Analysis

  • max time kernel
    131s
  • max time network
    133s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    08-02-2024 01:33

General

  • Target

    5ab24737d60ad841c55bc85a30f2c9cfc876a1c54a7dd267c96b8f1cf3f80b45.exe

  • Size

    3.0MB

  • MD5

    74d76e40ed909ca7e1c84845502d4200

  • SHA1

    68e52a5e876d3ced0acf3be1dab2cfec279c13cd

  • SHA256

    5ab24737d60ad841c55bc85a30f2c9cfc876a1c54a7dd267c96b8f1cf3f80b45

  • SHA512

    4178e42e6548168ffc54f077665c3d39ce4261e1ae03774a8bdef7e00b226ddf5c24e1eb146cbce624e31bdd333089b0639caf1fa78af1649a3dd4f4897e5177

  • SSDEEP

    49152:Y1HS7p1EZKMnkmWg8LX5prviYDyKS5AypQxbRQAo9JnCmpbu/nRFfjI7L0qb:YUHTPJg8z1mKnypSbRxo9JCm

Malware Config

Extracted

Family

orcus

Botnet

Новый тег

C2

31.44.184.52:58576

Mutex

sudo_tlqmdzup58bzrjc1lr1vgx7o4bzyr68q

Attributes
  • autostart_method

    Disable

  • enable_keylogger

    false

  • install_path

    %appdata%\httpmultiasync\linuxapi.exe

  • reconnect_delay

    10000

  • registry_keyname

    Sudik

  • taskscheduler_taskname

    sudik

  • watchdog_path

    AppData\aga.exe

Signatures

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

  • Orcus main payload 2 IoCs
  • Orcurs Rat Executable 11 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 42 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5ab24737d60ad841c55bc85a30f2c9cfc876a1c54a7dd267c96b8f1cf3f80b45.exe
    "C:\Users\Admin\AppData\Local\Temp\5ab24737d60ad841c55bc85a30f2c9cfc876a1c54a7dd267c96b8f1cf3f80b45.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1948
    • C:\Users\Admin\AppData\Roaming\httpmultiasync\linuxapi.exe
      "C:\Users\Admin\AppData\Roaming\httpmultiasync\linuxapi.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2724
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
        3⤵
          PID:2884
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
          3⤵
            PID:2844
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2816
      • C:\Windows\system32\taskeng.exe
        taskeng.exe {96541568-88E5-4370-88A3-EEC4DA129719} S-1-5-21-3427588347-1492276948-3422228430-1000:QVMRJQQO\Admin:Interactive:[1]
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:2828
        • C:\Users\Admin\AppData\Roaming\httpmultiasync\linuxapi.exe
          C:\Users\Admin\AppData\Roaming\httpmultiasync\linuxapi.exe
          2⤵
          • Executes dropped EXE
          PID:2772
        • C:\Users\Admin\AppData\Roaming\httpmultiasync\linuxapi.exe
          C:\Users\Admin\AppData\Roaming\httpmultiasync\linuxapi.exe
          2⤵
          • Executes dropped EXE
          PID:2328
        • C:\Users\Admin\AppData\Roaming\httpmultiasync\linuxapi.exe
          C:\Users\Admin\AppData\Roaming\httpmultiasync\linuxapi.exe
          2⤵
          • Executes dropped EXE
          PID:2152

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\CabAA17.tmp

        Filesize

        65KB

        MD5

        ac05d27423a85adc1622c714f2cb6184

        SHA1

        b0fe2b1abddb97837ea0195be70ab2ff14d43198

        SHA256

        c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

        SHA512

        6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

      • C:\Users\Admin\AppData\Roaming\httpmultiasync\linuxapi.exe

        Filesize

        3.0MB

        MD5

        74d76e40ed909ca7e1c84845502d4200

        SHA1

        68e52a5e876d3ced0acf3be1dab2cfec279c13cd

        SHA256

        5ab24737d60ad841c55bc85a30f2c9cfc876a1c54a7dd267c96b8f1cf3f80b45

        SHA512

        4178e42e6548168ffc54f077665c3d39ce4261e1ae03774a8bdef7e00b226ddf5c24e1eb146cbce624e31bdd333089b0639caf1fa78af1649a3dd4f4897e5177

      • C:\Users\Admin\AppData\Roaming\httpmultiasync\linuxapi.exe.config

        Filesize

        357B

        MD5

        a2b76cea3a59fa9af5ea21ff68139c98

        SHA1

        35d76475e6a54c168f536e30206578babff58274

        SHA256

        f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839

        SHA512

        b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad

      • \Users\Admin\AppData\Roaming\httpmultiasync\linuxapi.exe

        Filesize

        2.6MB

        MD5

        f7f991ab98e4011b4f8b1ba5d76c86d7

        SHA1

        6161a121f2f213286585ee8afb414cb7ddf9a2c2

        SHA256

        d09027e28bae6a00a7593b742cf4980bfd48994bfd50af71c673ca72a2a9524c

        SHA512

        88379ff55df6e47ed3398b59e325d82acaf05f7e4c862953f0dcc21f8c892e804fef0d02229c1038adba4e09e445b0a73713452ab8094ec96bdf6f27cbbcb92c

      • memory/1948-4-0x0000000000A00000-0x0000000000A5C000-memory.dmp

        Filesize

        368KB

      • memory/1948-5-0x0000000000400000-0x0000000000412000-memory.dmp

        Filesize

        72KB

      • memory/1948-0-0x0000000001020000-0x000000000131E000-memory.dmp

        Filesize

        3.0MB

      • memory/1948-3-0x0000000000210000-0x000000000021E000-memory.dmp

        Filesize

        56KB

      • memory/1948-2-0x0000000004A80000-0x0000000004AC0000-memory.dmp

        Filesize

        256KB

      • memory/1948-1-0x0000000074570000-0x0000000074C5E000-memory.dmp

        Filesize

        6.9MB

      • memory/1948-18-0x0000000074570000-0x0000000074C5E000-memory.dmp

        Filesize

        6.9MB

      • memory/2152-72-0x0000000000270000-0x00000000002B0000-memory.dmp

        Filesize

        256KB

      • memory/2152-71-0x0000000074570000-0x0000000074C5E000-memory.dmp

        Filesize

        6.9MB

      • memory/2152-70-0x0000000000E50000-0x000000000114E000-memory.dmp

        Filesize

        3.0MB

      • memory/2152-73-0x0000000074570000-0x0000000074C5E000-memory.dmp

        Filesize

        6.9MB

      • memory/2328-68-0x0000000074570000-0x0000000074C5E000-memory.dmp

        Filesize

        6.9MB

      • memory/2328-67-0x0000000004B40000-0x0000000004B80000-memory.dmp

        Filesize

        256KB

      • memory/2328-66-0x0000000000E20000-0x000000000111E000-memory.dmp

        Filesize

        3.0MB

      • memory/2328-65-0x0000000074570000-0x0000000074C5E000-memory.dmp

        Filesize

        6.9MB

      • memory/2724-34-0x0000000074570000-0x0000000074C5E000-memory.dmp

        Filesize

        6.9MB

      • memory/2724-16-0x0000000074570000-0x0000000074C5E000-memory.dmp

        Filesize

        6.9MB

      • memory/2724-17-0x00000000008F0000-0x0000000000BEE000-memory.dmp

        Filesize

        3.0MB

      • memory/2724-19-0x0000000004B60000-0x0000000004BA0000-memory.dmp

        Filesize

        256KB

      • memory/2724-20-0x00000000007F0000-0x0000000000802000-memory.dmp

        Filesize

        72KB

      • memory/2724-21-0x0000000002180000-0x00000000021CE000-memory.dmp

        Filesize

        312KB

      • memory/2772-59-0x0000000074570000-0x0000000074C5E000-memory.dmp

        Filesize

        6.9MB

      • memory/2772-38-0x00000000005C0000-0x0000000000600000-memory.dmp

        Filesize

        256KB

      • memory/2772-25-0x0000000074570000-0x0000000074C5E000-memory.dmp

        Filesize

        6.9MB

      • memory/2816-60-0x0000000004B30000-0x0000000004B70000-memory.dmp

        Filesize

        256KB

      • memory/2816-63-0x0000000004B30000-0x0000000004B70000-memory.dmp

        Filesize

        256KB

      • memory/2816-28-0x0000000000400000-0x00000000006FE000-memory.dmp

        Filesize

        3.0MB

      • memory/2816-41-0x0000000000740000-0x0000000000758000-memory.dmp

        Filesize

        96KB

      • memory/2816-30-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

        Filesize

        4KB

      • memory/2816-61-0x0000000074570000-0x0000000074C5E000-memory.dmp

        Filesize

        6.9MB

      • memory/2816-62-0x0000000004B30000-0x0000000004B70000-memory.dmp

        Filesize

        256KB

      • memory/2816-42-0x0000000000860000-0x0000000000870000-memory.dmp

        Filesize

        64KB

      • memory/2816-26-0x0000000000400000-0x00000000006FE000-memory.dmp

        Filesize

        3.0MB

      • memory/2816-40-0x0000000004B30000-0x0000000004B70000-memory.dmp

        Filesize

        256KB

      • memory/2816-23-0x0000000000400000-0x00000000006FE000-memory.dmp

        Filesize

        3.0MB

      • memory/2816-39-0x0000000074570000-0x0000000074C5E000-memory.dmp

        Filesize

        6.9MB

      • memory/2816-37-0x0000000000400000-0x00000000006FE000-memory.dmp

        Filesize

        3.0MB

      • memory/2816-35-0x0000000000400000-0x00000000006FE000-memory.dmp

        Filesize

        3.0MB

      • memory/2816-29-0x0000000000400000-0x00000000006FE000-memory.dmp

        Filesize

        3.0MB

      • memory/2816-32-0x0000000000400000-0x00000000006FE000-memory.dmp

        Filesize

        3.0MB