Analysis
-
max time kernel
135s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
07-02-2024 02:54
Behavioral task
behavioral1
Sample
7fa210b3f0cf860121a9c5cc44f92a330e04dbb7e89deb113c21687e9ae29775.exe
Resource
win7-20231215-en
General
-
Target
7fa210b3f0cf860121a9c5cc44f92a330e04dbb7e89deb113c21687e9ae29775.exe
-
Size
3.0MB
-
MD5
f250b617f96b16057d1ca4a2539b7f99
-
SHA1
ec6cd5efabe7dc98b62a8120d47d0417e0d335c6
-
SHA256
7fa210b3f0cf860121a9c5cc44f92a330e04dbb7e89deb113c21687e9ae29775
-
SHA512
2265b4557d5a22987e341ccc60b74efeac1c31403a9d9fb0143018450ce4e49c68f4c3af4c9ba77dc73f89bc8a2898790212065464f4370d44b70552d9d28816
-
SSDEEP
49152:Y1HS7p1EZKMnkmWg8LX5prviYDyKS5AypQxbRQAo9JnCmpbu/nRFfjI7L0qb:YUHTPJg8z1mKnypSbRxo9JCm
Malware Config
Extracted
orcus
Новый тег
31.44.184.52:58029
aaax6va698fwvwnskxxhhiv7p2n6j5erbcly
-
autostart_method
Disable
-
enable_keylogger
false
-
install_path
%appdata%\wpprivatepacket\jsrequest.exe
-
reconnect_delay
10000
-
registry_keyname
Sudik
-
taskscheduler_taskname
sudik
-
watchdog_path
AppData\aga.exe
Signatures
-
Orcus main payload 1 IoCs
resource yara_rule behavioral1/files/0x000d0000000122e4-10.dat family_orcus -
Orcurs Rat Executable 10 IoCs
resource yara_rule behavioral1/memory/2720-0-0x0000000000BE0000-0x0000000000EDE000-memory.dmp orcus behavioral1/files/0x000d0000000122e4-10.dat orcus behavioral1/memory/2776-17-0x0000000000200000-0x00000000004FE000-memory.dmp orcus behavioral1/memory/2940-28-0x0000000000400000-0x00000000006FE000-memory.dmp orcus behavioral1/memory/2940-30-0x0000000000400000-0x00000000006FE000-memory.dmp orcus behavioral1/memory/2940-33-0x0000000000400000-0x00000000006FE000-memory.dmp orcus behavioral1/memory/2940-35-0x0000000000400000-0x00000000006FE000-memory.dmp orcus behavioral1/memory/2940-38-0x0000000000400000-0x00000000006FE000-memory.dmp orcus behavioral1/memory/396-86-0x0000000000210000-0x000000000050E000-memory.dmp orcus behavioral1/memory/1392-91-0x0000000000F00000-0x00000000011FE000-memory.dmp orcus -
Executes dropped EXE 4 IoCs
pid Process 2776 jsrequest.exe 2672 jsrequest.exe 396 jsrequest.exe 1392 jsrequest.exe -
Loads dropped DLL 1 IoCs
pid Process 2720 7fa210b3f0cf860121a9c5cc44f92a330e04dbb7e89deb113c21687e9ae29775.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2776 set thread context of 2940 2776 jsrequest.exe 30 PID 2672 set thread context of 2020 2672 jsrequest.exe 33 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
pid Process 2720 7fa210b3f0cf860121a9c5cc44f92a330e04dbb7e89deb113c21687e9ae29775.exe 2776 jsrequest.exe 2776 jsrequest.exe 2672 jsrequest.exe 2672 jsrequest.exe 2672 jsrequest.exe 2672 jsrequest.exe 2940 msbuild.exe 2940 msbuild.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2720 7fa210b3f0cf860121a9c5cc44f92a330e04dbb7e89deb113c21687e9ae29775.exe Token: SeDebugPrivilege 2776 jsrequest.exe Token: SeDebugPrivilege 2672 jsrequest.exe Token: SeDebugPrivilege 2940 msbuild.exe -
Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 2720 wrote to memory of 2776 2720 7fa210b3f0cf860121a9c5cc44f92a330e04dbb7e89deb113c21687e9ae29775.exe 28 PID 2720 wrote to memory of 2776 2720 7fa210b3f0cf860121a9c5cc44f92a330e04dbb7e89deb113c21687e9ae29775.exe 28 PID 2720 wrote to memory of 2776 2720 7fa210b3f0cf860121a9c5cc44f92a330e04dbb7e89deb113c21687e9ae29775.exe 28 PID 2720 wrote to memory of 2776 2720 7fa210b3f0cf860121a9c5cc44f92a330e04dbb7e89deb113c21687e9ae29775.exe 28 PID 2568 wrote to memory of 2672 2568 taskeng.exe 31 PID 2568 wrote to memory of 2672 2568 taskeng.exe 31 PID 2568 wrote to memory of 2672 2568 taskeng.exe 31 PID 2568 wrote to memory of 2672 2568 taskeng.exe 31 PID 2776 wrote to memory of 2940 2776 jsrequest.exe 30 PID 2776 wrote to memory of 2940 2776 jsrequest.exe 30 PID 2776 wrote to memory of 2940 2776 jsrequest.exe 30 PID 2776 wrote to memory of 2940 2776 jsrequest.exe 30 PID 2776 wrote to memory of 2940 2776 jsrequest.exe 30 PID 2776 wrote to memory of 2940 2776 jsrequest.exe 30 PID 2776 wrote to memory of 2940 2776 jsrequest.exe 30 PID 2776 wrote to memory of 2940 2776 jsrequest.exe 30 PID 2776 wrote to memory of 2940 2776 jsrequest.exe 30 PID 2672 wrote to memory of 2512 2672 jsrequest.exe 32 PID 2672 wrote to memory of 2512 2672 jsrequest.exe 32 PID 2672 wrote to memory of 2512 2672 jsrequest.exe 32 PID 2672 wrote to memory of 2512 2672 jsrequest.exe 32 PID 2672 wrote to memory of 2512 2672 jsrequest.exe 32 PID 2672 wrote to memory of 2512 2672 jsrequest.exe 32 PID 2672 wrote to memory of 2512 2672 jsrequest.exe 32 PID 2672 wrote to memory of 2020 2672 jsrequest.exe 33 PID 2672 wrote to memory of 2020 2672 jsrequest.exe 33 PID 2672 wrote to memory of 2020 2672 jsrequest.exe 33 PID 2672 wrote to memory of 2020 2672 jsrequest.exe 33 PID 2672 wrote to memory of 2020 2672 jsrequest.exe 33 PID 2672 wrote to memory of 2020 2672 jsrequest.exe 33 PID 2672 wrote to memory of 2020 2672 jsrequest.exe 33 PID 2672 wrote to memory of 2020 2672 jsrequest.exe 33 PID 2672 wrote to memory of 2020 2672 jsrequest.exe 33 PID 2672 wrote to memory of 2020 2672 jsrequest.exe 33 PID 2672 wrote to memory of 2020 2672 jsrequest.exe 33 PID 2672 wrote to memory of 2020 2672 jsrequest.exe 33 PID 2568 wrote to memory of 396 2568 taskeng.exe 38 PID 2568 wrote to memory of 396 2568 taskeng.exe 38 PID 2568 wrote to memory of 396 2568 taskeng.exe 38 PID 2568 wrote to memory of 396 2568 taskeng.exe 38 PID 2568 wrote to memory of 1392 2568 taskeng.exe 39 PID 2568 wrote to memory of 1392 2568 taskeng.exe 39 PID 2568 wrote to memory of 1392 2568 taskeng.exe 39 PID 2568 wrote to memory of 1392 2568 taskeng.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\7fa210b3f0cf860121a9c5cc44f92a330e04dbb7e89deb113c21687e9ae29775.exe"C:\Users\Admin\AppData\Local\Temp\7fa210b3f0cf860121a9c5cc44f92a330e04dbb7e89deb113c21687e9ae29775.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Roaming\wpprivatepacket\jsrequest.exe"C:\Users\Admin\AppData\Roaming\wpprivatepacket\jsrequest.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2940
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {F16DFAFF-45A5-413E-A1EA-F0DA368265DA} S-1-5-21-3427588347-1492276948-3422228430-1000:QVMRJQQO\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Roaming\wpprivatepacket\jsrequest.exeC:\Users\Admin\AppData\Roaming\wpprivatepacket\jsrequest.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"3⤵PID:2512
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"3⤵PID:2020
-
-
-
C:\Users\Admin\AppData\Roaming\wpprivatepacket\jsrequest.exeC:\Users\Admin\AppData\Roaming\wpprivatepacket\jsrequest.exe2⤵
- Executes dropped EXE
PID:396
-
-
C:\Users\Admin\AppData\Roaming\wpprivatepacket\jsrequest.exeC:\Users\Admin\AppData\Roaming\wpprivatepacket\jsrequest.exe2⤵
- Executes dropped EXE
PID:1392
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
357B
MD5a2b76cea3a59fa9af5ea21ff68139c98
SHA135d76475e6a54c168f536e30206578babff58274
SHA256f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839
SHA512b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad
-
Filesize
3.0MB
MD5f250b617f96b16057d1ca4a2539b7f99
SHA1ec6cd5efabe7dc98b62a8120d47d0417e0d335c6
SHA2567fa210b3f0cf860121a9c5cc44f92a330e04dbb7e89deb113c21687e9ae29775
SHA5122265b4557d5a22987e341ccc60b74efeac1c31403a9d9fb0143018450ce4e49c68f4c3af4c9ba77dc73f89bc8a2898790212065464f4370d44b70552d9d28816