Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05-02-2024 01:13

General

  • Target

    02cb3ad1448449e784cb51f4238da4fe10abe0f9e11642c32399cb2d2972cc4c.exe

  • Size

    1.0MB

  • MD5

    b09d835b1c8bf6c5c24c5c958d8dea82

  • SHA1

    bf4511de1e9e27f76ecd3cefe1a3392b00329ac2

  • SHA256

    02cb3ad1448449e784cb51f4238da4fe10abe0f9e11642c32399cb2d2972cc4c

  • SHA512

    086605f75ff971eda077ee494b8a3dc8edda4cffa6071156638cb3d189a8cc91d1449b8dc8848df6d3a190443eb53af19ca74d55e31c8a20b4cc1feef1d9bcba

  • SSDEEP

    24576:k4I4MROxnFSx3UUDqrrcI0AilFEvxHPfMCYooE4:kaMiYJUUGrrcI0AilFEvxHPfJN

Malware Config

Extracted

Family

orcus

C2

4.tcp.eu.ngrok.io:14390

Mutex

381f52cc4da947c788fee861bc207f0e

Attributes
  • autostart_method

    TaskScheduler

  • enable_keylogger

    true

  • install_path

    %programfiles%\Steam Helper\Steam.exe

  • reconnect_delay

    10000

  • registry_keyname

    UpdateSystem32

  • taskscheduler_taskname

    Системные прирывания

  • watchdog_path

    Temp\Update Defender.exe

Signatures

  • Contains code to disable Windows Defender 1 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 7 IoCs
  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

  • Orcus main payload 4 IoCs
  • UAC bypass 3 TTPs 6 IoCs
  • Orcurs Rat Executable 5 IoCs
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Windows security modification 2 TTPs 3 IoCs
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
  • Drops file in System32 directory 3 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs
  • System policy modification 1 TTPs 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\02cb3ad1448449e784cb51f4238da4fe10abe0f9e11642c32399cb2d2972cc4c.exe
    "C:\Users\Admin\AppData\Local\Temp\02cb3ad1448449e784cb51f4238da4fe10abe0f9e11642c32399cb2d2972cc4c.exe"
    1⤵
    • Modifies Windows Defender Real-time Protection settings
    • UAC bypass
    • Checks computer location settings
    • Windows security modification
    • Checks whether UAC is enabled
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:5000
    • C:\Windows\SysWOW64\WindowsInput.exe
      "C:\Windows\SysWOW64\WindowsInput.exe" --install
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      PID:2068
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" Get-MpPreference -verbose
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1412
    • C:\Program Files (x86)\Steam Helper\Steam.exe
      "C:\Program Files (x86)\Steam Helper\Steam.exe"
      2⤵
      • Modifies Windows Defender Real-time Protection settings
      • UAC bypass
      • Checks computer location settings
      • Executes dropped EXE
      • Windows security modification
      • Checks whether UAC is enabled
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:1700
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" Get-MpPreference -verbose
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1268
      • C:\Users\Admin\AppData\Local\Temp\Update Defender.exe
        "C:\Users\Admin\AppData\Local\Temp\Update Defender.exe" /launchSelfAndExit "C:\Program Files (x86)\Steam Helper\Steam.exe" 1700 /protectFile
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4268
        • C:\Users\Admin\AppData\Local\Temp\Update Defender.exe
          "C:\Users\Admin\AppData\Local\Temp\Update Defender.exe" /watchProcess "C:\Program Files (x86)\Steam Helper\Steam.exe" 1700 "/protectFile"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3224
  • C:\Windows\SysWOW64\WindowsInput.exe
    "C:\Windows\SysWOW64\WindowsInput.exe"
    1⤵
    • Executes dropped EXE
    PID:1744
  • C:\Program Files (x86)\Steam Helper\Steam.exe
    "C:\Program Files (x86)\Steam Helper\Steam.exe"
    1⤵
    • Executes dropped EXE
    PID:1668

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Steam Helper\Steam.exe

    Filesize

    115KB

    MD5

    a21fdf2241cda9cf394bb68eb1d4df6f

    SHA1

    1ce1260986eb196f163df08e3f91261f605b1f92

    SHA256

    a9245761d171752e1bbcc02a1e3f67ac768afebd0aa71ea501b95f5c1a0c8d67

    SHA512

    110522327577d054fff4ae0831222db4d10ab79916f480a8620b1fadacec2d50c97ed24545f8f6dc788aeda9550be33700c96d53164e4b5c858a281cda19b0da

  • C:\Program Files (x86)\Steam Helper\Steam.exe

    Filesize

    220KB

    MD5

    2bb5fe7282480f4ad63f33c0f6602835

    SHA1

    b26384a4574e3be3af772b728632523a9ccf6960

    SHA256

    b7d898eaff0d6fde2fcf234c535a3010e546282714167e0c99e3dc7012a14401

    SHA512

    15cdd8fb1d7e1b09d56f342fdbb34ae20a74a5fe77e67c1714cff5a0c52707f2f28192f4a819f80443e96c8a11760a57afaa1b40d8edd08bcedae4245920daae

  • C:\Program Files (x86)\Steam Helper\Steam.exe

    Filesize

    223KB

    MD5

    597f915ad40219e0ee3785c960382ec9

    SHA1

    c77bbda401fee1c4916a7637f9366b33421e80c7

    SHA256

    46978e5af29f7b9551f799ad1a39844c2ff9b2dbf6fcd1c8adb524e1a9bc6a73

    SHA512

    f5bf385d66c7b43d9d973fd0f14b9414b6c467b19f31b7f8255eaeebbe16532238392adc70ff6767cfe251dca023e35259c123d82920ea3e0bfb71189ab07bec

  • C:\Program Files (x86)\Steam Helper\Steam.exe

    Filesize

    119KB

    MD5

    d4b4d2772b739515c9246ae04e2a19dd

    SHA1

    b1c9e1de1a499102e07580270e1ac9f87b398010

    SHA256

    0e2f475d0f3d167a422946e39f71885d4c309d565e33911d8647679e562d817d

    SHA512

    118d3b27dcba83423f8183c00c254660fabadd58410d045fef72b595a71d826a3655b2418dc8f77693f84b6c32b4a2e311c255bb8aaf0af9d6ebe2276f81a054

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Update Defender.exe.log

    Filesize

    425B

    MD5

    4eaca4566b22b01cd3bc115b9b0b2196

    SHA1

    e743e0792c19f71740416e7b3c061d9f1336bf94

    SHA256

    34ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb

    SHA512

    bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

    Filesize

    2KB

    MD5

    e38cf80ccd733d12acd8ed657fa76a0f

    SHA1

    580e49e1b482dcf0480cefe6d5bf8f0331732296

    SHA256

    47996c1354ee704ef75a94ae2217033da52695ca164573023cda951bdec728be

    SHA512

    ed7056b56d6cd0fd42f9bb716c647ed21f988231aa0817f28be7fceab199a274a479af4e7b77b86ed298b6734b39c2e6714d46bd6bd408d9862a77d97013bc12

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    18KB

    MD5

    abf637a648626a696ff525fc658665dc

    SHA1

    6a899fee14f0aefea5e34f9aa4d14b878dab52fa

    SHA256

    208fba8a0e97fecdda6c8e115f83d6fe14c2a5683c82e3168befe026119aeaed

    SHA512

    c8ec7aab05723a6c5c4271dbe6ae8a067a6ee8c7eb79d7277285c8a9f649ca6394c9c9c18555cd63019b57a3d1273fb86e839186f367d5277cb62f62ebc0ecad

  • C:\Users\Admin\AppData\Local\Temp\Update Defender.exe

    Filesize

    9KB

    MD5

    913967b216326e36a08010fb70f9dba3

    SHA1

    7b6f8c2eb5b443e03c212b85c2f0edb9c76ad2bf

    SHA256

    8d880758549220154d2ff4ee578f2b49527c5fb76a07d55237b61e30bcc09e3a

    SHA512

    c6fcb98d9fd509e9834fc3fba143bd36d41869cc104fbce5354951f0a6756156e34a30796baaa130dd45de3ed96e039ec14716716f6da4569915c7ef2d2b6c33

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_diimqcdp.4ij.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Roaming\Orcus\err_381f52cc4da947c788fee861bc207f0e.dat

    Filesize

    1KB

    MD5

    aba5f22dd736812f16972d2cd9533fc5

    SHA1

    e29cf34f36a14a02cfac6089716481dcefadeeb1

    SHA256

    be8f2ae553602373baf09880d938ed79f36ec36b3e5f50d21277fc002762eb19

    SHA512

    fb4b3a69d22e94bc8f67ba945dc2ca62a0a4f4bf341109239c2d68398c0d00713327412768d64e32f276ff0a46b14d9a2dd55edb76b42ccb57f71e1f561c9125

  • C:\Windows\SysWOW64\WindowsInput.exe

    Filesize

    21KB

    MD5

    e6fcf516d8ed8d0d4427f86e08d0d435

    SHA1

    c7691731583ab7890086635cb7f3e4c22ca5e409

    SHA256

    8dbe814359391ed6b0b5b182039008cf1d00964da9fbc4747f46242a95c24337

    SHA512

    c496cf8e2e222fe1e19051b291e6860f31aae39f54369c1c5e8c9758c4b56e8af904e3e536e743a0a6fdbbf8478afba4baee92e13fc1b3073376ac6bf4a7948e

  • C:\Windows\SysWOW64\WindowsInput.exe.config

    Filesize

    357B

    MD5

    a2b76cea3a59fa9af5ea21ff68139c98

    SHA1

    35d76475e6a54c168f536e30206578babff58274

    SHA256

    f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839

    SHA512

    b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad

  • memory/1412-93-0x00000000074F0000-0x000000000750A000-memory.dmp

    Filesize

    104KB

  • memory/1412-87-0x00000000071B0000-0x00000000071CA000-memory.dmp

    Filesize

    104KB

  • memory/1412-66-0x0000000005920000-0x0000000005986000-memory.dmp

    Filesize

    408KB

  • memory/1412-97-0x0000000074910000-0x00000000750C0000-memory.dmp

    Filesize

    7.7MB

  • memory/1412-94-0x00000000074D0000-0x00000000074D8000-memory.dmp

    Filesize

    32KB

  • memory/1412-91-0x00000000073E0000-0x00000000073EE000-memory.dmp

    Filesize

    56KB

  • memory/1412-92-0x00000000073F0000-0x0000000007404000-memory.dmp

    Filesize

    80KB

  • memory/1412-90-0x00000000073B0000-0x00000000073C1000-memory.dmp

    Filesize

    68KB

  • memory/1412-89-0x0000000007430000-0x00000000074C6000-memory.dmp

    Filesize

    600KB

  • memory/1412-88-0x0000000007230000-0x000000000723A000-memory.dmp

    Filesize

    40KB

  • memory/1412-69-0x000000007F570000-0x000000007F580000-memory.dmp

    Filesize

    64KB

  • memory/1412-71-0x0000000070CF0000-0x0000000070D3C000-memory.dmp

    Filesize

    304KB

  • memory/1412-86-0x0000000007800000-0x0000000007E7A000-memory.dmp

    Filesize

    6.5MB

  • memory/1412-67-0x0000000005A00000-0x0000000005D54000-memory.dmp

    Filesize

    3.3MB

  • memory/1412-84-0x0000000004A00000-0x0000000004A10000-memory.dmp

    Filesize

    64KB

  • memory/1412-85-0x0000000004A00000-0x0000000004A10000-memory.dmp

    Filesize

    64KB

  • memory/1412-82-0x0000000007090000-0x0000000007133000-memory.dmp

    Filesize

    652KB

  • memory/1412-81-0x0000000006470000-0x000000000648E000-memory.dmp

    Filesize

    120KB

  • memory/1412-70-0x0000000007050000-0x0000000007082000-memory.dmp

    Filesize

    200KB

  • memory/1412-51-0x00000000048E0000-0x0000000004916000-memory.dmp

    Filesize

    216KB

  • memory/1412-53-0x0000000005040000-0x0000000005668000-memory.dmp

    Filesize

    6.2MB

  • memory/1412-55-0x0000000004A00000-0x0000000004A10000-memory.dmp

    Filesize

    64KB

  • memory/1412-54-0x0000000004A00000-0x0000000004A10000-memory.dmp

    Filesize

    64KB

  • memory/1412-56-0x0000000005700000-0x0000000005722000-memory.dmp

    Filesize

    136KB

  • memory/1412-68-0x0000000005E90000-0x0000000005EAE000-memory.dmp

    Filesize

    120KB

  • memory/1412-52-0x0000000074910000-0x00000000750C0000-memory.dmp

    Filesize

    7.7MB

  • memory/1700-135-0x0000000074910000-0x00000000750C0000-memory.dmp

    Filesize

    7.7MB

  • memory/1744-44-0x00007FF941010000-0x00007FF941AD1000-memory.dmp

    Filesize

    10.8MB

  • memory/1744-46-0x000000001ABC0000-0x000000001ACCA000-memory.dmp

    Filesize

    1.0MB

  • memory/1744-45-0x0000000001CC0000-0x0000000001CD0000-memory.dmp

    Filesize

    64KB

  • memory/2068-35-0x00007FF941010000-0x00007FF941AD1000-memory.dmp

    Filesize

    10.8MB

  • memory/2068-34-0x0000000000500000-0x000000000050C000-memory.dmp

    Filesize

    48KB

  • memory/2068-42-0x00007FF941010000-0x00007FF941AD1000-memory.dmp

    Filesize

    10.8MB

  • memory/2068-37-0x0000000000D50000-0x0000000000D8C000-memory.dmp

    Filesize

    240KB

  • memory/2068-36-0x0000000000CF0000-0x0000000000D02000-memory.dmp

    Filesize

    72KB

  • memory/2068-38-0x0000000000BD0000-0x0000000000BE0000-memory.dmp

    Filesize

    64KB

  • memory/5000-9-0x0000000005340000-0x000000000534A000-memory.dmp

    Filesize

    40KB

  • memory/5000-109-0x000000007EE90000-0x000000007EEA0000-memory.dmp

    Filesize

    64KB

  • memory/5000-15-0x00000000058E0000-0x00000000058F2000-memory.dmp

    Filesize

    72KB

  • memory/5000-17-0x0000000005F60000-0x0000000005FAC000-memory.dmp

    Filesize

    304KB

  • memory/5000-14-0x0000000006500000-0x0000000006B18000-memory.dmp

    Filesize

    6.1MB

  • memory/5000-20-0x0000000006480000-0x00000000064A2000-memory.dmp

    Filesize

    136KB

  • memory/5000-18-0x00000000060C0000-0x00000000061CA000-memory.dmp

    Filesize

    1.0MB

  • memory/5000-7-0x0000000005200000-0x0000000005212000-memory.dmp

    Filesize

    72KB

  • memory/5000-8-0x0000000005210000-0x0000000005218000-memory.dmp

    Filesize

    32KB

  • memory/5000-0-0x0000000000610000-0x000000000071C000-memory.dmp

    Filesize

    1.0MB

  • memory/5000-10-0x0000000005350000-0x0000000005358000-memory.dmp

    Filesize

    32KB

  • memory/5000-107-0x0000000007B70000-0x0000000007BBA000-memory.dmp

    Filesize

    296KB

  • memory/5000-108-0x00000000087D0000-0x0000000008B24000-memory.dmp

    Filesize

    3.3MB

  • memory/5000-83-0x0000000074910000-0x00000000750C0000-memory.dmp

    Filesize

    7.7MB

  • memory/5000-119-0x0000000009FB0000-0x000000000A053000-memory.dmp

    Filesize

    652KB

  • memory/5000-120-0x000000000A4D0000-0x000000000A4E1000-memory.dmp

    Filesize

    68KB

  • memory/5000-121-0x000000000A4F0000-0x000000000A504000-memory.dmp

    Filesize

    80KB

  • memory/5000-13-0x0000000005820000-0x0000000005886000-memory.dmp

    Filesize

    408KB

  • memory/5000-134-0x0000000005370000-0x0000000005380000-memory.dmp

    Filesize

    64KB

  • memory/5000-16-0x0000000005F20000-0x0000000005F5C000-memory.dmp

    Filesize

    240KB

  • memory/5000-11-0x0000000005360000-0x0000000005368000-memory.dmp

    Filesize

    32KB

  • memory/5000-12-0x0000000005780000-0x0000000005788000-memory.dmp

    Filesize

    32KB

  • memory/5000-6-0x0000000005220000-0x00000000052B2000-memory.dmp

    Filesize

    584KB

  • memory/5000-5-0x0000000005930000-0x0000000005ED4000-memory.dmp

    Filesize

    5.6MB

  • memory/5000-4-0x0000000005080000-0x00000000050DC000-memory.dmp

    Filesize

    368KB

  • memory/5000-3-0x0000000005070000-0x000000000507E000-memory.dmp

    Filesize

    56KB

  • memory/5000-2-0x0000000005370000-0x0000000005380000-memory.dmp

    Filesize

    64KB

  • memory/5000-1-0x0000000074910000-0x00000000750C0000-memory.dmp

    Filesize

    7.7MB