Analysis

  • max time kernel
    127s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-02-2024 01:33

General

  • Target

    5ab24737d60ad841c55bc85a30f2c9cfc876a1c54a7dd267c96b8f1cf3f80b45.exe

  • Size

    3.0MB

  • MD5

    74d76e40ed909ca7e1c84845502d4200

  • SHA1

    68e52a5e876d3ced0acf3be1dab2cfec279c13cd

  • SHA256

    5ab24737d60ad841c55bc85a30f2c9cfc876a1c54a7dd267c96b8f1cf3f80b45

  • SHA512

    4178e42e6548168ffc54f077665c3d39ce4261e1ae03774a8bdef7e00b226ddf5c24e1eb146cbce624e31bdd333089b0639caf1fa78af1649a3dd4f4897e5177

  • SSDEEP

    49152:Y1HS7p1EZKMnkmWg8LX5prviYDyKS5AypQxbRQAo9JnCmpbu/nRFfjI7L0qb:YUHTPJg8z1mKnypSbRxo9JCm

Malware Config

Extracted

Family

orcus

Botnet

Новый тег

C2

31.44.184.52:58576

Mutex

sudo_tlqmdzup58bzrjc1lr1vgx7o4bzyr68q

Attributes
  • autostart_method

    Disable

  • enable_keylogger

    false

  • install_path

    %appdata%\httpmultiasync\linuxapi.exe

  • reconnect_delay

    10000

  • registry_keyname

    Sudik

  • taskscheduler_taskname

    sudik

  • watchdog_path

    AppData\aga.exe

Signatures

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

  • Orcus main payload 6 IoCs
  • Orcurs Rat Executable 7 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5ab24737d60ad841c55bc85a30f2c9cfc876a1c54a7dd267c96b8f1cf3f80b45.exe
    "C:\Users\Admin\AppData\Local\Temp\5ab24737d60ad841c55bc85a30f2c9cfc876a1c54a7dd267c96b8f1cf3f80b45.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4548
    • C:\Users\Admin\AppData\Roaming\httpmultiasync\linuxapi.exe
      "C:\Users\Admin\AppData\Roaming\httpmultiasync\linuxapi.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3216
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
        3⤵
          PID:2520
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
          3⤵
            PID:180
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1672
      • C:\Users\Admin\AppData\Roaming\httpmultiasync\linuxapi.exe
        C:\Users\Admin\AppData\Roaming\httpmultiasync\linuxapi.exe
        1⤵
        • Executes dropped EXE
        PID:1208
      • C:\Users\Admin\AppData\Roaming\httpmultiasync\linuxapi.exe
        C:\Users\Admin\AppData\Roaming\httpmultiasync\linuxapi.exe
        1⤵
        • Executes dropped EXE
        PID:3276
      • C:\Users\Admin\AppData\Roaming\httpmultiasync\linuxapi.exe
        C:\Users\Admin\AppData\Roaming\httpmultiasync\linuxapi.exe
        1⤵
        • Executes dropped EXE
        PID:2884

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\linuxapi.exe.log

        Filesize

        1KB

        MD5

        663b8d5469caa4489d463aa9bc18124f

        SHA1

        e57123a7d969115853ea631a3b33826335025d28

        SHA256

        7b4fa505452f0b8ac74bb31f5a03b13342836318018fb18d224ae2ff11b1a7e8

        SHA512

        45e373295125a629fcc0b19609608d969c9106514918bfac5d6b8e340e407434577b825741b8fa6a043c8f3f5c1a030ba8857da5f4e8ef15a551ce3c5fe03b55

      • C:\Users\Admin\AppData\Roaming\httpmultiasync\linuxapi.exe

        Filesize

        1.1MB

        MD5

        2a9d1009e59680f73b7b315491e7b78f

        SHA1

        5fe5b17c577baccaa91e56725c73ed0d80e58628

        SHA256

        d699a9a85b358e657f0f1287f357c64c4cf82aab375446629102bbcb4ab0c7e4

        SHA512

        3eb641a3d04182a73ca7dbf6174412cf0afc8769572f93ed67ff5cfae9018aa89fef40feb990880c9266962b163a0aff01a7b8724079c639338064646c2f79e3

      • C:\Users\Admin\AppData\Roaming\httpmultiasync\linuxapi.exe

        Filesize

        698KB

        MD5

        a62f10244bfc7ac326c3f1509633d837

        SHA1

        78718eccad87a529d0ce497ea2dcc151075fc170

        SHA256

        e8a0a2db481aed0f0c969f7a112c6068a910e4e7b9e2301c02b68fafdc6c121c

        SHA512

        93a1946843927f8e98617d6383c8ed100cc0e61c849b07cc755a61ea898254a60ebb290b20abce0d2aa35014a823c1e26ceafe0cf3901ac767df8cd66d372488

      • C:\Users\Admin\AppData\Roaming\httpmultiasync\linuxapi.exe

        Filesize

        923KB

        MD5

        f10c627484d209f98d62332cc20af71d

        SHA1

        c0387c1bdcc41d1e95c6d2c3e6324046c2a1ed65

        SHA256

        95507ba52cfea43c0bbd1d78656660816267bf3608f6a3b495c913d9a7069d7e

        SHA512

        280dd97829e49fef4cd4adebe8b7d91ae5726018e852267b96d8da951517670270a92731a2df8185320bcdba27832cb33c4b5c2702913fc212db79ac6468205d

      • C:\Users\Admin\AppData\Roaming\httpmultiasync\linuxapi.exe

        Filesize

        448KB

        MD5

        ea30aef27161241655b98f5f14b5917a

        SHA1

        ab7c954cb58ae8306708f434085eec06dfdf93c8

        SHA256

        e3df5826de0c88f30761eadc33d9048194c9cfc5e946b031e9603fb124fb08db

        SHA512

        995a26afb367ef328057da35e43d2539fd922680dc8bd64ec6721501a174c57c7bf2c735a94286967b9f4a508031cd7ed2ebd9c6c18cd1361c809b1f00a64037

      • C:\Users\Admin\AppData\Roaming\httpmultiasync\linuxapi.exe

        Filesize

        174KB

        MD5

        211a8427d5f87809aa121e5306a9d541

        SHA1

        ee3bc008d806224ea29e9ae9f0b3aafa9f424741

        SHA256

        23ba6e789edef4ee3e478e7ff70d3af4256460ef51503b5f8841cf7388ea80ee

        SHA512

        28c221c85a0c89bfc4c3217c4ceefc9c7e0440d3d8a7ee60efe6cbe210cdf8756a33ecc2518b72c57e6dcdeeef72744a2ab72a5e937f1843b9355f0fd5935953

      • C:\Users\Admin\AppData\Roaming\httpmultiasync\linuxapi.exe

        Filesize

        597KB

        MD5

        d5d7c73cb9fcf38f74239627588bfed3

        SHA1

        84774a93e5cb0ac519a1094b0d2f00d6c678e263

        SHA256

        165c24b04d51fa8602c4075cc9dfc9e7d818ca3dd33c151ea92647b8096ed22b

        SHA512

        e329028c33ca6db03d4a902e3212c6ad8ba42f273a70d2bc3b676d9aeba60578cb4fe042b4c0f6e4bfd3d46e8f1cda71761220490b91957cd9cb7fd3be43827c

      • C:\Users\Admin\AppData\Roaming\httpmultiasync\linuxapi.exe.config

        Filesize

        357B

        MD5

        a2b76cea3a59fa9af5ea21ff68139c98

        SHA1

        35d76475e6a54c168f536e30206578babff58274

        SHA256

        f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839

        SHA512

        b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad

      • memory/1208-30-0x0000000074A80000-0x0000000075230000-memory.dmp

        Filesize

        7.7MB

      • memory/1208-49-0x0000000074A80000-0x0000000075230000-memory.dmp

        Filesize

        7.7MB

      • memory/1208-35-0x0000000005E00000-0x0000000005E10000-memory.dmp

        Filesize

        64KB

      • memory/1672-50-0x0000000074A80000-0x0000000075230000-memory.dmp

        Filesize

        7.7MB

      • memory/1672-51-0x0000000005770000-0x0000000005780000-memory.dmp

        Filesize

        64KB

      • memory/1672-47-0x0000000008150000-0x0000000008312000-memory.dmp

        Filesize

        1.8MB

      • memory/1672-46-0x00000000077E0000-0x00000000078EA000-memory.dmp

        Filesize

        1.0MB

      • memory/1672-42-0x0000000007B30000-0x0000000008148000-memory.dmp

        Filesize

        6.1MB

      • memory/1672-45-0x0000000007650000-0x000000000769C000-memory.dmp

        Filesize

        304KB

      • memory/1672-41-0x00000000074A0000-0x0000000007506000-memory.dmp

        Filesize

        408KB

      • memory/1672-43-0x00000000075B0000-0x00000000075C2000-memory.dmp

        Filesize

        72KB

      • memory/1672-38-0x0000000006C00000-0x0000000006C0A000-memory.dmp

        Filesize

        40KB

      • memory/1672-44-0x0000000007610000-0x000000000764C000-memory.dmp

        Filesize

        240KB

      • memory/1672-33-0x0000000074A80000-0x0000000075230000-memory.dmp

        Filesize

        7.7MB

      • memory/1672-37-0x0000000005FD0000-0x0000000005FE0000-memory.dmp

        Filesize

        64KB

      • memory/1672-36-0x0000000005F40000-0x0000000005F58000-memory.dmp

        Filesize

        96KB

      • memory/2884-59-0x0000000074A80000-0x0000000075230000-memory.dmp

        Filesize

        7.7MB

      • memory/2884-58-0x0000000005890000-0x00000000058A0000-memory.dmp

        Filesize

        64KB

      • memory/2884-57-0x0000000074A80000-0x0000000075230000-memory.dmp

        Filesize

        7.7MB

      • memory/3216-29-0x0000000005E60000-0x0000000005EFC000-memory.dmp

        Filesize

        624KB

      • memory/3216-26-0x0000000005040000-0x0000000005052000-memory.dmp

        Filesize

        72KB

      • memory/3216-34-0x0000000074A80000-0x0000000075230000-memory.dmp

        Filesize

        7.7MB

      • memory/3216-27-0x0000000005500000-0x000000000554E000-memory.dmp

        Filesize

        312KB

      • memory/3216-25-0x0000000004CD0000-0x0000000004CE0000-memory.dmp

        Filesize

        64KB

      • memory/3216-23-0x0000000074A80000-0x0000000075230000-memory.dmp

        Filesize

        7.7MB

      • memory/3276-53-0x0000000074A80000-0x0000000075230000-memory.dmp

        Filesize

        7.7MB

      • memory/3276-54-0x00000000057D0000-0x00000000057E0000-memory.dmp

        Filesize

        64KB

      • memory/3276-55-0x0000000074A80000-0x0000000075230000-memory.dmp

        Filesize

        7.7MB

      • memory/4548-0-0x0000000000B70000-0x0000000000E6E000-memory.dmp

        Filesize

        3.0MB

      • memory/4548-7-0x0000000005C00000-0x0000000005C12000-memory.dmp

        Filesize

        72KB

      • memory/4548-24-0x0000000074A80000-0x0000000075230000-memory.dmp

        Filesize

        7.7MB

      • memory/4548-2-0x00000000057B0000-0x00000000057C0000-memory.dmp

        Filesize

        64KB

      • memory/4548-5-0x0000000006130000-0x00000000066D4000-memory.dmp

        Filesize

        5.6MB

      • memory/4548-1-0x0000000074A80000-0x0000000075230000-memory.dmp

        Filesize

        7.7MB

      • memory/4548-4-0x0000000005830000-0x000000000588C000-memory.dmp

        Filesize

        368KB

      • memory/4548-6-0x0000000005C20000-0x0000000005CB2000-memory.dmp

        Filesize

        584KB

      • memory/4548-3-0x0000000003110000-0x000000000311E000-memory.dmp

        Filesize

        56KB