Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-02-2024 03:19

General

  • Target

    a758763a7fb30398cbdab370be24c389a1927fb376772fcb31f4017ca942a284.exe

  • Size

    916KB

  • MD5

    bdbe50403b411db0e07511e098bdb9ff

  • SHA1

    5772743e950c1c647a5cab202fc3cc29039e2749

  • SHA256

    a758763a7fb30398cbdab370be24c389a1927fb376772fcb31f4017ca942a284

  • SHA512

    9531b3c7572f07aaac342635369732b77c1df58c262e32b21327cd2ac47afe6e3042d79a6a72e30c07b03e420cd9b47b1781bc5ed875b8d7b973b480090261f9

  • SSDEEP

    24576:+cI4MROxnFD3jEsYxrZlI0AilFEvxHiH0h9:+crMiJWrZlI0AilFEvxHi

Malware Config

Extracted

Family

orcus

C2

obfuscated.us:8080

Mutex

0133d229c4e24006957c0e4ab3a52531

Attributes
  • autostart_method

    Registry

  • enable_keylogger

    false

  • install_path

    %programfiles%\Orcus\Orcus.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\OrcusWatchdog.exe

Signatures

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

  • Orcus main payload 4 IoCs
  • Orcurs Rat Executable 5 IoCs
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops desktop.ini file(s) 2 IoCs
  • Drops file in System32 directory 3 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\a758763a7fb30398cbdab370be24c389a1927fb376772fcb31f4017ca942a284.exe
    "C:\Users\Admin\AppData\Local\Temp\a758763a7fb30398cbdab370be24c389a1927fb376772fcb31f4017ca942a284.exe"
    1⤵
    • Checks computer location settings
    • Drops desktop.ini file(s)
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:4040
    • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\1czizdxl.cmdline"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1844
      • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES54F7.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC54F6.tmp"
        3⤵
          PID:5076
      • C:\Windows\SysWOW64\WindowsInput.exe
        "C:\Windows\SysWOW64\WindowsInput.exe" --install
        2⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        PID:1152
      • C:\Program Files\Orcus\Orcus.exe
        "C:\Program Files\Orcus\Orcus.exe"
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:2680
        • C:\Users\Admin\AppData\Roaming\OrcusWatchdog.exe
          "C:\Users\Admin\AppData\Roaming\OrcusWatchdog.exe" /launchSelfAndExit "C:\Program Files\Orcus\Orcus.exe" 2680
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:832
          • C:\Users\Admin\AppData\Roaming\OrcusWatchdog.exe
            "C:\Users\Admin\AppData\Roaming\OrcusWatchdog.exe" /watchProcess "C:\Program Files\Orcus\Orcus.exe" 2680
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1280
    • C:\Windows\SysWOW64\WindowsInput.exe
      "C:\Windows\SysWOW64\WindowsInput.exe"
      1⤵
      • Executes dropped EXE
      PID:2324
    • C:\Program Files\Orcus\Orcus.exe
      "C:\Program Files\Orcus\Orcus.exe"
      1⤵
      • Executes dropped EXE
      PID:4364

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files\Orcus\Orcus.exe

      Filesize

      391KB

      MD5

      47762042c5aa2d592308ad42713b491a

      SHA1

      429329a90b36fa500d6849167fc87f9bdf0a2144

      SHA256

      059bb4329da629cd52210265abbb05ad356c1911cf2c9624801bdbb99734d713

      SHA512

      3751a3321be43d92086df8fac3587db483f7eabe97f838f87b23fa8ebb896c2d4764bb1e265a092784d9fc1301339efcb5f65425f9fd03cc2cb6cac9a0d06f1e

    • C:\Program Files\Orcus\Orcus.exe

      Filesize

      217KB

      MD5

      de4f011cac5e5cca525735c0cf19b75f

      SHA1

      7d9440464d1c85cf7adc7a2b8e19b3b5d5b2efa4

      SHA256

      767d6e358ea50c63f49aceadd7664010069c321f73d9b61ea7d4c293e8cd5793

      SHA512

      84612b663c5351f748591549baa4b505355f6976d080bbfd25e442fbdf4a8c94d35de6cbf2d01a9012e09fa018cddc2e4d601270e1b27d1f34fd6322de75451d

    • C:\Program Files\Orcus\Orcus.exe

      Filesize

      216KB

      MD5

      16c76b56eba386c7449f918e0c32d9a7

      SHA1

      54b54afbfe6028aa8c0776a80d318d423533604c

      SHA256

      bdb97088a355dc2bcb80128f066c23fda038366522e4060d408258f6badb4381

      SHA512

      0169513ba8db048a66ddb5c3aa294282fa7591817e65374a592e3341020e2c7aaf9005841cbbd93ea37a3b04307e7ad61c17877af016c5397446ad95d0aa7ebb

    • C:\Program Files\Orcus\Orcus.exe

      Filesize

      199KB

      MD5

      453f7e4d8361011ab8bd9862a699baf9

      SHA1

      36a809b6e4a0e2d4b0cf6ea612201b9519883b21

      SHA256

      3e24007b45ba07caad6ce50d36f018d39c00c72e63e0ba294e2883a5e367a85e

      SHA512

      58a909803351c54aa2b0fec3a96cbcbc11e4e2e2f16fd98a5521ea094b560a1e4c9c261f6ac4ee1a6170727eae9a6ab787c796858f5bca5d737fc98046dbd831

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\OrcusWatchdog.exe.log

      Filesize

      425B

      MD5

      4eaca4566b22b01cd3bc115b9b0b2196

      SHA1

      e743e0792c19f71740416e7b3c061d9f1336bf94

      SHA256

      34ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb

      SHA512

      bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1

    • C:\Users\Admin\AppData\Local\Temp\1czizdxl.dll

      Filesize

      76KB

      MD5

      3c93720aac3f691a5089dcf42e0d3b05

      SHA1

      d41009296d612e33e48d2eec5e1209da8fa508eb

      SHA256

      6792cb2838e50aff66d1bce236bd219915728c206f1b959eecffc2e06607b9e7

      SHA512

      68d530d59002436753e8353887a1c02906b5f791115d29ef2beb1abc3907c9e66908937617e2629d8e3a7dd37543b91120a1a2589f95e4bd39fb37bcc9280df9

    • C:\Users\Admin\AppData\Local\Temp\RES54F7.tmp

      Filesize

      1KB

      MD5

      5a9f1059cf02252db22710e92a3df00d

      SHA1

      ee9b74576b40d3f8b9d8a9fdeb72193da41f97c0

      SHA256

      5905218e7199e4b8d4ac15f22b29f78dc63431e6457f5c14081c21b342322d89

      SHA512

      6ef22001d04777867dbedd262bdd69a6aec03752bae85d44743d0f8b8d08d4cf63d76a26db42c370b9b65192ede92f635c0fd627f8a148f02f62ec85ac6eb64a

    • C:\Users\Admin\AppData\Roaming\OrcusWatchdog.exe

      Filesize

      9KB

      MD5

      913967b216326e36a08010fb70f9dba3

      SHA1

      7b6f8c2eb5b443e03c212b85c2f0edb9c76ad2bf

      SHA256

      8d880758549220154d2ff4ee578f2b49527c5fb76a07d55237b61e30bcc09e3a

      SHA512

      c6fcb98d9fd509e9834fc3fba143bd36d41869cc104fbce5354951f0a6756156e34a30796baaa130dd45de3ed96e039ec14716716f6da4569915c7ef2d2b6c33

    • C:\Windows\SysWOW64\WindowsInput.exe

      Filesize

      21KB

      MD5

      e6fcf516d8ed8d0d4427f86e08d0d435

      SHA1

      c7691731583ab7890086635cb7f3e4c22ca5e409

      SHA256

      8dbe814359391ed6b0b5b182039008cf1d00964da9fbc4747f46242a95c24337

      SHA512

      c496cf8e2e222fe1e19051b291e6860f31aae39f54369c1c5e8c9758c4b56e8af904e3e536e743a0a6fdbbf8478afba4baee92e13fc1b3073376ac6bf4a7948e

    • C:\Windows\SysWOW64\WindowsInput.exe.config

      Filesize

      357B

      MD5

      a2b76cea3a59fa9af5ea21ff68139c98

      SHA1

      35d76475e6a54c168f536e30206578babff58274

      SHA256

      f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839

      SHA512

      b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad

    • \??\c:\Users\Admin\AppData\Local\Temp\1czizdxl.0.cs

      Filesize

      208KB

      MD5

      3311d4c7ce60d3f026d3a46566efb616

      SHA1

      86d54f8e98fde711a34235ee59dd2a9452ff0ad7

      SHA256

      8919c9c518f7e06a63f878128142f23b4c6508d17233b271ef8f428dc0019f14

      SHA512

      5640ac4cd9b192b41d2283030c4c2b04061ecdd4a0eb153b9aff41267b0b184996553c7f5f5e28fd6cb711e4c6871e8e37fe73d44bd960995c5536705987986d

    • \??\c:\Users\Admin\AppData\Local\Temp\1czizdxl.cmdline

      Filesize

      349B

      MD5

      1af98284600f36e5183aaa7bf7cc5bc8

      SHA1

      16e9ee9ea433ea551b6a77ca37534c4d43d306d2

      SHA256

      b9fe93fe272b84da08a68c7eb9012737d90b1166975d27e8d8b25176d534a67d

      SHA512

      08fa13ca1bbde3509b5ccad8639414d2519e320f6cdab54c89d8eef9bf768b95091fe91d0b1b460b5ee02015b8058da3deeaa3144f615e3db4d0871328455f25

    • \??\c:\Users\Admin\AppData\Local\Temp\CSC54F6.tmp

      Filesize

      676B

      MD5

      b86b55ee570e968955b90d041d070d5e

      SHA1

      b3bd6d4892f63959d794a6d50d3380098745aeed

      SHA256

      eb0308cac4533eec1f1cc560a75505d7bbefa465f0dd37fee5e3be1c5e530096

      SHA512

      9ffba8b018a252f036ec56e239ddb0bcb49cd6a2e4f66cadaf420b69f0b858c65b11103ad9dbc7ed7b60c1fbdf5d2482afae3ba0559159f9f7e3a2883a52c46e

    • memory/832-90-0x0000000000700000-0x0000000000708000-memory.dmp

      Filesize

      32KB

    • memory/832-95-0x00000000746D0000-0x0000000074E80000-memory.dmp

      Filesize

      7.7MB

    • memory/832-91-0x00000000746D0000-0x0000000074E80000-memory.dmp

      Filesize

      7.7MB

    • memory/1152-43-0x0000000003070000-0x00000000030AC000-memory.dmp

      Filesize

      240KB

    • memory/1152-39-0x0000000000F60000-0x0000000000F6C000-memory.dmp

      Filesize

      48KB

    • memory/1152-42-0x000000001BBF0000-0x000000001BC00000-memory.dmp

      Filesize

      64KB

    • memory/1152-41-0x0000000003010000-0x0000000003022000-memory.dmp

      Filesize

      72KB

    • memory/1152-47-0x00007FF9AB2F0000-0x00007FF9ABDB1000-memory.dmp

      Filesize

      10.8MB

    • memory/1152-40-0x00007FF9AB2F0000-0x00007FF9ABDB1000-memory.dmp

      Filesize

      10.8MB

    • memory/1280-103-0x00000000746D0000-0x0000000074E80000-memory.dmp

      Filesize

      7.7MB

    • memory/1280-96-0x00000000746D0000-0x0000000074E80000-memory.dmp

      Filesize

      7.7MB

    • memory/1844-14-0x0000000000960000-0x0000000000970000-memory.dmp

      Filesize

      64KB

    • memory/2324-50-0x000000001AC00000-0x000000001AD0A000-memory.dmp

      Filesize

      1.0MB

    • memory/2324-49-0x00007FF9AB2F0000-0x00007FF9ABDB1000-memory.dmp

      Filesize

      10.8MB

    • memory/2324-100-0x000000001A6E0000-0x000000001A6F0000-memory.dmp

      Filesize

      64KB

    • memory/2324-99-0x00007FF9AB2F0000-0x00007FF9ABDB1000-memory.dmp

      Filesize

      10.8MB

    • memory/2680-71-0x000000001B210000-0x000000001B25E000-memory.dmp

      Filesize

      312KB

    • memory/2680-75-0x000000001C3B0000-0x000000001C3C0000-memory.dmp

      Filesize

      64KB

    • memory/2680-68-0x00000000005B0000-0x000000000069A000-memory.dmp

      Filesize

      936KB

    • memory/2680-70-0x000000001B200000-0x000000001B212000-memory.dmp

      Filesize

      72KB

    • memory/2680-67-0x00007FF9AB2F0000-0x00007FF9ABDB1000-memory.dmp

      Filesize

      10.8MB

    • memory/2680-69-0x000000001B2E0000-0x000000001B2F0000-memory.dmp

      Filesize

      64KB

    • memory/2680-102-0x000000001B2E0000-0x000000001B2F0000-memory.dmp

      Filesize

      64KB

    • memory/2680-73-0x000000001B2A0000-0x000000001B2B8000-memory.dmp

      Filesize

      96KB

    • memory/2680-101-0x00007FF9AB2F0000-0x00007FF9ABDB1000-memory.dmp

      Filesize

      10.8MB

    • memory/4040-25-0x000000001D030000-0x000000001D050000-memory.dmp

      Filesize

      128KB

    • memory/4040-7-0x000000001C460000-0x000000001C92E000-memory.dmp

      Filesize

      4.8MB

    • memory/4040-66-0x00007FF9ADEA0000-0x00007FF9AE841000-memory.dmp

      Filesize

      9.6MB

    • memory/4040-1-0x0000000001740000-0x0000000001750000-memory.dmp

      Filesize

      64KB

    • memory/4040-0-0x00007FF9ADEA0000-0x00007FF9AE841000-memory.dmp

      Filesize

      9.6MB

    • memory/4040-2-0x000000001BCE0000-0x000000001BD3C000-memory.dmp

      Filesize

      368KB

    • memory/4040-8-0x000000001C930000-0x000000001C9CC000-memory.dmp

      Filesize

      624KB

    • memory/4040-24-0x0000000001710000-0x0000000001722000-memory.dmp

      Filesize

      72KB

    • memory/4040-5-0x000000001BDE0000-0x000000001BDEE000-memory.dmp

      Filesize

      56KB

    • memory/4040-6-0x00007FF9ADEA0000-0x00007FF9AE841000-memory.dmp

      Filesize

      9.6MB

    • memory/4040-22-0x000000001CFF0000-0x000000001D006000-memory.dmp

      Filesize

      88KB

    • memory/4364-78-0x000000001B5C0000-0x000000001B5D0000-memory.dmp

      Filesize

      64KB

    • memory/4364-98-0x00007FF9AB2F0000-0x00007FF9ABDB1000-memory.dmp

      Filesize

      10.8MB

    • memory/4364-74-0x00007FF9AB2F0000-0x00007FF9ABDB1000-memory.dmp

      Filesize

      10.8MB