Analysis
-
max time kernel
56s -
max time network
57s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
08-02-2024 13:36
Behavioral task
behavioral1
Sample
rat.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
rat.exe
Resource
win10v2004-20231222-en
General
-
Target
rat.exe
-
Size
1.8MB
-
MD5
8ad0919a0ee7cba7298d009d4b58e3ff
-
SHA1
f75c3c9f06aa11b72db556d259b40a11d685ac11
-
SHA256
798159895032344c910b1d937ebda40fafeb2c657e3039c49c0999d77a73f75f
-
SHA512
23d50fc6006cb610a35cacdf29fee5a074993eb3b3e3f3746d78e9c621fb41c7ac0dda24fd4be4412b3a9915fd93cd1f46fa6f7a476bf53a8cee370939a2a064
-
SSDEEP
49152:kJuHrhm4SEHZF6qXyoU7Ej44FoGl3RRZr7NoazWVgUIRFSO1SSQ:CMrh3JHZF6VoUoj4+7fNo
Malware Config
Signatures
-
Orcus main payload 3 IoCs
resource yara_rule behavioral1/files/0x0007000000014498-28.dat family_orcus behavioral1/files/0x0007000000014498-31.dat family_orcus behavioral1/files/0x0007000000014498-42.dat family_orcus -
Orcurs Rat Executable 5 IoCs
resource yara_rule behavioral1/memory/2024-0-0x00000000003A0000-0x00000000006F8000-memory.dmp orcus behavioral1/files/0x0007000000014498-28.dat orcus behavioral1/files/0x0007000000014498-31.dat orcus behavioral1/memory/2584-35-0x0000000001190000-0x00000000014E8000-memory.dmp orcus behavioral1/files/0x0007000000014498-42.dat orcus -
Executes dropped EXE 7 IoCs
pid Process 2876 WindowsInput.exe 2624 WindowsInput.exe 2584 Orcus.exe 580 Orcus.exe 2984 Sys322.exe 1040 Sys322.exe 2440 WindowsInput.exe -
Loads dropped DLL 3 IoCs
pid Process 2024 rat.exe 2024 rat.exe 2584 Orcus.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\System3222 = "\"C:\\Program Files (x86)\\Orcus\\Orcus.exe\"" Orcus.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs
flow ioc 2 4.tcp.eu.ngrok.io -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\WindowsInput.exe.config rat.exe File created C:\Windows\SysWOW64\WindowsInput.InstallState WindowsInput.exe File created C:\Windows\SysWOW64\WindowsInput.exe rat.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
pid Process 2024 rat.exe 2024 rat.exe 2584 Orcus.exe 2584 Orcus.exe 580 Orcus.exe 580 Orcus.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files (x86)\Orcus\Orcus.exe rat.exe File opened for modification C:\Program Files (x86)\Orcus\Orcus.exe rat.exe File created C:\Program Files (x86)\Orcus\Orcus.exe.config rat.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2584 Orcus.exe 2584 Orcus.exe 1040 Sys322.exe 1040 Sys322.exe 2584 Orcus.exe 1040 Sys322.exe 2584 Orcus.exe 1040 Sys322.exe 2584 Orcus.exe 1040 Sys322.exe 2584 Orcus.exe 1040 Sys322.exe 2584 Orcus.exe 1040 Sys322.exe 2584 Orcus.exe 1040 Sys322.exe 2584 Orcus.exe 1040 Sys322.exe 2584 Orcus.exe 1040 Sys322.exe 2584 Orcus.exe 1040 Sys322.exe 2584 Orcus.exe 1040 Sys322.exe 2584 Orcus.exe 1040 Sys322.exe 2584 Orcus.exe 1040 Sys322.exe 2584 Orcus.exe 1040 Sys322.exe 2584 Orcus.exe 1040 Sys322.exe 2584 Orcus.exe 1040 Sys322.exe 2584 Orcus.exe 1040 Sys322.exe 2584 Orcus.exe 1040 Sys322.exe 1040 Sys322.exe 2584 Orcus.exe 2584 Orcus.exe 1040 Sys322.exe 2584 Orcus.exe 1040 Sys322.exe 2584 Orcus.exe 1040 Sys322.exe 1040 Sys322.exe 2584 Orcus.exe 2584 Orcus.exe 1040 Sys322.exe 2584 Orcus.exe 1040 Sys322.exe 2584 Orcus.exe 1040 Sys322.exe 2584 Orcus.exe 1040 Sys322.exe 2584 Orcus.exe 1040 Sys322.exe 1040 Sys322.exe 2584 Orcus.exe 2584 Orcus.exe 1040 Sys322.exe 1040 Sys322.exe 2584 Orcus.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2584 Orcus.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2584 Orcus.exe Token: SeDebugPrivilege 2984 Sys322.exe Token: SeDebugPrivilege 1040 Sys322.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2584 Orcus.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 2584 Orcus.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2584 Orcus.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 2024 wrote to memory of 2876 2024 rat.exe 28 PID 2024 wrote to memory of 2876 2024 rat.exe 28 PID 2024 wrote to memory of 2876 2024 rat.exe 28 PID 2024 wrote to memory of 2876 2024 rat.exe 28 PID 2024 wrote to memory of 2584 2024 rat.exe 30 PID 2024 wrote to memory of 2584 2024 rat.exe 30 PID 2024 wrote to memory of 2584 2024 rat.exe 30 PID 2024 wrote to memory of 2584 2024 rat.exe 30 PID 312 wrote to memory of 580 312 taskeng.exe 32 PID 312 wrote to memory of 580 312 taskeng.exe 32 PID 312 wrote to memory of 580 312 taskeng.exe 32 PID 312 wrote to memory of 580 312 taskeng.exe 32 PID 2584 wrote to memory of 2984 2584 Orcus.exe 33 PID 2584 wrote to memory of 2984 2584 Orcus.exe 33 PID 2584 wrote to memory of 2984 2584 Orcus.exe 33 PID 2584 wrote to memory of 2984 2584 Orcus.exe 33 PID 2984 wrote to memory of 1040 2984 Sys322.exe 34 PID 2984 wrote to memory of 1040 2984 Sys322.exe 34 PID 2984 wrote to memory of 1040 2984 Sys322.exe 34 PID 2984 wrote to memory of 1040 2984 Sys322.exe 34 PID 2584 wrote to memory of 2440 2584 Orcus.exe 38 PID 2584 wrote to memory of 2440 2584 Orcus.exe 38 PID 2584 wrote to memory of 2440 2584 Orcus.exe 38 PID 2584 wrote to memory of 2440 2584 Orcus.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\rat.exe"C:\Users\Admin\AppData\Local\Temp\rat.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Windows\SysWOW64\WindowsInput.exe"C:\Windows\SysWOW64\WindowsInput.exe" --install2⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2876
-
-
C:\Program Files (x86)\Orcus\Orcus.exe"C:\Program Files (x86)\Orcus\Orcus.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Users\Admin\AppData\Roaming\Sys322.exe"C:\Users\Admin\AppData\Roaming\Sys322.exe" /launchSelfAndExit "C:\Program Files (x86)\Orcus\Orcus.exe" 2584 /protectFile3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Users\Admin\AppData\Roaming\Sys322.exe"C:\Users\Admin\AppData\Roaming\Sys322.exe" /watchProcess "C:\Program Files (x86)\Orcus\Orcus.exe" 2584 "/protectFile"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1040
-
-
-
C:\Windows\SysWOW64\WindowsInput.exe"C:\Windows\SysWOW64\WindowsInput.exe" --uninstall3⤵
- Executes dropped EXE
PID:2440
-
-
-
C:\Windows\SysWOW64\WindowsInput.exe"C:\Windows\SysWOW64\WindowsInput.exe"1⤵
- Executes dropped EXE
PID:2624
-
C:\Windows\system32\taskeng.exetaskeng.exe {9C398233-D4B1-4920-8ABC-3D7318E3E3DE} S-1-5-21-3427588347-1492276948-3422228430-1000:QVMRJQQO\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:312 -
C:\Program Files (x86)\Orcus\Orcus.exe"C:\Program Files (x86)\Orcus\Orcus.exe"2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:580
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD59e1fdeb0ff2bcf2afca7e7da091a44ba
SHA18329b70558a79140c190c325ff1990e910c1dea9
SHA2562aeed035d7aa468be500300f8440fcafd8f3fa6cd8f5c829a6cb7e393f2e6f66
SHA512ab97db50c7c5ecd30c4fd41a43e7ff1e879f078563e36b0086affe8318a2de90d6e48cc6c757ac996a8c0fea43da7adc954d9be97a37eab06c7309a62fa86027
-
Filesize
1.4MB
MD5f72483cf4a86e3307366f6ae8caffcdc
SHA1810bcddf592e49c110d8526d8144a34680e32f71
SHA256e53589e8d842bc7a45ece8333903c72cbdfd334328262317556a64d55d1ec493
SHA512a95e4bd523ae85a9ae5cb76d2d2bf31965c5ed17b36876d64294cffa2736b43a6aaf9f902120ab68a4c41047058e15e37274061a51fa0d63c4c0c98e2b58768a
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
7KB
MD5362ce475f5d1e84641bad999c16727a0
SHA16b613c73acb58d259c6379bd820cca6f785cc812
SHA2561f78f1056761c6ebd8965ed2c06295bafa704b253aff56c492b93151ab642899
SHA5127630e1629cf4abecd9d3ddea58227b232d5c775cb480967762a6a6466be872e1d57123b08a6179fe1cfbc09403117d0f81bc13724f259a1d25c1325f1eac645b
-
Filesize
357B
MD5a2b76cea3a59fa9af5ea21ff68139c98
SHA135d76475e6a54c168f536e30206578babff58274
SHA256f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839
SHA512b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad
-
Filesize
1.8MB
MD58ad0919a0ee7cba7298d009d4b58e3ff
SHA1f75c3c9f06aa11b72db556d259b40a11d685ac11
SHA256798159895032344c910b1d937ebda40fafeb2c657e3039c49c0999d77a73f75f
SHA51223d50fc6006cb610a35cacdf29fee5a074993eb3b3e3f3746d78e9c621fb41c7ac0dda24fd4be4412b3a9915fd93cd1f46fa6f7a476bf53a8cee370939a2a064
-
Filesize
9KB
MD5913967b216326e36a08010fb70f9dba3
SHA17b6f8c2eb5b443e03c212b85c2f0edb9c76ad2bf
SHA2568d880758549220154d2ff4ee578f2b49527c5fb76a07d55237b61e30bcc09e3a
SHA512c6fcb98d9fd509e9834fc3fba143bd36d41869cc104fbce5354951f0a6756156e34a30796baaa130dd45de3ed96e039ec14716716f6da4569915c7ef2d2b6c33
-
Filesize
21KB
MD5e6fcf516d8ed8d0d4427f86e08d0d435
SHA1c7691731583ab7890086635cb7f3e4c22ca5e409
SHA2568dbe814359391ed6b0b5b182039008cf1d00964da9fbc4747f46242a95c24337
SHA512c496cf8e2e222fe1e19051b291e6860f31aae39f54369c1c5e8c9758c4b56e8af904e3e536e743a0a6fdbbf8478afba4baee92e13fc1b3073376ac6bf4a7948e