Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    06-02-2024 01:34

General

  • Target

    a29400e0ab5d6053fa0282250f76133714c09580e023a379728d37c6ba21317b.exe

  • Size

    22.9MB

  • MD5

    c3250c3541382fc0bd8f14229e5fc721

  • SHA1

    ca91e11b8ad65c492912de4401cbcbfecd45d02f

  • SHA256

    a29400e0ab5d6053fa0282250f76133714c09580e023a379728d37c6ba21317b

  • SHA512

    d341aa7aad0adc81b80b9b2b23066f3b78a91711fa434496378f3f615356f1a72603d1ba7313ef5700ac13a08b4552d84e168de61a64eaf7ee727a1fbd889fbe

  • SSDEEP

    24576:Fkk4MROxnFSx3sUzrrcI0AilFEvxHP+ooU:FmMiYJsUzrrcI0AilFEvxHP

Malware Config

Extracted

Family

orcus

C2

0.tcp.eu.ngrok.io:11649

Mutex

91ae58d9b49a47b0933d6314024a6ff7

Attributes
  • autostart_method

    Registry

  • enable_keylogger

    true

  • install_path

    %programfiles%\Chrome Update\Chrome Network.exe

  • reconnect_delay

    10000

  • registry_keyname

    Telegram Update

  • taskscheduler_taskname

    svhost

  • watchdog_path

    Temp\System Files.exe

Signatures

  • Contains code to disable Windows Defender 1 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 7 IoCs
  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

  • Orcus main payload 5 IoCs
  • UAC bypass 3 TTPs 6 IoCs
  • Orcurs Rat Executable 7 IoCs
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 4 IoCs
  • Windows security modification 2 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Drops file in System32 directory 3 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs
  • System policy modification 1 TTPs 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a29400e0ab5d6053fa0282250f76133714c09580e023a379728d37c6ba21317b.exe
    "C:\Users\Admin\AppData\Local\Temp\a29400e0ab5d6053fa0282250f76133714c09580e023a379728d37c6ba21317b.exe"
    1⤵
    • Modifies Windows Defender Real-time Protection settings
    • UAC bypass
    • Loads dropped DLL
    • Windows security modification
    • Checks whether UAC is enabled
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2052
    • C:\Windows\SysWOW64\WindowsInput.exe
      "C:\Windows\SysWOW64\WindowsInput.exe" --install
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      PID:2576
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" Get-MpPreference -verbose
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2372
    • C:\Program Files (x86)\Chrome Update\Chrome Network.exe
      "C:\Program Files (x86)\Chrome Update\Chrome Network.exe"
      2⤵
      • Modifies Windows Defender Real-time Protection settings
      • UAC bypass
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:868
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" Get-MpPreference -verbose
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1920
      • C:\Users\Admin\AppData\Local\Temp\System Files.exe
        "C:\Users\Admin\AppData\Local\Temp\System Files.exe" /launchSelfAndExit "C:\Program Files (x86)\Chrome Update\Chrome Network.exe" 868 /protectFile
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2852
        • C:\Users\Admin\AppData\Local\Temp\System Files.exe
          "C:\Users\Admin\AppData\Local\Temp\System Files.exe" /watchProcess "C:\Program Files (x86)\Chrome Update\Chrome Network.exe" 868 "/protectFile"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2336
  • C:\Windows\SysWOW64\WindowsInput.exe
    "C:\Windows\SysWOW64\WindowsInput.exe"
    1⤵
    • Executes dropped EXE
    PID:2740
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {FBD9780A-D7BF-46CF-913E-D1CFD19F7A18} S-1-5-21-3427588347-1492276948-3422228430-1000:QVMRJQQO\Admin:Interactive:[1]
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2512
    • C:\Program Files (x86)\Chrome Update\Chrome Network.exe
      "C:\Program Files (x86)\Chrome Update\Chrome Network.exe"
      2⤵
      • Executes dropped EXE
      PID:1044

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Chrome Update\Chrome Network.exe

    Filesize

    2.1MB

    MD5

    a4603a8891eb9348c4c62866c6439d54

    SHA1

    96a1ba81a8cf461a9f6b8174136cd0d5344ae82d

    SHA256

    566baba7b3d7b7b2afa951ae00f71bb9d79ba1b586befb1b80b7966b7c678424

    SHA512

    1620d61cfba48e932ad8dfbc5127f28df4ac957ddde05630c7feb54498c8b957e0cf4272b79c28449d202eb51c89e9de19646ed781d94ec6f84e0e8905f0186c

  • C:\Program Files (x86)\Chrome Update\Chrome Network.exe

    Filesize

    1.4MB

    MD5

    857bf63eec0e560c0219a92ffe081a70

    SHA1

    3a57ce4e0204808e207b5072aee7d6ef43744a72

    SHA256

    8a3e146a0a8f22ead9b7c202a4a131cecb5f3dfd2ba356624a297e0febd4d3dc

    SHA512

    d91aaa1389252312d27c7da32ea1c50867688a7cad540686e3e6f67664134f2bb7c4cf3b39a91545bd56e70753046856f432a3f8445edc60d715c3a0f3cc19d1

  • C:\Program Files (x86)\Chrome Update\Chrome Network.exe

    Filesize

    1.5MB

    MD5

    c9897f958b41abc1e28946ae05b046bc

    SHA1

    a935c3914208532d1ad751f9297291bb15f00615

    SHA256

    9b9a8d72a3e3763cebf66bca2259758e24ea57523414dd3ff453ecf51c03e42b

    SHA512

    37da26c7a8b5a599d536b9622dc1cd7b8c9d7f0e0729e62cbdfc94ab7637500d63b86a7915b3af19339d2007b868b22bbe2ab937bd373e4710de3aa6ad6f8dcc

  • C:\Program Files (x86)\Chrome Update\Chrome Network.exe

    Filesize

    6.9MB

    MD5

    075f8728127a0d9c0f7cad3a3f501d7e

    SHA1

    f9ac4650449f0258e22340cc8dece5bc61f39897

    SHA256

    7cdbb61bca9bbbe2e5375f75121e68d376e3f31e13e0bcfb30c1c7d232b11c8e

    SHA512

    066cbd9f48538c4f88157e9cb750c628f6c9879c32d84bc93918ec42b941c974493bc7ac89adced7d245e89519c31bc17beebe843921f84cd990dcd285118706

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

    Filesize

    7KB

    MD5

    0a8efedad7daaa372940c5dfcc39cb69

    SHA1

    c70ead50a0ecd4e5a9589df2a073847d8cfd166e

    SHA256

    d33769d8787d50690f3398432f606ff100a155485f02eb6b745abd24bdc3ceef

    SHA512

    48af885b2f3bbf41fdadbcf774ea4ea5d26b43c135c0b2a08518feb3da26a8bf456d2d798b6db33e42ad01c3a56c61032345ec276babc08529336f1ad795d715

  • C:\Users\Admin\AppData\Roaming\Orcus\err_91ae58d9b49a47b0933d6314024a6ff7.dat

    Filesize

    1KB

    MD5

    f653cdbb78fc13b54f5715a43ab69cb5

    SHA1

    c378b3677e8c35ef0cfdd06ed2da83066a096d76

    SHA256

    b9bbd94856b23e287fed9bc5f7818ff6b490428cd090f434205c9d92bf9b129b

    SHA512

    f91077f70e4530cca616e07eb7773df4088346fc002fe5114a4b65873c540d8f86adf5985889964079dff7d90b63aa03ecb9d7b4b019e3e1d4055030a422564f

  • C:\Windows\SysWOW64\WindowsInput.exe.config

    Filesize

    357B

    MD5

    a2b76cea3a59fa9af5ea21ff68139c98

    SHA1

    35d76475e6a54c168f536e30206578babff58274

    SHA256

    f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839

    SHA512

    b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad

  • \Program Files (x86)\Chrome Update\Chrome Network.exe

    Filesize

    2.0MB

    MD5

    c9745e509290205002b5391c335c47db

    SHA1

    28797998f1b4e8c3dbf9763525e50128e0baa950

    SHA256

    f2871f4307d0a0a13e60f02166fc91d16e2a50c6db9fa61f170fa742f0964ce0

    SHA512

    0745b6d9dbdfd793550a6cad9f8cdbe85299e14428514c352498cf1c40911d25b66bdb06d345f1f1bf21a203cbb9133ae87f1937f61840b9c3787d87467842f8

  • \Users\Admin\AppData\Local\Temp\System Files.exe

    Filesize

    9KB

    MD5

    913967b216326e36a08010fb70f9dba3

    SHA1

    7b6f8c2eb5b443e03c212b85c2f0edb9c76ad2bf

    SHA256

    8d880758549220154d2ff4ee578f2b49527c5fb76a07d55237b61e30bcc09e3a

    SHA512

    c6fcb98d9fd509e9834fc3fba143bd36d41869cc104fbce5354951f0a6756156e34a30796baaa130dd45de3ed96e039ec14716716f6da4569915c7ef2d2b6c33

  • \Windows\SysWOW64\WindowsInput.exe

    Filesize

    21KB

    MD5

    e6fcf516d8ed8d0d4427f86e08d0d435

    SHA1

    c7691731583ab7890086635cb7f3e4c22ca5e409

    SHA256

    8dbe814359391ed6b0b5b182039008cf1d00964da9fbc4747f46242a95c24337

    SHA512

    c496cf8e2e222fe1e19051b291e6860f31aae39f54369c1c5e8c9758c4b56e8af904e3e536e743a0a6fdbbf8478afba4baee92e13fc1b3073376ac6bf4a7948e

  • memory/868-57-0x0000000000DB0000-0x0000000000DC8000-memory.dmp

    Filesize

    96KB

  • memory/868-58-0x0000000000F30000-0x0000000000F40000-memory.dmp

    Filesize

    64KB

  • memory/868-56-0x0000000000B60000-0x0000000000BAE000-memory.dmp

    Filesize

    312KB

  • memory/868-51-0x0000000074CA0000-0x000000007538E000-memory.dmp

    Filesize

    6.9MB

  • memory/868-50-0x0000000004AF0000-0x0000000004B30000-memory.dmp

    Filesize

    256KB

  • memory/868-48-0x0000000000F40000-0x0000000001030000-memory.dmp

    Filesize

    960KB

  • memory/868-88-0x0000000004AF0000-0x0000000004B30000-memory.dmp

    Filesize

    256KB

  • memory/868-91-0x0000000074CA0000-0x000000007538E000-memory.dmp

    Filesize

    6.9MB

  • memory/1044-60-0x0000000074CA0000-0x000000007538E000-memory.dmp

    Filesize

    6.9MB

  • memory/1044-61-0x0000000004AD0000-0x0000000004B10000-memory.dmp

    Filesize

    256KB

  • memory/1044-90-0x0000000074CA0000-0x000000007538E000-memory.dmp

    Filesize

    6.9MB

  • memory/1920-67-0x000000006CC30000-0x000000006D1DB000-memory.dmp

    Filesize

    5.7MB

  • memory/1920-68-0x0000000002890000-0x00000000028D0000-memory.dmp

    Filesize

    256KB

  • memory/1920-72-0x000000006CC30000-0x000000006D1DB000-memory.dmp

    Filesize

    5.7MB

  • memory/1920-71-0x0000000002890000-0x00000000028D0000-memory.dmp

    Filesize

    256KB

  • memory/1920-70-0x0000000002890000-0x00000000028D0000-memory.dmp

    Filesize

    256KB

  • memory/1920-69-0x000000006CC30000-0x000000006D1DB000-memory.dmp

    Filesize

    5.7MB

  • memory/2052-8-0x0000000000650000-0x0000000000658000-memory.dmp

    Filesize

    32KB

  • memory/2052-10-0x0000000000670000-0x0000000000678000-memory.dmp

    Filesize

    32KB

  • memory/2052-49-0x0000000074CA0000-0x000000007538E000-memory.dmp

    Filesize

    6.9MB

  • memory/2052-4-0x00000000005A0000-0x00000000005FC000-memory.dmp

    Filesize

    368KB

  • memory/2052-1-0x0000000074CA0000-0x000000007538E000-memory.dmp

    Filesize

    6.9MB

  • memory/2052-52-0x0000000074CA0000-0x000000007538E000-memory.dmp

    Filesize

    6.9MB

  • memory/2052-2-0x0000000004D10000-0x0000000004D50000-memory.dmp

    Filesize

    256KB

  • memory/2052-0-0x0000000000310000-0x0000000000400000-memory.dmp

    Filesize

    960KB

  • memory/2052-3-0x0000000000300000-0x000000000030E000-memory.dmp

    Filesize

    56KB

  • memory/2052-5-0x00000000004F0000-0x0000000000502000-memory.dmp

    Filesize

    72KB

  • memory/2052-9-0x0000000000660000-0x0000000000668000-memory.dmp

    Filesize

    32KB

  • memory/2052-6-0x0000000000510000-0x0000000000518000-memory.dmp

    Filesize

    32KB

  • memory/2052-7-0x0000000000600000-0x000000000060A000-memory.dmp

    Filesize

    40KB

  • memory/2336-89-0x0000000074CA0000-0x000000007538E000-memory.dmp

    Filesize

    6.9MB

  • memory/2336-92-0x0000000074CA0000-0x000000007538E000-memory.dmp

    Filesize

    6.9MB

  • memory/2372-38-0x000000006DF60000-0x000000006E50B000-memory.dmp

    Filesize

    5.7MB

  • memory/2372-39-0x000000006DF60000-0x000000006E50B000-memory.dmp

    Filesize

    5.7MB

  • memory/2372-35-0x000000006DF60000-0x000000006E50B000-memory.dmp

    Filesize

    5.7MB

  • memory/2372-36-0x0000000002870000-0x00000000028B0000-memory.dmp

    Filesize

    256KB

  • memory/2372-37-0x0000000002870000-0x00000000028B0000-memory.dmp

    Filesize

    256KB

  • memory/2576-20-0x0000000000B90000-0x0000000000B9C000-memory.dmp

    Filesize

    48KB

  • memory/2576-21-0x000007FEF5F00000-0x000007FEF68EC000-memory.dmp

    Filesize

    9.9MB

  • memory/2576-22-0x000000001B130000-0x000000001B1B0000-memory.dmp

    Filesize

    512KB

  • memory/2576-25-0x000007FEF5F00000-0x000007FEF68EC000-memory.dmp

    Filesize

    9.9MB

  • memory/2740-28-0x00000000199F0000-0x0000000019A70000-memory.dmp

    Filesize

    512KB

  • memory/2740-27-0x000007FEF5510000-0x000007FEF5EFC000-memory.dmp

    Filesize

    9.9MB

  • memory/2740-53-0x000007FEF5510000-0x000007FEF5EFC000-memory.dmp

    Filesize

    9.9MB

  • memory/2852-84-0x00000000001B0000-0x00000000001B8000-memory.dmp

    Filesize

    32KB

  • memory/2852-83-0x0000000074CA0000-0x000000007538E000-memory.dmp

    Filesize

    6.9MB

  • memory/2852-87-0x0000000074CA0000-0x000000007538E000-memory.dmp

    Filesize

    6.9MB