Analysis
-
max time kernel
390s -
max time network
388s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
08-02-2024 13:41
Behavioral task
behavioral1
Sample
rat.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
rat.exe
Resource
win10v2004-20231222-en
General
-
Target
rat.exe
-
Size
1.8MB
-
MD5
8ad0919a0ee7cba7298d009d4b58e3ff
-
SHA1
f75c3c9f06aa11b72db556d259b40a11d685ac11
-
SHA256
798159895032344c910b1d937ebda40fafeb2c657e3039c49c0999d77a73f75f
-
SHA512
23d50fc6006cb610a35cacdf29fee5a074993eb3b3e3f3746d78e9c621fb41c7ac0dda24fd4be4412b3a9915fd93cd1f46fa6f7a476bf53a8cee370939a2a064
-
SSDEEP
49152:kJuHrhm4SEHZF6qXyoU7Ej44FoGl3RRZr7NoazWVgUIRFSO1SSQ:CMrh3JHZF6VoUoj4+7fNo
Malware Config
Signatures
-
Orcus main payload 1 IoCs
resource yara_rule behavioral1/files/0x0007000000015c46-30.dat family_orcus -
Orcurs Rat Executable 4 IoCs
resource yara_rule behavioral1/memory/2020-0-0x0000000000FB0000-0x0000000001308000-memory.dmp orcus behavioral1/memory/2524-18-0x000000001A680000-0x000000001A700000-memory.dmp orcus behavioral1/files/0x0007000000015c46-30.dat orcus behavioral1/memory/2556-37-0x00000000010D0000-0x0000000001428000-memory.dmp orcus -
Executes dropped EXE 7 IoCs
pid Process 2524 WindowsInput.exe 2596 WindowsInput.exe 2556 Orcus.exe 1736 Orcus.exe 2316 Sys322.exe 952 Sys322.exe 1732 Orcus.exe -
Loads dropped DLL 3 IoCs
pid Process 2020 rat.exe 2020 rat.exe 2556 Orcus.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Windows\CurrentVersion\Run\System3222 = "\"C:\\Program Files (x86)\\Orcus\\Orcus.exe\"" Orcus.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs
flow ioc 2 4.tcp.eu.ngrok.io -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\WindowsInput.exe rat.exe File created C:\Windows\SysWOW64\WindowsInput.exe.config rat.exe File created C:\Windows\SysWOW64\WindowsInput.InstallState WindowsInput.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
pid Process 2020 rat.exe 2020 rat.exe 2556 Orcus.exe 2556 Orcus.exe 1736 Orcus.exe 1736 Orcus.exe 1732 Orcus.exe 1732 Orcus.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Orcus\Orcus.exe rat.exe File created C:\Program Files (x86)\Orcus\Orcus.exe.config rat.exe File created C:\Program Files (x86)\Orcus\Orcus.exe rat.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 952 Sys322.exe 952 Sys322.exe 952 Sys322.exe 2556 Orcus.exe 2556 Orcus.exe 2556 Orcus.exe 952 Sys322.exe 2556 Orcus.exe 952 Sys322.exe 2556 Orcus.exe 952 Sys322.exe 2556 Orcus.exe 952 Sys322.exe 2556 Orcus.exe 952 Sys322.exe 2556 Orcus.exe 952 Sys322.exe 2556 Orcus.exe 952 Sys322.exe 2556 Orcus.exe 952 Sys322.exe 2556 Orcus.exe 952 Sys322.exe 2556 Orcus.exe 952 Sys322.exe 2556 Orcus.exe 952 Sys322.exe 2556 Orcus.exe 952 Sys322.exe 2556 Orcus.exe 952 Sys322.exe 2556 Orcus.exe 952 Sys322.exe 2556 Orcus.exe 952 Sys322.exe 2556 Orcus.exe 952 Sys322.exe 2556 Orcus.exe 952 Sys322.exe 2556 Orcus.exe 952 Sys322.exe 2556 Orcus.exe 952 Sys322.exe 2556 Orcus.exe 952 Sys322.exe 2556 Orcus.exe 952 Sys322.exe 2556 Orcus.exe 952 Sys322.exe 2556 Orcus.exe 952 Sys322.exe 2556 Orcus.exe 952 Sys322.exe 2556 Orcus.exe 952 Sys322.exe 2556 Orcus.exe 952 Sys322.exe 2556 Orcus.exe 952 Sys322.exe 2556 Orcus.exe 952 Sys322.exe 2556 Orcus.exe 952 Sys322.exe 2556 Orcus.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2556 Orcus.exe Token: SeDebugPrivilege 2316 Sys322.exe Token: SeDebugPrivilege 952 Sys322.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2556 Orcus.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 2556 Orcus.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2556 Orcus.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 2020 wrote to memory of 2524 2020 rat.exe 28 PID 2020 wrote to memory of 2524 2020 rat.exe 28 PID 2020 wrote to memory of 2524 2020 rat.exe 28 PID 2020 wrote to memory of 2524 2020 rat.exe 28 PID 2020 wrote to memory of 2556 2020 rat.exe 30 PID 2020 wrote to memory of 2556 2020 rat.exe 30 PID 2020 wrote to memory of 2556 2020 rat.exe 30 PID 2020 wrote to memory of 2556 2020 rat.exe 30 PID 3020 wrote to memory of 1736 3020 taskeng.exe 32 PID 3020 wrote to memory of 1736 3020 taskeng.exe 32 PID 3020 wrote to memory of 1736 3020 taskeng.exe 32 PID 3020 wrote to memory of 1736 3020 taskeng.exe 32 PID 2556 wrote to memory of 2316 2556 Orcus.exe 33 PID 2556 wrote to memory of 2316 2556 Orcus.exe 33 PID 2556 wrote to memory of 2316 2556 Orcus.exe 33 PID 2556 wrote to memory of 2316 2556 Orcus.exe 33 PID 2316 wrote to memory of 952 2316 Sys322.exe 34 PID 2316 wrote to memory of 952 2316 Sys322.exe 34 PID 2316 wrote to memory of 952 2316 Sys322.exe 34 PID 2316 wrote to memory of 952 2316 Sys322.exe 34 PID 3020 wrote to memory of 1732 3020 taskeng.exe 38 PID 3020 wrote to memory of 1732 3020 taskeng.exe 38 PID 3020 wrote to memory of 1732 3020 taskeng.exe 38 PID 3020 wrote to memory of 1732 3020 taskeng.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\rat.exe"C:\Users\Admin\AppData\Local\Temp\rat.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Windows\SysWOW64\WindowsInput.exe"C:\Windows\SysWOW64\WindowsInput.exe" --install2⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2524
-
-
C:\Program Files (x86)\Orcus\Orcus.exe"C:\Program Files (x86)\Orcus\Orcus.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Users\Admin\AppData\Roaming\Sys322.exe"C:\Users\Admin\AppData\Roaming\Sys322.exe" /launchSelfAndExit "C:\Program Files (x86)\Orcus\Orcus.exe" 2556 /protectFile3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Users\Admin\AppData\Roaming\Sys322.exe"C:\Users\Admin\AppData\Roaming\Sys322.exe" /watchProcess "C:\Program Files (x86)\Orcus\Orcus.exe" 2556 "/protectFile"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:952
-
-
-
-
C:\Windows\SysWOW64\WindowsInput.exe"C:\Windows\SysWOW64\WindowsInput.exe"1⤵
- Executes dropped EXE
PID:2596
-
C:\Windows\system32\taskeng.exetaskeng.exe {2FB6664F-2D4B-4D92-BA46-02916322D268} S-1-5-21-3470981204-343661084-3367201002-1000:GLTGRJAG\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Program Files (x86)\Orcus\Orcus.exe"C:\Program Files (x86)\Orcus\Orcus.exe"2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1736
-
-
C:\Program Files (x86)\Orcus\Orcus.exe"C:\Program Files (x86)\Orcus\Orcus.exe"2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1732
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9KB
MD5913967b216326e36a08010fb70f9dba3
SHA17b6f8c2eb5b443e03c212b85c2f0edb9c76ad2bf
SHA2568d880758549220154d2ff4ee578f2b49527c5fb76a07d55237b61e30bcc09e3a
SHA512c6fcb98d9fd509e9834fc3fba143bd36d41869cc104fbce5354951f0a6756156e34a30796baaa130dd45de3ed96e039ec14716716f6da4569915c7ef2d2b6c33
-
Filesize
357B
MD5a2b76cea3a59fa9af5ea21ff68139c98
SHA135d76475e6a54c168f536e30206578babff58274
SHA256f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839
SHA512b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad
-
Filesize
1.8MB
MD58ad0919a0ee7cba7298d009d4b58e3ff
SHA1f75c3c9f06aa11b72db556d259b40a11d685ac11
SHA256798159895032344c910b1d937ebda40fafeb2c657e3039c49c0999d77a73f75f
SHA51223d50fc6006cb610a35cacdf29fee5a074993eb3b3e3f3746d78e9c621fb41c7ac0dda24fd4be4412b3a9915fd93cd1f46fa6f7a476bf53a8cee370939a2a064
-
Filesize
21KB
MD5e6fcf516d8ed8d0d4427f86e08d0d435
SHA1c7691731583ab7890086635cb7f3e4c22ca5e409
SHA2568dbe814359391ed6b0b5b182039008cf1d00964da9fbc4747f46242a95c24337
SHA512c496cf8e2e222fe1e19051b291e6860f31aae39f54369c1c5e8c9758c4b56e8af904e3e536e743a0a6fdbbf8478afba4baee92e13fc1b3073376ac6bf4a7948e