Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    05-02-2024 01:13

General

  • Target

    02cb3ad1448449e784cb51f4238da4fe10abe0f9e11642c32399cb2d2972cc4c.exe

  • Size

    1.0MB

  • MD5

    b09d835b1c8bf6c5c24c5c958d8dea82

  • SHA1

    bf4511de1e9e27f76ecd3cefe1a3392b00329ac2

  • SHA256

    02cb3ad1448449e784cb51f4238da4fe10abe0f9e11642c32399cb2d2972cc4c

  • SHA512

    086605f75ff971eda077ee494b8a3dc8edda4cffa6071156638cb3d189a8cc91d1449b8dc8848df6d3a190443eb53af19ca74d55e31c8a20b4cc1feef1d9bcba

  • SSDEEP

    24576:k4I4MROxnFSx3UUDqrrcI0AilFEvxHPfMCYooE4:kaMiYJUUGrrcI0AilFEvxHPfJN

Malware Config

Extracted

Family

orcus

C2

4.tcp.eu.ngrok.io:14390

Mutex

381f52cc4da947c788fee861bc207f0e

Attributes
  • autostart_method

    TaskScheduler

  • enable_keylogger

    true

  • install_path

    %programfiles%\Steam Helper\Steam.exe

  • reconnect_delay

    10000

  • registry_keyname

    UpdateSystem32

  • taskscheduler_taskname

    Системные прирывания

  • watchdog_path

    Temp\Update Defender.exe

Signatures

  • Contains code to disable Windows Defender 1 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 7 IoCs
  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

  • Orcus main payload 5 IoCs
  • UAC bypass 3 TTPs 6 IoCs
  • Orcurs Rat Executable 7 IoCs
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 4 IoCs
  • Windows security modification 2 TTPs 3 IoCs
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Drops file in System32 directory 3 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 34 IoCs
  • System policy modification 1 TTPs 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\02cb3ad1448449e784cb51f4238da4fe10abe0f9e11642c32399cb2d2972cc4c.exe
    "C:\Users\Admin\AppData\Local\Temp\02cb3ad1448449e784cb51f4238da4fe10abe0f9e11642c32399cb2d2972cc4c.exe"
    1⤵
    • Modifies Windows Defender Real-time Protection settings
    • UAC bypass
    • Loads dropped DLL
    • Windows security modification
    • Checks whether UAC is enabled
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2176
    • C:\Windows\SysWOW64\WindowsInput.exe
      "C:\Windows\SysWOW64\WindowsInput.exe" --install
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      PID:2280
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" Get-MpPreference -verbose
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1644
    • C:\Program Files (x86)\Steam Helper\Steam.exe
      "C:\Program Files (x86)\Steam Helper\Steam.exe"
      2⤵
      • Modifies Windows Defender Real-time Protection settings
      • UAC bypass
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Checks whether UAC is enabled
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2940
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" Get-MpPreference -verbose
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:676
      • C:\Users\Admin\AppData\Local\Temp\Update Defender.exe
        "C:\Users\Admin\AppData\Local\Temp\Update Defender.exe" /launchSelfAndExit "C:\Program Files (x86)\Steam Helper\Steam.exe" 2940 /protectFile
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1636
  • C:\Windows\SysWOW64\WindowsInput.exe
    "C:\Windows\SysWOW64\WindowsInput.exe"
    1⤵
    • Executes dropped EXE
    PID:2588
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {241F0569-14D0-4188-8679-7EDDFE62F95C} S-1-5-21-1268429524-3929314613-1992311491-1000:XBTLDBHN\Admin:Interactive:[1]
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1900
    • C:\Program Files (x86)\Steam Helper\Steam.exe
      "C:\Program Files (x86)\Steam Helper\Steam.exe"
      2⤵
      • Executes dropped EXE
      PID:2472
  • C:\Users\Admin\AppData\Local\Temp\Update Defender.exe
    "C:\Users\Admin\AppData\Local\Temp\Update Defender.exe" /watchProcess "C:\Program Files (x86)\Steam Helper\Steam.exe" 2940 "/protectFile"
    1⤵
    • Executes dropped EXE
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:628

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Steam Helper\Steam.exe

    Filesize

    510KB

    MD5

    4b1cc829c9de48746263c44e824d2c3d

    SHA1

    402572409e2ccd9da2d4e15b9f032a6efcc0e697

    SHA256

    170836ea19a0b576df0559fe676c685957ac9c4afdce1a7d0bb9055b9c11bcab

    SHA512

    6bac201be80a689c8683f5f1a1c3ff4544963456944a27f3749192c90ef5f74ef61f5c17225ddb064615fed4053a912846db1c3bf87a9f3785133987a3ad6f85

  • C:\Program Files (x86)\Steam Helper\Steam.exe

    Filesize

    433KB

    MD5

    d7b389d0da1af1f59b4930528b8c64ae

    SHA1

    6d0b125db65dddd81baf5deb950a90d9186e2a21

    SHA256

    d19ebf87e911e396d560b0b9fcb0df2a12c1e32f0fe49da09c94d7f73e9ec467

    SHA512

    77e37f6eafcecc71c8eb21b4108b3e3ce50b5e07936bfccb9d16477c8d7f3ec3b345991abd00e5dea61dbc77da87c883f90761b40f6b6b0f836153d40cff19cb

  • C:\Program Files (x86)\Steam Helper\Steam.exe

    Filesize

    344KB

    MD5

    bad5bc3c8c0fb75a077ad27126d9d830

    SHA1

    2a1edae298c1d34da4acac238c79dcbe6980c5ed

    SHA256

    a318aa555fda435c264aca27c0ca36107739510c816a5be7737003bd444f489e

    SHA512

    a4d73f7b5bda694f6fd9900e461c4da4fcc8311d63efc62c19768d1bec944cdbc25ee4f1458a1330f87acf7bc4da9a0ca6d5bc4bd871d7fecda7676d121f66d6

  • C:\Program Files (x86)\Steam Helper\Steam.exe

    Filesize

    96KB

    MD5

    1aadd7da7bb740805a4a6c0776791a5a

    SHA1

    8ddfe861889c4113cedcaff71a922b8822b36034

    SHA256

    7804122ad6595e824a0ef34faa11eb29431d6f63cf6355eaff6d930649ce4d38

    SHA512

    a62aa89fa5a5cc789f4d50750cab9950d46af86cdd91266c77e188396da2216bdebee76d642d2d3ea85e8e8101f76d92b3139fe7a478c157551851b5dd2a7741

  • C:\Users\Admin\AppData\Local\Temp\Update Defender.exe

    Filesize

    9KB

    MD5

    913967b216326e36a08010fb70f9dba3

    SHA1

    7b6f8c2eb5b443e03c212b85c2f0edb9c76ad2bf

    SHA256

    8d880758549220154d2ff4ee578f2b49527c5fb76a07d55237b61e30bcc09e3a

    SHA512

    c6fcb98d9fd509e9834fc3fba143bd36d41869cc104fbce5354951f0a6756156e34a30796baaa130dd45de3ed96e039ec14716716f6da4569915c7ef2d2b6c33

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\PX8G1CXD61TIHHI6HM52.temp

    Filesize

    2KB

    MD5

    331ec88a329255afba5881181323b42b

    SHA1

    5697e9361d22019b4ca1255770efab8a34675bad

    SHA256

    cbf3bb6b7c0e5a7541802508db3166e7d207cf14324c4a58d82461f6f330ecec

    SHA512

    080316c0aa134441cc6b5af51d90969069fe00c0e73975c461d0112908ac18888bb65640bdbadb1bca59560462a1e1e538c8fdf5288549518acb1e98e16f20eb

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

    Filesize

    7KB

    MD5

    81118bcf5a39264d4a095760693b1e59

    SHA1

    585c463cd5fe0464ffb703725d0eda560110ab85

    SHA256

    02a25a2ae0cea1c7a11f2f82a81370f9085f963eafa12cbe9ea71ad7b73dadef

    SHA512

    4584db4fc4dd2228d944f956f7d883870fa8fb8614ae5c9cd2bd7f1cf002f84cdfc1041484efca3d68ab3c8e9ca21ff5205fc692cfeb721cbd9043612467e487

  • C:\Users\Admin\AppData\Roaming\Orcus\err_381f52cc4da947c788fee861bc207f0e.dat

    Filesize

    1KB

    MD5

    8b90a6c99330a3291e6ea45ab7097401

    SHA1

    9e4087f7c2aa963364631dc59abef4445c582d4d

    SHA256

    ad6de8f4b10e7d470b0480d67eb740724d7215b7aca4be073ee08944a7ae8190

    SHA512

    6ecabe8d61ab4c9ce847c8d86f99867546477c0045bd9606f5eb198014779321882d654ef388196fc5b85ed986f4824c3bd308f0237de21fd97066871ddc936e

  • C:\Windows\SysWOW64\WindowsInput.exe

    Filesize

    21KB

    MD5

    e6fcf516d8ed8d0d4427f86e08d0d435

    SHA1

    c7691731583ab7890086635cb7f3e4c22ca5e409

    SHA256

    8dbe814359391ed6b0b5b182039008cf1d00964da9fbc4747f46242a95c24337

    SHA512

    c496cf8e2e222fe1e19051b291e6860f31aae39f54369c1c5e8c9758c4b56e8af904e3e536e743a0a6fdbbf8478afba4baee92e13fc1b3073376ac6bf4a7948e

  • C:\Windows\SysWOW64\WindowsInput.exe.config

    Filesize

    357B

    MD5

    a2b76cea3a59fa9af5ea21ff68139c98

    SHA1

    35d76475e6a54c168f536e30206578babff58274

    SHA256

    f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839

    SHA512

    b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad

  • \Program Files (x86)\Steam Helper\Steam.exe

    Filesize

    383KB

    MD5

    d193a29579532107f3eb50bcc2460768

    SHA1

    0da00fc0b2173a44e690ef825d3724027f27f7c9

    SHA256

    c9ff75149cbf26a5c780c500a60dda473f1f8cdf4e8fa6b80f94bf12db28e6a6

    SHA512

    32143edcfb02bd979c0824d23a4dea8ebd3ca299cf18417fe9520c80be01730e8c9ee815904b80f95d10761cee612f85899b58529a4acf0775d379f8f818cf02

  • memory/628-94-0x00000000743A0000-0x0000000074A8E000-memory.dmp

    Filesize

    6.9MB

  • memory/628-88-0x00000000743A0000-0x0000000074A8E000-memory.dmp

    Filesize

    6.9MB

  • memory/676-71-0x000000006C2D0000-0x000000006C87B000-memory.dmp

    Filesize

    5.7MB

  • memory/676-73-0x000000006C2D0000-0x000000006C87B000-memory.dmp

    Filesize

    5.7MB

  • memory/676-72-0x0000000002820000-0x0000000002860000-memory.dmp

    Filesize

    256KB

  • memory/676-70-0x0000000002820000-0x0000000002860000-memory.dmp

    Filesize

    256KB

  • memory/676-69-0x000000006C2D0000-0x000000006C87B000-memory.dmp

    Filesize

    5.7MB

  • memory/1636-87-0x00000000743A0000-0x0000000074A8E000-memory.dmp

    Filesize

    6.9MB

  • memory/1636-89-0x00000000743A0000-0x0000000074A8E000-memory.dmp

    Filesize

    6.9MB

  • memory/1636-84-0x0000000000070000-0x0000000000078000-memory.dmp

    Filesize

    32KB

  • memory/1644-36-0x000000006D660000-0x000000006DC0B000-memory.dmp

    Filesize

    5.7MB

  • memory/1644-37-0x000000006D660000-0x000000006DC0B000-memory.dmp

    Filesize

    5.7MB

  • memory/1644-38-0x00000000027E0000-0x0000000002820000-memory.dmp

    Filesize

    256KB

  • memory/1644-39-0x00000000027E0000-0x0000000002820000-memory.dmp

    Filesize

    256KB

  • memory/1644-40-0x000000006D660000-0x000000006DC0B000-memory.dmp

    Filesize

    5.7MB

  • memory/2176-48-0x00000000743A0000-0x0000000074A8E000-memory.dmp

    Filesize

    6.9MB

  • memory/2176-6-0x00000000009F0000-0x00000000009F8000-memory.dmp

    Filesize

    32KB

  • memory/2176-1-0x00000000743A0000-0x0000000074A8E000-memory.dmp

    Filesize

    6.9MB

  • memory/2176-2-0x0000000004A90000-0x0000000004AD0000-memory.dmp

    Filesize

    256KB

  • memory/2176-3-0x0000000000330000-0x000000000033E000-memory.dmp

    Filesize

    56KB

  • memory/2176-0-0x0000000000BB0000-0x0000000000CBC000-memory.dmp

    Filesize

    1.0MB

  • memory/2176-4-0x0000000000B10000-0x0000000000B6C000-memory.dmp

    Filesize

    368KB

  • memory/2176-5-0x0000000000990000-0x00000000009A2000-memory.dmp

    Filesize

    72KB

  • memory/2176-9-0x0000000000A20000-0x0000000000A28000-memory.dmp

    Filesize

    32KB

  • memory/2176-8-0x0000000000A10000-0x0000000000A18000-memory.dmp

    Filesize

    32KB

  • memory/2176-7-0x0000000000A00000-0x0000000000A0A000-memory.dmp

    Filesize

    40KB

  • memory/2176-10-0x0000000000A30000-0x0000000000A38000-memory.dmp

    Filesize

    32KB

  • memory/2280-21-0x000007FEF5590000-0x000007FEF5F7C000-memory.dmp

    Filesize

    9.9MB

  • memory/2280-20-0x00000000000F0000-0x00000000000FC000-memory.dmp

    Filesize

    48KB

  • memory/2280-22-0x00000000022F0000-0x0000000002370000-memory.dmp

    Filesize

    512KB

  • memory/2280-25-0x000007FEF5590000-0x000007FEF5F7C000-memory.dmp

    Filesize

    9.9MB

  • memory/2472-90-0x00000000743A0000-0x0000000074A8E000-memory.dmp

    Filesize

    6.9MB

  • memory/2472-61-0x0000000004AC0000-0x0000000004B00000-memory.dmp

    Filesize

    256KB

  • memory/2472-60-0x00000000743A0000-0x0000000074A8E000-memory.dmp

    Filesize

    6.9MB

  • memory/2588-28-0x000007FEF4BA0000-0x000007FEF558C000-memory.dmp

    Filesize

    9.9MB

  • memory/2588-27-0x0000000001210000-0x000000000121C000-memory.dmp

    Filesize

    48KB

  • memory/2588-68-0x000007FEF4BA0000-0x000007FEF558C000-memory.dmp

    Filesize

    9.9MB

  • memory/2588-29-0x0000000000B80000-0x0000000000C00000-memory.dmp

    Filesize

    512KB

  • memory/2940-52-0x00000000003C0000-0x0000000000400000-memory.dmp

    Filesize

    256KB

  • memory/2940-56-0x0000000005140000-0x000000000518E000-memory.dmp

    Filesize

    312KB

  • memory/2940-53-0x0000000000410000-0x0000000000422000-memory.dmp

    Filesize

    72KB

  • memory/2940-58-0x0000000004DD0000-0x0000000004DE0000-memory.dmp

    Filesize

    64KB

  • memory/2940-51-0x0000000000CF0000-0x0000000000DFC000-memory.dmp

    Filesize

    1.0MB

  • memory/2940-57-0x00000000046F0000-0x0000000004708000-memory.dmp

    Filesize

    96KB

  • memory/2940-62-0x00000000003C0000-0x0000000000400000-memory.dmp

    Filesize

    256KB

  • memory/2940-91-0x00000000743A0000-0x0000000074A8E000-memory.dmp

    Filesize

    6.9MB

  • memory/2940-92-0x00000000003C0000-0x0000000000400000-memory.dmp

    Filesize

    256KB

  • memory/2940-93-0x00000000003C0000-0x0000000000400000-memory.dmp

    Filesize

    256KB

  • memory/2940-50-0x00000000743A0000-0x0000000074A8E000-memory.dmp

    Filesize

    6.9MB