orcus | d4205c32a32976e3ff2cf981e2959ed4a8df9689a4c17bfc5b6d860666912417

Analysis

max time kernel
149s
max time network
143s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
13-03-2024 02:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d4205c32a32976e3ff2cf981e2959ed4a8df9689a4c17bfc5b6d860666912417.exe
Size

2.6MB
MD5

a1de47f3e2c2d8384e730f62414b45e9
SHA1

5f886112de96a5d414c34a9b48ddbdb8dba9a419
SHA256

d4205c32a32976e3ff2cf981e2959ed4a8df9689a4c17bfc5b6d860666912417
SHA512

10abb7c01414f773b61ec2abd23eb36f04d9b5e6c8cefe8ab7806df9721787531535c6b2064bb4c4a18c867a5c92a8886a2c1728dbdf099968bee07e6c124996
SSDEEP

24576:QAHnh+eWsN3skA4RV1Hom2KXSmHdqf0K44JzixdvW80EXLq31gEfUvWDyBFZpxx3:Hh+ZkldoPKiYdqd6P

Score

10^/10

orcus ligeon rat spyware stealer

Malware Config

Extracted

Family

orcus

Botnet

ligeon

ligeon.ddns.net:1606

Mutex

b98fb09a59c24a81b9d17a55ccf2c036

Attributes

autostart_method
Disable
enable_keylogger
true
install_path
%programfiles%\Orcus\Orcus.exe
reconnect_delay
10000
registry_keyname
Orcus
taskscheduler_taskname
Orcus
watchdog_path
AppData\OrcusWatchdog.exe

Signatures

Orcus
Orcus is a Remote Access Trojan that is being sold on underground forums.
rat spyware stealer orcus

Orcurs Rat Executable 6 IoCs

resource	yara_rule
behavioral1/memory/2072-4-0x0000000000400000-0x00000000004EA000-memory.dmp	orcus
behavioral1/memory/2072-10-0x0000000000400000-0x00000000004EA000-memory.dmp	orcus
behavioral1/memory/2072-11-0x0000000000400000-0x00000000004EA000-memory.dmp	orcus
behavioral1/memory/3064-28-0x0000000000170000-0x000000000025A000-memory.dmp	orcus
behavioral1/memory/3064-34-0x0000000000170000-0x000000000025A000-memory.dmp	orcus
behavioral1/memory/3064-35-0x0000000000170000-0x000000000025A000-memory.dmp	orcus

Executes dropped EXE 3 IoCs

pid	Process
2448	setspn.exe
2892	setspn.exe
1216	setspn.exe

AutoIT Executable 7 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/2836-0-0x0000000000020000-0x00000000002CA000-memory.dmp	autoit_exe
behavioral1/files/0x000c000000015c4c-24.dat	autoit_exe
behavioral1/memory/2448-26-0x0000000000DF0000-0x000000000109A000-memory.dmp	autoit_exe
behavioral1/files/0x000c000000015c4c-39.dat	autoit_exe
behavioral1/memory/2892-40-0x0000000000260000-0x000000000050A000-memory.dmp	autoit_exe
behavioral1/files/0x000c000000015c4c-54.dat	autoit_exe
behavioral1/memory/1216-55-0x00000000009B0000-0x0000000000C5A000-memory.dmp	autoit_exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2836 set thread context of 2072	2836	d4205c32a32976e3ff2cf981e2959ed4a8df9689a4c17bfc5b6d860666912417.exe	28
PID 2448 set thread context of 3064	2448	setspn.exe	33
PID 2892 set thread context of 2008	2892	setspn.exe	39
PID 1216 set thread context of 1292	1216	setspn.exe	43

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3040	schtasks.exe
2708	schtasks.exe
268	schtasks.exe
912	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2836	d4205c32a32976e3ff2cf981e2959ed4a8df9689a4c17bfc5b6d860666912417.exe
2836	d4205c32a32976e3ff2cf981e2959ed4a8df9689a4c17bfc5b6d860666912417.exe
2448	setspn.exe
2448	setspn.exe
2892	setspn.exe
2892	setspn.exe
1216	setspn.exe
1216	setspn.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2072	RegSvcs.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2072	RegSvcs.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2836 wrote to memory of 2072	2836	d4205c32a32976e3ff2cf981e2959ed4a8df9689a4c17bfc5b6d860666912417.exe	28
PID 2836 wrote to memory of 2072	2836	d4205c32a32976e3ff2cf981e2959ed4a8df9689a4c17bfc5b6d860666912417.exe	28
PID 2836 wrote to memory of 2072	2836	d4205c32a32976e3ff2cf981e2959ed4a8df9689a4c17bfc5b6d860666912417.exe	28
PID 2836 wrote to memory of 2072	2836	d4205c32a32976e3ff2cf981e2959ed4a8df9689a4c17bfc5b6d860666912417.exe	28
PID 2836 wrote to memory of 2072	2836	d4205c32a32976e3ff2cf981e2959ed4a8df9689a4c17bfc5b6d860666912417.exe	28
PID 2836 wrote to memory of 2072	2836	d4205c32a32976e3ff2cf981e2959ed4a8df9689a4c17bfc5b6d860666912417.exe	28
PID 2836 wrote to memory of 2072	2836	d4205c32a32976e3ff2cf981e2959ed4a8df9689a4c17bfc5b6d860666912417.exe	28
PID 2836 wrote to memory of 2072	2836	d4205c32a32976e3ff2cf981e2959ed4a8df9689a4c17bfc5b6d860666912417.exe	28
PID 2836 wrote to memory of 2072	2836	d4205c32a32976e3ff2cf981e2959ed4a8df9689a4c17bfc5b6d860666912417.exe	28
PID 2836 wrote to memory of 3040	2836	d4205c32a32976e3ff2cf981e2959ed4a8df9689a4c17bfc5b6d860666912417.exe	29
PID 2836 wrote to memory of 3040	2836	d4205c32a32976e3ff2cf981e2959ed4a8df9689a4c17bfc5b6d860666912417.exe	29
PID 2836 wrote to memory of 3040	2836	d4205c32a32976e3ff2cf981e2959ed4a8df9689a4c17bfc5b6d860666912417.exe	29
PID 2836 wrote to memory of 3040	2836	d4205c32a32976e3ff2cf981e2959ed4a8df9689a4c17bfc5b6d860666912417.exe	29
PID 2348 wrote to memory of 2448	2348	taskeng.exe	32
PID 2348 wrote to memory of 2448	2348	taskeng.exe	32
PID 2348 wrote to memory of 2448	2348	taskeng.exe	32
PID 2348 wrote to memory of 2448	2348	taskeng.exe	32
PID 2448 wrote to memory of 3064	2448	setspn.exe	33
PID 2448 wrote to memory of 3064	2448	setspn.exe	33
PID 2448 wrote to memory of 3064	2448	setspn.exe	33
PID 2448 wrote to memory of 3064	2448	setspn.exe	33
PID 2448 wrote to memory of 3064	2448	setspn.exe	33
PID 2448 wrote to memory of 3064	2448	setspn.exe	33
PID 2448 wrote to memory of 3064	2448	setspn.exe	33
PID 2448 wrote to memory of 3064	2448	setspn.exe	33
PID 2448 wrote to memory of 3064	2448	setspn.exe	33
PID 2448 wrote to memory of 2708	2448	setspn.exe	34
PID 2448 wrote to memory of 2708	2448	setspn.exe	34
PID 2448 wrote to memory of 2708	2448	setspn.exe	34
PID 2448 wrote to memory of 2708	2448	setspn.exe	34
PID 2348 wrote to memory of 2892	2348	taskeng.exe	38
PID 2348 wrote to memory of 2892	2348	taskeng.exe	38
PID 2348 wrote to memory of 2892	2348	taskeng.exe	38
PID 2348 wrote to memory of 2892	2348	taskeng.exe	38
PID 2892 wrote to memory of 2008	2892	setspn.exe	39
PID 2892 wrote to memory of 2008	2892	setspn.exe	39
PID 2892 wrote to memory of 2008	2892	setspn.exe	39
PID 2892 wrote to memory of 2008	2892	setspn.exe	39
PID 2892 wrote to memory of 2008	2892	setspn.exe	39
PID 2892 wrote to memory of 2008	2892	setspn.exe	39
PID 2892 wrote to memory of 2008	2892	setspn.exe	39
PID 2892 wrote to memory of 2008	2892	setspn.exe	39
PID 2892 wrote to memory of 2008	2892	setspn.exe	39
PID 2892 wrote to memory of 268	2892	setspn.exe	40
PID 2892 wrote to memory of 268	2892	setspn.exe	40
PID 2892 wrote to memory of 268	2892	setspn.exe	40
PID 2892 wrote to memory of 268	2892	setspn.exe	40
PID 2348 wrote to memory of 1216	2348	taskeng.exe	42
PID 2348 wrote to memory of 1216	2348	taskeng.exe	42
PID 2348 wrote to memory of 1216	2348	taskeng.exe	42
PID 2348 wrote to memory of 1216	2348	taskeng.exe	42
PID 1216 wrote to memory of 1292	1216	setspn.exe	43
PID 1216 wrote to memory of 1292	1216	setspn.exe	43
PID 1216 wrote to memory of 1292	1216	setspn.exe	43
PID 1216 wrote to memory of 1292	1216	setspn.exe	43
PID 1216 wrote to memory of 1292	1216	setspn.exe	43
PID 1216 wrote to memory of 1292	1216	setspn.exe	43
PID 1216 wrote to memory of 1292	1216	setspn.exe	43
PID 1216 wrote to memory of 1292	1216	setspn.exe	43
PID 1216 wrote to memory of 1292	1216	setspn.exe	43
PID 1216 wrote to memory of 912	1216	setspn.exe	44
PID 1216 wrote to memory of 912	1216	setspn.exe	44
PID 1216 wrote to memory of 912	1216	setspn.exe	44
PID 1216 wrote to memory of 912	1216	setspn.exe	44

C:\Users\Admin\AppData\Local\Temp\d4205c32a32976e3ff2cf981e2959ed4a8df9689a4c17bfc5b6d860666912417.exe
"C:\Users\Admin\AppData\Local\Temp\d4205c32a32976e3ff2cf981e2959ed4a8df9689a4c17bfc5b6d860666912417.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2072
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F
  2⤵
  - Creates scheduled task(s)
  PID:3040

C:\Windows\system32\taskeng.exe
taskeng.exe {E7041465-7AA9-4773-9B16-2A2AB38B6DF8} S-1-5-21-2248906074-2862704502-246302768-1000:GHPZRGFC\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe
  C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2448
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    PID:3064
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F
    3⤵
    - Creates scheduled task(s)
    PID:2708
- C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe
  C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2892
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    PID:2008
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F
    3⤵
    - Creates scheduled task(s)
    PID:268
- C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe
  C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1216
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    PID:1292
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F
    3⤵
    - Creates scheduled task(s)
    PID:912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe

Filesize
2.6MB

MD5
2d0d0d1df18287e9ac2185304a112487

SHA1
fd81b2775ff49d28ae667ced0be2f0d82423f8ea

SHA256
2839fdb2aaa6ae7e8188a2daa60236fc559827bb80f3ce90986cdebc84a15072

SHA512
3a0a8e1d0f580a91f211fa11e0d459c52f5c7f5488d194f71906f68897d759bdf9160211c309f7d5a4a40d05ae3153ad199486cfd1b5a4895cfaba44315bdee0

Download Submit
C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe

Filesize
1005KB

MD5
e332509219d61e7f38a150097dd39ee0

SHA1
a068759ba13f96d8a6c554dfcb6fee1a12f3ead0

SHA256
c96e8a946fab382b6173a070ed713d7129290a04018c269b59d16197956571a3

SHA512
5c424a01653d0290f063c4a5a4503703a5086b9c738974fad48ecb2f8bba11e3f41d844e7ec402f745d12308527bdf2afc221e795d0e058e5404747b6ef26367

Download Submit
C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe

Filesize
581KB

MD5
1ad64bf55ca92c40047442ce4305f5e6

SHA1
3b1000b8b1b9457faa64d433e303f2e54260de42

SHA256
86c0f4f6beb6732b7e374e41b8c03f7f38a3b80385e140bc039df4077b6c47fc

SHA512
c977bfbefa080aa9f96f5dec8723763c4b5082c459446accb48d90385d28091fe462022589c63de9860a6692dae00d04711f14d9877c80c1dbe2420670563cb4

Download Submit
memory/1216-55-0x00000000009B0000-0x0000000000C5A000-memory.dmp

Filesize
2.7MB

Download
memory/1292-65-0x0000000074880000-0x0000000074F6E000-memory.dmp

Filesize
6.9MB

Download
memory/2008-53-0x0000000074880000-0x0000000074F6E000-memory.dmp

Filesize
6.9MB

Download
memory/2008-52-0x0000000000220000-0x0000000000260000-memory.dmp

Filesize
256KB

Download
memory/2008-51-0x0000000074880000-0x0000000074F6E000-memory.dmp

Filesize
6.9MB

Download
memory/2072-23-0x0000000004840000-0x0000000004880000-memory.dmp

Filesize
256KB

Download
memory/2072-11-0x0000000000400000-0x00000000004EA000-memory.dmp

Filesize
936KB

Download
memory/2072-17-0x0000000000790000-0x00000000007EC000-memory.dmp

Filesize
368KB

Download
memory/2072-18-0x00000000007F0000-0x0000000000802000-memory.dmp

Filesize
72KB

Download
memory/2072-20-0x0000000000AC0000-0x0000000000AD8000-memory.dmp

Filesize
96KB

Download
memory/2072-19-0x0000000000810000-0x0000000000818000-memory.dmp

Filesize
32KB

Download
memory/2072-21-0x0000000000B40000-0x0000000000B50000-memory.dmp

Filesize
64KB

Download
memory/2072-22-0x0000000074880000-0x0000000074F6E000-memory.dmp

Filesize
6.9MB

Download
memory/2072-2-0x0000000000400000-0x00000000004EA000-memory.dmp

Filesize
936KB

Download
memory/2072-15-0x0000000004840000-0x0000000004880000-memory.dmp

Filesize
256KB

Download
memory/2072-4-0x0000000000400000-0x00000000004EA000-memory.dmp

Filesize
936KB

Download
memory/2072-8-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2072-10-0x0000000000400000-0x00000000004EA000-memory.dmp

Filesize
936KB

Download
memory/2072-16-0x0000000000290000-0x000000000029E000-memory.dmp

Filesize
56KB

Download
memory/2072-14-0x0000000074880000-0x0000000074F6E000-memory.dmp

Filesize
6.9MB

Download
memory/2448-26-0x0000000000DF0000-0x000000000109A000-memory.dmp

Filesize
2.7MB

Download
memory/2836-0-0x0000000000020000-0x00000000002CA000-memory.dmp

Filesize
2.7MB

Download
memory/2836-1-0x0000000000420000-0x0000000000421000-memory.dmp

Filesize
4KB

Download
memory/2892-40-0x0000000000260000-0x000000000050A000-memory.dmp

Filesize
2.7MB

Download
memory/3064-36-0x0000000074880000-0x0000000074F6E000-memory.dmp

Filesize
6.9MB

Download
memory/3064-38-0x0000000074880000-0x0000000074F6E000-memory.dmp

Filesize
6.9MB

Download
memory/3064-37-0x00000000041B0000-0x00000000041F0000-memory.dmp

Filesize
256KB

Download
memory/3064-35-0x0000000000170000-0x000000000025A000-memory.dmp

Filesize
936KB

Download
memory/3064-34-0x0000000000170000-0x000000000025A000-memory.dmp

Filesize
936KB

Download
memory/3064-28-0x0000000000170000-0x000000000025A000-memory.dmp

Filesize
936KB

Download