Malware Analysis Report

2025-01-22 15:11

Sample ID 240220-k7eldaeb4x
Target Hack.exe
SHA256 97fcda2efb84505407d88da25d6c0d58371c57ed50be9ee1e9115746db247840
Tags
orcus rat spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

97fcda2efb84505407d88da25d6c0d58371c57ed50be9ee1e9115746db247840

Threat Level: Known bad

The file Hack.exe was found to be: Known bad.

Malicious Activity Summary

orcus rat spyware stealer

Orcurs Rat Executable

Orcus

Orcus main payload

Orcus family

Orcurs Rat Executable

Checks computer location settings

Executes dropped EXE

Drops desktop.ini file(s)

Drops file in System32 directory

Drops file in Windows directory

Unsigned PE

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-02-20 09:14

Signatures

Orcurs Rat Executable

Description Indicator Process Target
N/A N/A N/A N/A

Orcus family

orcus

Orcus main payload

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-02-20 09:14

Reported

2024-02-20 09:15

Platform

win7-20231215-en

Max time kernel

20s

Max time network

19s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Hack.exe"

Signatures

Orcus

rat spyware stealer orcus

Orcus main payload

Description Indicator Process Target
N/A N/A N/A N/A

Orcurs Rat Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\system32\system31\loader.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\system32\system31\loader.exe C:\Users\Admin\AppData\Local\Temp\Hack.exe N/A
File opened for modification C:\Windows\system32\system31\loader.exe C:\Users\Admin\AppData\Local\Temp\Hack.exe N/A
File created C:\Windows\system32\system31\loader.exe.config C:\Users\Admin\AppData\Local\Temp\Hack.exe N/A

Enumerates physical storage devices

Processes

C:\Users\Admin\AppData\Local\Temp\Hack.exe

"C:\Users\Admin\AppData\Local\Temp\Hack.exe"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\i7olcwlv.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9982.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC9981.tmp"

C:\Windows\system32\system31\loader.exe

"C:\Windows\system32\system31\loader.exe"

Network

N/A

Files

memory/2164-1-0x0000000000180000-0x000000000018E000-memory.dmp

memory/2164-0-0x0000000000F10000-0x0000000000F6C000-memory.dmp

memory/2164-2-0x000007FEF5760000-0x000007FEF60FD000-memory.dmp

memory/2164-3-0x0000000000B90000-0x0000000000C10000-memory.dmp

memory/2164-4-0x000007FEF5760000-0x000007FEF60FD000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\i7olcwlv.cmdline

MD5 c514e044a7ad09fdb99f70d500c53201
SHA1 f78e8bb7937be47a284d8d34e81c5d79028bc9e6
SHA256 c5d3fdde2a563e64c16fe0a80700143b483196ef029a4469701286c7b1a42f96
SHA512 d863b839d8ead1e610cbb2c4fb4a1cc4fa4eb595ba7a82cd71ee9a1db9cd0294ccb4372c66ce6cdd9f1044c156b9bf919515bea4832ebb5c36303f6367859c1a

\??\c:\Users\Admin\AppData\Local\Temp\i7olcwlv.0.cs

MD5 2b14ae8b54d216abf4d228493ceca44a
SHA1 d134351498e4273e9d6391153e35416bc743adef
SHA256 4e1cc3da1f7bf92773aae6cffa6d61bfc3e25aead3ad947f6215f93a053f346c
SHA512 5761b605add10ae3ef80f3b8706c8241b4e8abe4ac3ce36b7be8a97d08b08da5a72fedd5e976b3c9e1c463613a943ebb5d323e6a075ef6c7c3b1abdc0d53ac05

memory/2004-10-0x0000000002170000-0x00000000021F0000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\CSC9981.tmp

MD5 3053e65594b7a24d3f99c09d1e300bc9
SHA1 8ddb1c51490c40cf7af9fd1d3eaf8c97eadb51f0
SHA256 72597e945625dfc78dc1248fce85e4a048f9bfa688e540133f1ffad579a99733
SHA512 4cc25e761ed2d24a9f06ddeb6d17ed900bb1cb40c9061c53f21ff9df9640c5b111834245c2beb583cb7353f7f09809911fbca657e71814e9c34baa4b1cb2141b

C:\Users\Admin\AppData\Local\Temp\RES9982.tmp

MD5 b0d4f10960c374f8bed2f9e9e344c209
SHA1 ee897faaf00723123aa8bf3f52aae480751b8918
SHA256 587d84a9a347c07855741d013c613f7b0be7fc1f0e489b2cf96928243cc2dd66
SHA512 721bfbad589689492117836b6bd731e2968abab661b5f73e7264430adb5b6679862e8cb47b38c30b871661919d7f9bea13d1165d4a09295a3b0372f2a6b5513c

C:\Users\Admin\AppData\Local\Temp\i7olcwlv.dll

MD5 832d67db9fd7c62d1fa0570c17cf1b9c
SHA1 56c8d8b28269ff3d66e7924b6ac6090b0093b7ff
SHA256 2470e68ca98797a092b6ffb5a078a268ee5c569edae9f5f775415008ed84c561
SHA512 0093a8a41d08cbd067422695a4d2ed2e58a6de7b43a2452b2af29d049429cc237fbc3111b24b526dc316d629c72c41dff0eaf4eac68f8dbb5e9e4d7ae29d48fe

memory/2164-18-0x0000000000B70000-0x0000000000B86000-memory.dmp

memory/2164-20-0x00000000003B0000-0x00000000003C2000-memory.dmp

memory/2164-21-0x0000000000650000-0x0000000000658000-memory.dmp

C:\Windows\system32\system31\loader.exe.config

MD5 a2b76cea3a59fa9af5ea21ff68139c98
SHA1 35d76475e6a54c168f536e30206578babff58274
SHA256 f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839
SHA512 b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad

C:\Windows\System32\system31\loader.exe

MD5 5bc07820605f88458f319271255ca033
SHA1 d5f9e6b2755dd4d189a3e97a38cfe376cdacb81f
SHA256 97fcda2efb84505407d88da25d6c0d58371c57ed50be9ee1e9115746db247840
SHA512 c2f7dfbcc5f2de041943782154d70eea786161f655d291e5153ce06754e94479377006583eac4a5a10107bf8125450cecf621fa5dd56b70b78ff2293ae682555

memory/2164-29-0x000007FEF5760000-0x000007FEF60FD000-memory.dmp

memory/2688-31-0x0000000000EA0000-0x0000000000F8A000-memory.dmp

memory/2688-32-0x000007FEEF280000-0x000007FEEFC6C000-memory.dmp

memory/2688-33-0x000000001AD20000-0x000000001ADA0000-memory.dmp

memory/2688-34-0x0000000000480000-0x0000000000492000-memory.dmp

memory/2688-35-0x000007FEEF280000-0x000007FEEFC6C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-02-20 09:14

Reported

2024-02-20 09:15

Platform

win10v2004-20231215-en

Max time kernel

44s

Max time network

60s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Hack.exe"

Signatures

Orcus

rat spyware stealer orcus

Orcus main payload

Description Indicator Process Target
N/A N/A N/A N/A

Orcurs Rat Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Hack.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\system32\system31\loader.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File created C:\Windows\assembly\Desktop.ini C:\Users\Admin\AppData\Local\Temp\Hack.exe N/A
File opened for modification C:\Windows\assembly\Desktop.ini C:\Users\Admin\AppData\Local\Temp\Hack.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\system32\system31\loader.exe C:\Users\Admin\AppData\Local\Temp\Hack.exe N/A
File opened for modification C:\Windows\system32\system31\loader.exe C:\Users\Admin\AppData\Local\Temp\Hack.exe N/A
File created C:\Windows\system32\system31\loader.exe.config C:\Users\Admin\AppData\Local\Temp\Hack.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\assembly C:\Users\Admin\AppData\Local\Temp\Hack.exe N/A
File created C:\Windows\assembly\Desktop.ini C:\Users\Admin\AppData\Local\Temp\Hack.exe N/A
File opened for modification C:\Windows\assembly\Desktop.ini C:\Users\Admin\AppData\Local\Temp\Hack.exe N/A

Enumerates physical storage devices

Processes

C:\Users\Admin\AppData\Local\Temp\Hack.exe

"C:\Users\Admin\AppData\Local\Temp\Hack.exe"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\rcdf8ab4.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4AB6.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC4AB5.tmp"

C:\Windows\system32\system31\loader.exe

"C:\Windows\system32\system31\loader.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 190.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp

Files

memory/4400-0-0x00007FF819D10000-0x00007FF81A6B1000-memory.dmp

memory/4400-1-0x00000000011D0000-0x00000000011E0000-memory.dmp

memory/4400-2-0x000000001B6A0000-0x000000001B6FC000-memory.dmp

memory/4400-5-0x000000001B730000-0x000000001B73E000-memory.dmp

memory/4400-6-0x00007FF819D10000-0x00007FF81A6B1000-memory.dmp

memory/4400-7-0x000000001BDB0000-0x000000001C27E000-memory.dmp

memory/4400-8-0x000000001C280000-0x000000001C31C000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\rcdf8ab4.cmdline

MD5 cc5ba43cea9c02a1638c63c9282e096a
SHA1 5437ba03d9c795142010b0e97619803396430dd4
SHA256 bbd0450e105fae54fa3508f21d97294fa370038920fe9326eacf8f6e725babd8
SHA512 3c6216695e262990f1d23ef6cb2d7c547af9e3e3f1bc5764b12b6b92e93bb61812d7f934f4328c3b3c803270bc3ea62c764e4c32425238e15784634c58050d8b

\??\c:\Users\Admin\AppData\Local\Temp\rcdf8ab4.0.cs

MD5 5d907037f4b54dbab1bf453c2008817b
SHA1 d2343b2308c178e068dc3cb588a6ddc0ed118492
SHA256 220bf6f07a36f99ecc370e03399b8ab60a1686b1f1423ff6dda2cf05fadca7e4
SHA512 ab7468f7240f065cae4b324f7ce9fd0c0da9bc5b583c4b82db81a16965f9f2228ebdc2e4330fafcb7408594f2e67fed8b083933b4b97aa881e22f6acb636ee91

memory/3912-14-0x0000000000C30000-0x0000000000C40000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\CSC4AB5.tmp

MD5 5ecfc65580ec5ba91dc5b66a5eff8f0a
SHA1 8fd6f39a05c0af3226b1990e98a4fd40fbb0cbca
SHA256 3de7f1411393a3df8e0dc5f3bbbcb8d3dceb131562e131cce030e13f007f20a4
SHA512 a0b048ab0f4f7123cbf51421d0b775ed9ee0858a4f8f3421dce185bba93d65a791ecd15b90b314df81e1a7022b3594a33be0b2554026fadaac49a7fef7ab0d69

C:\Users\Admin\AppData\Local\Temp\RES4AB6.tmp

MD5 2db955813e7e7582de884a0413accfc9
SHA1 5b24bd05350cd90445fdbceb38d0fed1ab094123
SHA256 7dda75988e8ab4b8c88b87b1924dbe05da2b6c15a5bff66871fb63440449242b
SHA512 8e28aa43ddc3afdef8127d83739f422b014e9f354726fbaf437e98e7cbbf83f48c50b2d350d2fd206b520d11960e80e3102fd60b3b9280b562576450d6d083a9

C:\Users\Admin\AppData\Local\Temp\rcdf8ab4.dll

MD5 354d5ed074fb5cb68be3b8f1450e2a5f
SHA1 30042ab16e69a8c50fa1160f699e82ca076e5ff8
SHA256 22442dfe49dfa37d8073a830c41bea492e9e61aabe5ca310d62de8e7f15ec903
SHA512 01c96fbb3f1bc6d57689729d49280fc1a0f7f4621458064055deeb1d98f57282aefb05274019d30e40f6f168849ad870c9bf7a357939f87e7164bf5ae2a04467

memory/4400-22-0x000000001C940000-0x000000001C956000-memory.dmp

memory/4400-24-0x0000000001040000-0x0000000001052000-memory.dmp

memory/4400-25-0x0000000000FD0000-0x0000000000FD8000-memory.dmp

C:\Windows\System32\system31\loader.exe

MD5 5bc07820605f88458f319271255ca033
SHA1 d5f9e6b2755dd4d189a3e97a38cfe376cdacb81f
SHA256 97fcda2efb84505407d88da25d6c0d58371c57ed50be9ee1e9115746db247840
SHA512 c2f7dfbcc5f2de041943782154d70eea786161f655d291e5153ce06754e94479377006583eac4a5a10107bf8125450cecf621fa5dd56b70b78ff2293ae682555

C:\Windows\system32\system31\loader.exe.config

MD5 a2b76cea3a59fa9af5ea21ff68139c98
SHA1 35d76475e6a54c168f536e30206578babff58274
SHA256 f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839
SHA512 b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad

memory/4400-41-0x00007FF819D10000-0x00007FF81A6B1000-memory.dmp

memory/4240-42-0x0000000000EC0000-0x0000000000FAA000-memory.dmp

memory/4240-43-0x00007FF817910000-0x00007FF8183D1000-memory.dmp

memory/4240-44-0x000000001BD80000-0x000000001BD90000-memory.dmp

memory/4240-45-0x000000001BD10000-0x000000001BD22000-memory.dmp

memory/4240-47-0x00007FF817910000-0x00007FF8183D1000-memory.dmp