Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04-02-2024 20:19

General

  • Target

    file.exe

  • Size

    916KB

  • MD5

    bdbe50403b411db0e07511e098bdb9ff

  • SHA1

    5772743e950c1c647a5cab202fc3cc29039e2749

  • SHA256

    a758763a7fb30398cbdab370be24c389a1927fb376772fcb31f4017ca942a284

  • SHA512

    9531b3c7572f07aaac342635369732b77c1df58c262e32b21327cd2ac47afe6e3042d79a6a72e30c07b03e420cd9b47b1781bc5ed875b8d7b973b480090261f9

  • SSDEEP

    24576:+cI4MROxnFD3jEsYxrZlI0AilFEvxHiH0h9:+crMiJWrZlI0AilFEvxHi

Malware Config

Extracted

Family

orcus

C2

obfuscated.us:8080

Mutex

0133d229c4e24006957c0e4ab3a52531

Attributes
  • autostart_method

    Registry

  • enable_keylogger

    false

  • install_path

    %programfiles%\Orcus\Orcus.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\OrcusWatchdog.exe

Signatures

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

  • Orcus main payload 3 IoCs
  • Orcurs Rat Executable 4 IoCs
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops desktop.ini file(s) 2 IoCs
  • Drops file in System32 directory 3 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Checks computer location settings
    • Drops desktop.ini file(s)
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:3744
    • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\umfnrdg7.cmdline"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4772
      • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7D3F.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC7D3E.tmp"
        3⤵
          PID:664
      • C:\Windows\SysWOW64\WindowsInput.exe
        "C:\Windows\SysWOW64\WindowsInput.exe" --install
        2⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        PID:5116
      • C:\Program Files\Orcus\Orcus.exe
        "C:\Program Files\Orcus\Orcus.exe"
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:2372
        • C:\Users\Admin\AppData\Roaming\OrcusWatchdog.exe
          "C:\Users\Admin\AppData\Roaming\OrcusWatchdog.exe" /launchSelfAndExit "C:\Program Files\Orcus\Orcus.exe" 2372
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:540
          • C:\Users\Admin\AppData\Roaming\OrcusWatchdog.exe
            "C:\Users\Admin\AppData\Roaming\OrcusWatchdog.exe" /watchProcess "C:\Program Files\Orcus\Orcus.exe" 2372
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4648
    • C:\Windows\SysWOW64\WindowsInput.exe
      "C:\Windows\SysWOW64\WindowsInput.exe"
      1⤵
      • Executes dropped EXE
      PID:1616
    • C:\Program Files\Orcus\Orcus.exe
      "C:\Program Files\Orcus\Orcus.exe"
      1⤵
      • Executes dropped EXE
      PID:2004

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files\Orcus\Orcus.exe

      Filesize

      916KB

      MD5

      bdbe50403b411db0e07511e098bdb9ff

      SHA1

      5772743e950c1c647a5cab202fc3cc29039e2749

      SHA256

      a758763a7fb30398cbdab370be24c389a1927fb376772fcb31f4017ca942a284

      SHA512

      9531b3c7572f07aaac342635369732b77c1df58c262e32b21327cd2ac47afe6e3042d79a6a72e30c07b03e420cd9b47b1781bc5ed875b8d7b973b480090261f9

    • C:\Program Files\Orcus\Orcus.exe

      Filesize

      775KB

      MD5

      e440c9eb6f599e32731c1041e46e1b2d

      SHA1

      af9504357fa725b74c60e4010a2cc2dc27a2c6b2

      SHA256

      21dee025982cb03535920e3ec5e58de19598f21483a900683bc2da120cec341e

      SHA512

      f94a39a5e2cc8aa1f0f5654239731c68c8fef399d2898a5559e656d7910ada039fa93ae60a2bfa29070e8fda346f58a5445e9ce3da928a7d9d433bf88f918729

    • C:\Program Files\Orcus\Orcus.exe

      Filesize

      251KB

      MD5

      f5784842fb6db8efbf402070ed502136

      SHA1

      0c6a5b127181e80ea09690d73743325121bb461b

      SHA256

      3ef3b29ba7846d3738a91a4807f67dbb2d8f0b6904629cc3c2bee9a1013c47f7

      SHA512

      68dc1a1a443893bf4a5783329f8eb104a4049f77145c36f4f611850aaf802c35faefbd428e2d50b8688f42b78a216aa222ef44183db775dd16de5b68fd209c65

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\OrcusWatchdog.exe.log

      Filesize

      425B

      MD5

      4eaca4566b22b01cd3bc115b9b0b2196

      SHA1

      e743e0792c19f71740416e7b3c061d9f1336bf94

      SHA256

      34ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb

      SHA512

      bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1

    • C:\Users\Admin\AppData\Local\Temp\RES7D3F.tmp

      Filesize

      1KB

      MD5

      0c3d928d9f958517b73e9247fbf495c0

      SHA1

      eedde51313770d12c75793a2d83833a51e6151ee

      SHA256

      cfcdde7b03f9d60b54e0e835cf7434faef46152503203041f03dd7d7f2e15f87

      SHA512

      db2af6d9527429cc08f61b8de7a9db1749b18619d5a819bd1208cd459c4de29ca5844bf7e73e51fab9be350d4555e968caded48fd240d44b677377300bdb66f8

    • C:\Users\Admin\AppData\Local\Temp\umfnrdg7.dll

      Filesize

      76KB

      MD5

      f8fc48f7c5b8cac638349d10f84ee57e

      SHA1

      11a620aa28e9aad544c2ccca7b4f5bad8f2b2ce1

      SHA256

      74d8441c80405cbb16e22e6c335f3c9eabfef35d06256b8c097dab11e12b6d1f

      SHA512

      3b6890b47ad9ddc7916f7d0a5bed234089a04ca1569a1533bd057c742591b232d4b49f02b5c1ad5a0e76d3ab7743a083be9dae15ea09a1ec6cf98e61fb0dd383

    • C:\Users\Admin\AppData\Roaming\OrcusWatchdog.exe

      Filesize

      9KB

      MD5

      913967b216326e36a08010fb70f9dba3

      SHA1

      7b6f8c2eb5b443e03c212b85c2f0edb9c76ad2bf

      SHA256

      8d880758549220154d2ff4ee578f2b49527c5fb76a07d55237b61e30bcc09e3a

      SHA512

      c6fcb98d9fd509e9834fc3fba143bd36d41869cc104fbce5354951f0a6756156e34a30796baaa130dd45de3ed96e039ec14716716f6da4569915c7ef2d2b6c33

    • C:\Windows\SysWOW64\WindowsInput.exe

      Filesize

      21KB

      MD5

      e6fcf516d8ed8d0d4427f86e08d0d435

      SHA1

      c7691731583ab7890086635cb7f3e4c22ca5e409

      SHA256

      8dbe814359391ed6b0b5b182039008cf1d00964da9fbc4747f46242a95c24337

      SHA512

      c496cf8e2e222fe1e19051b291e6860f31aae39f54369c1c5e8c9758c4b56e8af904e3e536e743a0a6fdbbf8478afba4baee92e13fc1b3073376ac6bf4a7948e

    • C:\Windows\SysWOW64\WindowsInput.exe.config

      Filesize

      357B

      MD5

      a2b76cea3a59fa9af5ea21ff68139c98

      SHA1

      35d76475e6a54c168f536e30206578babff58274

      SHA256

      f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839

      SHA512

      b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad

    • \??\c:\Users\Admin\AppData\Local\Temp\CSC7D3E.tmp

      Filesize

      676B

      MD5

      d876ab0572a3270ff3c5d369ee9942ab

      SHA1

      441d712ceb41197e83517c0e7b0e65beee1e3266

      SHA256

      53218e85775d8d7de4a267f7ae467020cdb9324e567bde1c58f467ad9787bccd

      SHA512

      0d689c0b10098c90aef286e1ef3de7640568ad7c4ac64a888a2de49392ec8de3fa3998c5ebd7149cfaf02e8991385734e233debad2113cbe46e7901fb4a1d603

    • \??\c:\Users\Admin\AppData\Local\Temp\umfnrdg7.0.cs

      Filesize

      208KB

      MD5

      032e0be34c354148b745fdfdc93ce7b6

      SHA1

      4f200e07a14baf38a67a946cc018a69bc423f2e9

      SHA256

      8032dccdba7fe3fd366554bf4da1be8dcbf3f002f7f54d67df59018d129b36f5

      SHA512

      f188827bd4ed2855e1fac63f535a45858b76386d5cd233e7725e6f9df8e0ef9fdeea35dd7e7241f42e4549fdd239cd939bed82ad001377cd8d97be0b3f48dc00

    • \??\c:\Users\Admin\AppData\Local\Temp\umfnrdg7.cmdline

      Filesize

      349B

      MD5

      4476e12ba73393f4c5740ea6200989fb

      SHA1

      f56a9ce1f02e7606a37b3156f4f1f76ca02869fa

      SHA256

      193d55db8f819c6eff33fd8e5f8d286e99aea4f471a0881e1042569f384595a7

      SHA512

      7a4135f745751cd3ef6e6ad762676d890859af132819cb07b321b32c11bbff75617798e266b0ef08598b8e2bd24d31ed61a14bbbb9f330951f2510f21e96e649

    • memory/540-93-0x0000000000860000-0x0000000000868000-memory.dmp

      Filesize

      32KB

    • memory/540-92-0x0000000074FA0000-0x0000000075750000-memory.dmp

      Filesize

      7.7MB

    • memory/540-99-0x0000000074FA0000-0x0000000075750000-memory.dmp

      Filesize

      7.7MB

    • memory/1616-49-0x00007FFC509F0000-0x00007FFC514B1000-memory.dmp

      Filesize

      10.8MB

    • memory/1616-101-0x00007FFC509F0000-0x00007FFC514B1000-memory.dmp

      Filesize

      10.8MB

    • memory/1616-105-0x0000000019C90000-0x0000000019CA0000-memory.dmp

      Filesize

      64KB

    • memory/1616-51-0x000000001A1B0000-0x000000001A2BA000-memory.dmp

      Filesize

      1.0MB

    • memory/1616-50-0x0000000019C90000-0x0000000019CA0000-memory.dmp

      Filesize

      64KB

    • memory/2004-77-0x000000001BE20000-0x000000001BE30000-memory.dmp

      Filesize

      64KB

    • memory/2004-75-0x00007FFC509F0000-0x00007FFC514B1000-memory.dmp

      Filesize

      10.8MB

    • memory/2004-104-0x00007FFC509F0000-0x00007FFC514B1000-memory.dmp

      Filesize

      10.8MB

    • memory/2372-76-0x000000001B0F0000-0x000000001B100000-memory.dmp

      Filesize

      64KB

    • memory/2372-74-0x000000001B0B0000-0x000000001B0C8000-memory.dmp

      Filesize

      96KB

    • memory/2372-108-0x000000001B0A0000-0x000000001B0B0000-memory.dmp

      Filesize

      64KB

    • memory/2372-107-0x000000001B0A0000-0x000000001B0B0000-memory.dmp

      Filesize

      64KB

    • memory/2372-106-0x00007FFC509F0000-0x00007FFC514B1000-memory.dmp

      Filesize

      10.8MB

    • memory/2372-103-0x000000001D490000-0x000000001D652000-memory.dmp

      Filesize

      1.8MB

    • memory/2372-80-0x000000001B0A0000-0x000000001B0B0000-memory.dmp

      Filesize

      64KB

    • memory/2372-68-0x00007FFC509F0000-0x00007FFC514B1000-memory.dmp

      Filesize

      10.8MB

    • memory/2372-69-0x00000000003C0000-0x00000000004AA000-memory.dmp

      Filesize

      936KB

    • memory/2372-70-0x000000001B0A0000-0x000000001B0B0000-memory.dmp

      Filesize

      64KB

    • memory/2372-72-0x000000001B010000-0x000000001B05E000-memory.dmp

      Filesize

      312KB

    • memory/2372-71-0x000000001B000000-0x000000001B012000-memory.dmp

      Filesize

      72KB

    • memory/3744-0-0x00007FFC53670000-0x00007FFC54011000-memory.dmp

      Filesize

      9.6MB

    • memory/3744-7-0x000000001C460000-0x000000001C92E000-memory.dmp

      Filesize

      4.8MB

    • memory/3744-25-0x000000001BF60000-0x000000001BF80000-memory.dmp

      Filesize

      128KB

    • memory/3744-1-0x00007FFC53670000-0x00007FFC54011000-memory.dmp

      Filesize

      9.6MB

    • memory/3744-24-0x0000000001660000-0x0000000001672000-memory.dmp

      Filesize

      72KB

    • memory/3744-67-0x00007FFC53670000-0x00007FFC54011000-memory.dmp

      Filesize

      9.6MB

    • memory/3744-22-0x000000001BF20000-0x000000001BF36000-memory.dmp

      Filesize

      88KB

    • memory/3744-2-0x00000000015B0000-0x00000000015C0000-memory.dmp

      Filesize

      64KB

    • memory/3744-8-0x000000001C9D0000-0x000000001CA6C000-memory.dmp

      Filesize

      624KB

    • memory/3744-3-0x000000001BD10000-0x000000001BD6C000-memory.dmp

      Filesize

      368KB

    • memory/3744-6-0x000000001BDD0000-0x000000001BDDE000-memory.dmp

      Filesize

      56KB

    • memory/4648-100-0x0000000074FA0000-0x0000000075750000-memory.dmp

      Filesize

      7.7MB

    • memory/4648-109-0x0000000074FA0000-0x0000000075750000-memory.dmp

      Filesize

      7.7MB

    • memory/4772-14-0x0000000002400000-0x0000000002410000-memory.dmp

      Filesize

      64KB

    • memory/5116-39-0x0000000000410000-0x000000000041C000-memory.dmp

      Filesize

      48KB

    • memory/5116-40-0x00007FFC509F0000-0x00007FFC514B1000-memory.dmp

      Filesize

      10.8MB

    • memory/5116-47-0x00007FFC509F0000-0x00007FFC514B1000-memory.dmp

      Filesize

      10.8MB

    • memory/5116-41-0x000000001B140000-0x000000001B150000-memory.dmp

      Filesize

      64KB

    • memory/5116-43-0x0000000002630000-0x000000000266C000-memory.dmp

      Filesize

      240KB

    • memory/5116-42-0x0000000000B00000-0x0000000000B12000-memory.dmp

      Filesize

      72KB