Analysis

  • max time kernel
    535s
  • max time network
    517s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    08-02-2024 15:18

General

  • Target

    file.exe

  • Size

    914KB

  • MD5

    12ad4c2b63d32b4579f03992e362f8ef

  • SHA1

    c38692667cdfd7f2b8bc67f3d7165f72fba74552

  • SHA256

    d699d584b651c6da780801cb6c2fb074464ce36e46b287658913d8bb67d2329b

  • SHA512

    c03c47ce05435eeed509021cd844a0530480b9cef30a60d0b7c1c4914b7b425edf86ef78be0e2929d198c5561e69445605d02a10a73a66ba11183f079f500ca0

  • SSDEEP

    24576:+am4MROxnFD3wrXYf1rrcI0AilFEvxHPmE7ooj:+OMiJJrrcI0AilFEvxHP

Malware Config

Extracted

Family

orcus

C2

4.tcp.eu.ngrok.io:15428

Mutex

0133d229c4e24006957c0e4ab3a52531

Attributes
  • autostart_method

    Registry

  • enable_keylogger

    true

  • install_path

    %programfiles%\Orcus\Orcus.exe

  • reconnect_delay

    10000

  • registry_keyname

    System3222

  • taskscheduler_taskname

    System3222

  • watchdog_path

    AppData\Sys322.exe

Signatures

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

  • Orcus main payload 1 IoCs
  • Orcurs Rat Executable 3 IoCs
  • Drops file in Drivers directory 39 IoCs
  • Manipulates Digital Signatures 1 IoCs

    Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 8 IoCs
  • Loads dropped DLL 23 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops desktop.ini file(s) 51 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs
  • Drops autorun.inf file 1 TTPs 1 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 40 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1416
    • C:\Windows\SysWOW64\WindowsInput.exe
      "C:\Windows\SysWOW64\WindowsInput.exe" --install
      2⤵
      • Executes dropped EXE
      PID:2052
    • C:\Program Files (x86)\Orcus\Orcus.exe
      "C:\Program Files (x86)\Orcus\Orcus.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3048
      • C:\Users\Admin\AppData\Roaming\Sys322.exe
        "C:\Users\Admin\AppData\Roaming\Sys322.exe" /launchSelfAndExit "C:\Program Files (x86)\Orcus\Orcus.exe" 3048 /protectFile
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2020
        • C:\Users\Admin\AppData\Roaming\Sys322.exe
          "C:\Users\Admin\AppData\Roaming\Sys322.exe" /watchProcess "C:\Program Files (x86)\Orcus\Orcus.exe" 3048 "/protectFile"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2896
          • C:\Users\Admin\AppData\Roaming\Sys322.exe
            "C:\Users\Admin\AppData\Roaming\Sys322.exe" /launchClientAndExit "C:\Program Files (x86)\Orcus\Orcus.exe" 2896
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:2232
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
              dw20.exe -x -s 408
              6⤵
              • Loads dropped DLL
              • Suspicious use of FindShellTrayWindow
              PID:2012
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 840
            5⤵
            • Loads dropped DLL
            • Program crash
            PID:888
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\{498b2b4f-a2e5-46da-adc0-5ecc1674a6bf}.bat""
        3⤵
        • Drops file in Drivers directory
        • Manipulates Digital Signatures
        • Deletes itself
        • Drops desktop.ini file(s)
        • Drops autorun.inf file
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        PID:2560
  • C:\Windows\SysWOW64\WindowsInput.exe
    "C:\Windows\SysWOW64\WindowsInput.exe"
    1⤵
    • Executes dropped EXE
    PID:2700
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {92230B5E-56A3-4D1C-8A16-4C4F56C88D55} S-1-5-21-3601492379-692465709-652514833-1000:CALKHSYM\Admin:Interactive:[1]
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2736
    • C:\Program Files (x86)\Orcus\Orcus.exe
      "C:\Program Files (x86)\Orcus\Orcus.exe"
      2⤵
      • Executes dropped EXE
      PID:2604
    • C:\Program Files (x86)\Orcus\Orcus.exe
      "C:\Program Files (x86)\Orcus\Orcus.exe"
      2⤵
      • Executes dropped EXE
      PID:1648

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\MICROS~1\CRYPTN~1\MetaData\943080~1

    Filesize

    344B

    MD5

    ed6dacae95f4fe79741659d53f2e719b

    SHA1

    7d510cf109f62deb9a4b294ee9a105e00d90d62c

    SHA256

    ca8f8753d31a32ba700635c8cd1c587ce435878a1b654d51069eacd3ee7ec10b

    SHA512

    fccfa86f677d7cea7bf13fdf400f3081a7d772f38920cbbd2e5914cc91aa1453436ba23ca11356b6b5cfed3fc40f473a33929c1b171db9eedd832ca7b2b75c33

  • C:\Users\Admin\AppData\Local\Temp\Cab28C7.tmp

    Filesize

    65KB

    MD5

    ac05d27423a85adc1622c714f2cb6184

    SHA1

    b0fe2b1abddb97837ea0195be70ab2ff14d43198

    SHA256

    c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

    SHA512

    6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

  • C:\Users\Admin\AppData\Local\Temp\{498b2b4f-a2e5-46da-adc0-5ecc1674a6bf}.bat

    Filesize

    70B

    MD5

    12888c690be6b5a4d468481b3c141167

    SHA1

    8f684102864ba7e9951024447c4894052af708fe

    SHA256

    10661b06e91d2a6dfb39f59e22a9ee88b6629db80e85b1f4f0f03eb197447236

    SHA512

    e7e95e6f66fc12714b399a135d6b127535d69a949005db29dc4af4b70c0fb8ff5243f873ad8318559817d055a517233635efcff78102b633e52ea84468caaf05

  • C:\Users\Admin\AppData\Roaming\ASystem\LIB_01~1\TURBOJ~1.DLL

    Filesize

    448KB

    MD5

    9a27bfdd0fa06e1b42e64e150a58fd3e

    SHA1

    bc66f567791528160df80521813a530b00136f7b

    SHA256

    d6d5fd47f18954e0addd8e2ddb360e4dcc4bf88ee9a2afdffbcd70dfdc68f1d8

    SHA512

    cff99b270af9e6b76da100be307da763cb72bec54b94d0813adfd94db8a9af2e2a158d132412b3b6034b793ff399eaf575ed502a71fde6520fb3b62f9595ac88

  • C:\Users\Admin\AppData\Roaming\ASystem\lib_0133d229c4e24006957c0e4ab3a52531\TurboJpegWrapper.dll

    Filesize

    1.3MB

    MD5

    ac6acc235ebef6374bed71b37e322874

    SHA1

    a267baad59cd7352167636836bad4b971fcd6b6b

    SHA256

    047b042cebf4c851f0d14f85f16ce952f03e48c20362d4ed9390875d4900fe96

    SHA512

    72ac8b8c8f27264cc261297c325d14a0be2084d007c6132ab8402d87f912fe9189cb074db11625d9f86d29a6188f22a89e58ae45c9131fac4522473567017081

  • C:\Users\Admin\AppData\Roaming\Sys322.exe

    Filesize

    9KB

    MD5

    913967b216326e36a08010fb70f9dba3

    SHA1

    7b6f8c2eb5b443e03c212b85c2f0edb9c76ad2bf

    SHA256

    8d880758549220154d2ff4ee578f2b49527c5fb76a07d55237b61e30bcc09e3a

    SHA512

    c6fcb98d9fd509e9834fc3fba143bd36d41869cc104fbce5354951f0a6756156e34a30796baaa130dd45de3ed96e039ec14716716f6da4569915c7ef2d2b6c33

  • C:\Windows\SysWOW64\WINDOW~1.INS

    Filesize

    7KB

    MD5

    362ce475f5d1e84641bad999c16727a0

    SHA1

    6b613c73acb58d259c6379bd820cca6f785cc812

    SHA256

    1f78f1056761c6ebd8965ed2c06295bafa704b253aff56c492b93151ab642899

    SHA512

    7630e1629cf4abecd9d3ddea58227b232d5c775cb480967762a6a6466be872e1d57123b08a6179fe1cfbc09403117d0f81bc13724f259a1d25c1325f1eac645b

  • C:\Windows\SysWOW64\WindowsInput.exe.config

    Filesize

    357B

    MD5

    a2b76cea3a59fa9af5ea21ff68139c98

    SHA1

    35d76475e6a54c168f536e30206578babff58274

    SHA256

    f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839

    SHA512

    b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad

  • \Program Files (x86)\Orcus\Orcus.exe

    Filesize

    914KB

    MD5

    12ad4c2b63d32b4579f03992e362f8ef

    SHA1

    c38692667cdfd7f2b8bc67f3d7165f72fba74552

    SHA256

    d699d584b651c6da780801cb6c2fb074464ce36e46b287658913d8bb67d2329b

    SHA512

    c03c47ce05435eeed509021cd844a0530480b9cef30a60d0b7c1c4914b7b425edf86ef78be0e2929d198c5561e69445605d02a10a73a66ba11183f079f500ca0

  • \Users\Admin\AppData\Roaming\ASystem\lib_0133d229c4e24006957c0e4ab3a52531\SharpDX.DXGI.dll

    Filesize

    125KB

    MD5

    2b44c70c49b70d797fbb748158b5d9bb

    SHA1

    93e00e6527e461c45c7868d14cf05c007e478081

    SHA256

    3762d43c83af69cd38c9341a927ca6bd00f6bae8217c874d693047d6df4705bf

    SHA512

    faced62f6ecbfa2ee0d7a47e300302d23030d1f28758cbe9c442e9d8d4f8359c59088aa6237a28103e43d248c8efc7eeaf2c184028701b752df6cce92d6854d0

  • \Users\Admin\AppData\Roaming\ASystem\lib_0133d229c4e24006957c0e4ab3a52531\SharpDX.Direct3D11.dll

    Filesize

    271KB

    MD5

    98eb5ba5871acdeaebf3a3b0f64be449

    SHA1

    c965284f60ef789b00b10b3df60ee682b4497de3

    SHA256

    d7617d926648849cbfef450b8f48e458ee52e2793fb2251a30094b778aa8848c

    SHA512

    a60025e304713d333e4b82b2d0be28087950688b049c98d2db5910c00b8d45b92e16d25ac8a58ff1318de019de3a9a00c7cbf8a6ad4b5bb1cb175dafa1b9bea2

  • \Users\Admin\AppData\Roaming\ASystem\lib_0133d229c4e24006957c0e4ab3a52531\SharpDX.Direct3D9.dll

    Filesize

    338KB

    MD5

    934da0e49208d0881c44fe19d5033840

    SHA1

    a19c5a822e82e41752a08d3bd9110db19a8a5016

    SHA256

    02da4af8cd4a8de19d816000caaae885e676b9e52f136ff071a279c2b8ad34c7

    SHA512

    de62f629c2299b50af62893244a28895d63b78138c8632449984306f45de16bd01076eadbb0d75a700215e970c1df731e202ea640236c0f0da6ed15146193b59

  • \Users\Admin\AppData\Roaming\ASystem\lib_0133d229c4e24006957c0e4ab3a52531\SharpDX.dll

    Filesize

    247KB

    MD5

    ffb4b61cc11bec6d48226027c2c26704

    SHA1

    fa8b9e344accbdc4dffa9b5d821d23f0716da29e

    SHA256

    061542ff3fb36039b7bbffdf3e07b66176b264c1dfd834a14b09c08620717303

    SHA512

    48aa6130bf1f5bd6de19256bbdf754c0158b43dd122cec47bb801a7a7b56f2da268bfdec24d135621764a23278ead3dcc35911a057e2dfa55a348bae8ef7b8a9

  • \Windows\SysWOW64\WindowsInput.exe

    Filesize

    21KB

    MD5

    e6fcf516d8ed8d0d4427f86e08d0d435

    SHA1

    c7691731583ab7890086635cb7f3e4c22ca5e409

    SHA256

    8dbe814359391ed6b0b5b182039008cf1d00964da9fbc4747f46242a95c24337

    SHA512

    c496cf8e2e222fe1e19051b291e6860f31aae39f54369c1c5e8c9758c4b56e8af904e3e536e743a0a6fdbbf8478afba4baee92e13fc1b3073376ac6bf4a7948e

  • memory/1416-0-0x0000000001040000-0x000000000112A000-memory.dmp

    Filesize

    936KB

  • memory/1416-36-0x0000000074C30000-0x000000007531E000-memory.dmp

    Filesize

    6.9MB

  • memory/1416-5-0x0000000000510000-0x0000000000522000-memory.dmp

    Filesize

    72KB

  • memory/1416-4-0x00000000003F0000-0x000000000044C000-memory.dmp

    Filesize

    368KB

  • memory/1416-3-0x00000000001D0000-0x00000000001DE000-memory.dmp

    Filesize

    56KB

  • memory/1416-2-0x0000000004BA0000-0x0000000004BE0000-memory.dmp

    Filesize

    256KB

  • memory/1416-1-0x0000000074C30000-0x000000007531E000-memory.dmp

    Filesize

    6.9MB

  • memory/1648-80-0x0000000074C30000-0x000000007531E000-memory.dmp

    Filesize

    6.9MB

  • memory/1648-81-0x0000000000960000-0x00000000009A0000-memory.dmp

    Filesize

    256KB

  • memory/1648-82-0x0000000074C30000-0x000000007531E000-memory.dmp

    Filesize

    6.9MB

  • memory/2012-141-0x0000000000650000-0x0000000000651000-memory.dmp

    Filesize

    4KB

  • memory/2012-145-0x0000000000650000-0x0000000000651000-memory.dmp

    Filesize

    4KB

  • memory/2020-54-0x0000000074C30000-0x000000007531E000-memory.dmp

    Filesize

    6.9MB

  • memory/2020-53-0x0000000000220000-0x0000000000228000-memory.dmp

    Filesize

    32KB

  • memory/2020-57-0x0000000074C30000-0x000000007531E000-memory.dmp

    Filesize

    6.9MB

  • memory/2052-14-0x0000000001200000-0x000000000120C000-memory.dmp

    Filesize

    48KB

  • memory/2052-15-0x000007FEF5DD0000-0x000007FEF67BC000-memory.dmp

    Filesize

    9.9MB

  • memory/2052-16-0x000000001B320000-0x000000001B3A0000-memory.dmp

    Filesize

    512KB

  • memory/2052-19-0x000007FEF5DD0000-0x000007FEF67BC000-memory.dmp

    Filesize

    9.9MB

  • memory/2232-135-0x0000000001F80000-0x0000000001FC0000-memory.dmp

    Filesize

    256KB

  • memory/2232-143-0x00000000714F0000-0x0000000071A9B000-memory.dmp

    Filesize

    5.7MB

  • memory/2232-144-0x0000000001F80000-0x0000000001FC0000-memory.dmp

    Filesize

    256KB

  • memory/2232-146-0x00000000714F0000-0x0000000071A9B000-memory.dmp

    Filesize

    5.7MB

  • memory/2232-134-0x00000000714F0000-0x0000000071A9B000-memory.dmp

    Filesize

    5.7MB

  • memory/2232-133-0x00000000714F0000-0x0000000071A9B000-memory.dmp

    Filesize

    5.7MB

  • memory/2604-45-0x0000000001080000-0x00000000010C0000-memory.dmp

    Filesize

    256KB

  • memory/2604-74-0x0000000074C30000-0x000000007531E000-memory.dmp

    Filesize

    6.9MB

  • memory/2604-44-0x0000000074C30000-0x000000007531E000-memory.dmp

    Filesize

    6.9MB

  • memory/2700-23-0x0000000000BF0000-0x0000000000C70000-memory.dmp

    Filesize

    512KB

  • memory/2700-75-0x000007FEF53E0000-0x000007FEF5DCC000-memory.dmp

    Filesize

    9.9MB

  • memory/2700-22-0x000007FEF53E0000-0x000007FEF5DCC000-memory.dmp

    Filesize

    9.9MB

  • memory/2700-21-0x0000000001320000-0x000000000132C000-memory.dmp

    Filesize

    48KB

  • memory/2896-152-0x0000000074C30000-0x000000007531E000-memory.dmp

    Filesize

    6.9MB

  • memory/2896-78-0x0000000074C30000-0x000000007531E000-memory.dmp

    Filesize

    6.9MB

  • memory/2896-56-0x0000000074C30000-0x000000007531E000-memory.dmp

    Filesize

    6.9MB

  • memory/3048-77-0x0000000004B10000-0x0000000004B50000-memory.dmp

    Filesize

    256KB

  • memory/3048-38-0x0000000000C20000-0x0000000000C6E000-memory.dmp

    Filesize

    312KB

  • memory/3048-129-0x0000000007160000-0x00000000072B4000-memory.dmp

    Filesize

    1.3MB

  • memory/3048-130-0x0000000074C30000-0x000000007531E000-memory.dmp

    Filesize

    6.9MB

  • memory/3048-102-0x0000000005480000-0x00000000054CA000-memory.dmp

    Filesize

    296KB

  • memory/3048-40-0x0000000000E90000-0x0000000000EA0000-memory.dmp

    Filesize

    64KB

  • memory/3048-39-0x0000000000D50000-0x0000000000D68000-memory.dmp

    Filesize

    96KB

  • memory/3048-76-0x0000000074C30000-0x000000007531E000-memory.dmp

    Filesize

    6.9MB

  • memory/3048-37-0x0000000004B10000-0x0000000004B50000-memory.dmp

    Filesize

    256KB

  • memory/3048-35-0x00000000011D0000-0x00000000012BA000-memory.dmp

    Filesize

    936KB

  • memory/3048-34-0x0000000074C30000-0x000000007531E000-memory.dmp

    Filesize

    6.9MB

  • memory/3048-116-0x0000000000F10000-0x0000000000F36000-memory.dmp

    Filesize

    152KB

  • memory/3048-109-0x0000000005670000-0x00000000056CA000-memory.dmp

    Filesize

    360KB

  • memory/3048-95-0x0000000005260000-0x00000000052A4000-memory.dmp

    Filesize

    272KB