef2d2b6c33

    • C:\Windows\SysWOW64\WindowsInput.exe

      Filesize

      21KB

      MD5

      e6fcf516d8ed8d0d4427f86e08d0d435

      SHA1

      c7691731583ab7890086635cb7f3e4c22ca5e409

      SHA256

      8dbe814359391ed6b0b5b182039008cf1d00964da9fbc4747f46242a95c24337

      SHA512

      c496cf8e2e222fe1e19051b291e6860f31aae39f54369c1c5e8c9758c4b56e8af904e3e536e743a0a6fdbbf8478afba4baee92e13fc1b3073376ac6bf4a7948e

    • C:\Windows\SysWOW64\WindowsInput.exe.config

      Filesize

      357B

      MD5

      a2b76cea3a59fa9af5ea21ff68139c98

      SHA1

      35d76475e6a54c168f536e30206578babff58274

      SHA256

      f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839

      SHA512

      b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad

    • \??\c:\Users\Admin\AppData\Local\Temp\CSC5947.tmp

      Filesize

      676B

      MD5

      a1afd0923b6f8a51e0a7b997a8618afb

      SHA1

      6c0fb68ba0d080795dceaf303a357b09c2c790db

      SHA256

      87d7b9d56164923d860e2ead6ebff88404f460b0304d9c78cf4ae7fac1202b96

      SHA512

      f071b9f8a43079e387a3755acb7c5be330f46f5a13d3439dee49a49388cfd8105af4d2e238518b2eb0304f8cd3afe7db8428940a2f453be4007ce32ca1396637

    • \??\c:\Users\Admin\AppData\Local\Temp\z0vlj3gd.0.cs

      Filesize

      208KB

      MD5

      250321226bbc2a616d91e1c82cb4ab2b

      SHA1

      7cffd0b2e9c842865d8961386ab8fcfac8d04173

      SHA256

      ef2707f83a0c0927cfd46b115641b9cae52a41123e4826515b9eeb561785218d

      SHA512

      bda59ca04cdf254f837f2cec6da55eff5c3d2af00da66537b9ebaa3601c502ae63772f082fd12663b63d537d2e03efe87a3b5746ef25e842aaf1c7d88245b4e1

    • \??\c:\Users\Admin\AppData\Local\Temp\z0vlj3gd.cmdline

      Filesize

      349B

      MD5

      9a4e103ed2d9c1c2f67e05c52f1b78df

      SHA1

      75ca8b012011866c75a8eb05c277f5fb1588231a

      SHA256

      7cc21d92fa70047851329ba616cb694573d3b8791be38016bc60ec59b4e380f2

      SHA512

      b93b39cc1eae6f0af55fddee1221ff0d4769a34913b4d0db331836bcbb6f787f1ae567a6aae2279208e756f2477e688996136803a9e1c75ad4b934076068f1ea

    • memory/296-45-0x0000000000240000-0x000000000032A000-memory.dmp

      Filesize

      936KB

    • memory/296-49-0x0000000000850000-0x000000000089E000-memory.dmp

      Filesize

      312KB

    • memory/296-48-0x000000001B030000-0x000000001B0B0000-memory.dmp

      Filesize

      512KB

    • memory/296-107-0x000000001B030000-0x000000001B0B0000-memory.dmp

      Filesize

      512KB

    • memory/296-88-0x000000001B030000-0x000000001B0B0000-memory.dmp

      Filesize

      512KB

    • memory/296-87-0x000007FEEE120000-0x000007FEEEB0C000-memory.dmp

      Filesize

      9.9MB

    • memory/296-47-0x000007FEEE120000-0x000007FEEEB0C000-memory.dmp

      Filesize

      9.9MB

    • memory/296-50-0x0000000002210000-0x0000000002228000-memory.dmp

      Filesize

      96KB

    • memory/296-52-0x0000000002120000-0x0000000002130000-memory.dmp

      Filesize

      64KB

    • memory/296-61-0x000000001B030000-0x000000001B0B0000-memory.dmp

      Filesize

      512KB

    • memory/924-56-0x000007FEEE120000-0x000007FEEEB0C000-memory.dmp

      Filesize

      9.9MB

    • memory/924-62-0x000000001AEA0000-0x000000001AF20000-memory.dmp

      Filesize

      512KB

    • memory/924-85-0x000007FEEE120000-0x000007FEEEB0C000-memory.dmp

      Filesize

      9.9MB

    • memory/1748-84-0x00000000742C0000-0x00000000749AE000-memory.dmp

      Filesize

      6.9MB

    • memory/1748-108-0x00000000742C0000-0x00000000749AE000-memory.dmp

      Filesize

      6.9MB

    • memory/2132-83-0x00000000742C0000-0x00000000749AE000-memory.dmp

      Filesize

      6.9MB

    • memory/2132-64-0x0000000000BF0000-0x0000000000BF8000-memory.dmp

      Filesize

      32KB

    • memory/2132-65-0x00000000742C0000-0x00000000749AE000-memory.dmp

      Filesize

      6.9MB

    • memory/2364-1-0x0000000000490000-0x000000000049E000-memory.dmp

      Filesize

      56KB

    • memory/2364-0-0x000000001AE60000-0x000000001AEBC000-memory.dmp

      Filesize

      368KB

    • memory/2364-4-0x000007FEF54B0000-0x000007FEF5E4D000-memory.dmp

      Filesize

      9.6MB

    • memory/2364-3-0x00000000000F0000-0x0000000000170000-memory.dmp

      Filesize

      512KB

    • memory/2364-46-0x000007FEF54B0000-0x000007FEF5E4D000-memory.dmp

      Filesize

      9.6MB

    • memory/2364-18-0x0000000000DA0000-0x0000000000DB6000-memory.dmp

      Filesize

      88KB

    • memory/2364-2-0x000007FEF54B0000-0x000007FEF5E4D000-memory.dmp

      Filesize

      9.6MB

    • memory/2364-20-0x00000000004B0000-0x00000000004C2000-memory.dmp

      Filesize

      72KB

    • memory/2456-10-0x0000000002240000-0x00000000022C0000-memory.dmp

      Filesize

      512KB

    • memory/2564-36-0x000007FEEE120000-0x000007FEEEB0C000-memory.dmp

      Filesize

      9.9MB

    • memory/2564-86-0x000007FEEE120000-0x000007FEEEB0C000-memory.dmp

      Filesize

      9.9MB

    • memory/2564-35-0x00000000003D0000-0x00000000003DC000-memory.dmp

      Filesize

      48KB

    • memory/2816-29-0x000007FEEEB10000-0x000007FEEF4FC000-memory.dmp

      Filesize

      9.9MB

    • memory/2816-28-0x0000000001060000-0x000000000106C000-memory.dmp

      Filesize

      48KB

    • memory/2816-30-0x000000001B550000-0x000000001B5D0000-memory.dmp

      Filesize

      512KB

    • memory/2816-33-0x000007FEEEB10000-0x000007FEEF4FC000-memory.dmp

      Filesize

      9.9MB