Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    12-04-2024 22:19

General

  • Target

    6f4fe8932a9950e7ef10385b0dc250375d747a0f79c4ff83f7ea247b4154e540.exe

  • Size

    2.6MB

  • MD5

    5f4c17dd08313ff9a678db7e3e5ce11d

  • SHA1

    e9539fff9f44d99bf5a14e32398031a3c416bfc2

  • SHA256

    6f4fe8932a9950e7ef10385b0dc250375d747a0f79c4ff83f7ea247b4154e540

  • SHA512

    488524d07bc7daa4656db295abede19b4f2f18d8bf063ddf98d59ab6f6aabb8f7bbbec0870b05aac8188fe5cc8a01da09c39e94349bea0d2ca78e77b1d3562d8

  • SSDEEP

    24576:SAHnh+eWsN3skA4RV1Hom2KXSmHdK3VqbE6przwKpwvEuM/SD0wugdDEl6NrL/Na:Vh+ZkldoPKiYdKr9k

Malware Config

Extracted

Family

orcus

Botnet

ligeon

C2

ligeon.ddns.net:1606

Mutex

b98fb09a59c24a81b9d17a55ccf2c036

Attributes
  • autostart_method

    Disable

  • enable_keylogger

    true

  • install_path

    %programfiles%\Orcus\Orcus.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\OrcusWatchdog.exe

Signatures

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

  • Detects executables containing common artifacts observed in infostealers 9 IoCs
  • Detects executables manipulated with Fody 9 IoCs
  • Orcurs Rat Executable 9 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 3 IoCs
  • AutoIT Executable 4 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6f4fe8932a9950e7ef10385b0dc250375d747a0f79c4ff83f7ea247b4154e540.exe
    "C:\Users\Admin\AppData\Local\Temp\6f4fe8932a9950e7ef10385b0dc250375d747a0f79c4ff83f7ea247b4154e540.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1624
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2968
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F
      2⤵
      • Creates scheduled task(s)
      PID:3020
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /k ping 127.0.0.1 -t 0 & del C:\Users\Admin\AppData\Local\Temp\6f4fe8932a9950e7ef10385b0dc250375d747a0f79c4ff83f7ea247b4154e540.exe & exit
      2⤵
      • Deletes itself
      • Suspicious use of WriteProcessMemory
      PID:2676
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -t 0
        3⤵
        • Runs ping.exe
        PID:2072
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {96B5E806-585E-401C-80B7-6426BE7EF058} S-1-5-21-330940541-141609230-1670313778-1000:KXIPPCKF\Admin:Interactive:[1]
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2404
    • C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe
      C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2484
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        3⤵
          PID:2392
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F
          3⤵
          • Creates scheduled task(s)
          PID:1620
      • C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe
        C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1272
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
          3⤵
            PID:748
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F
            3⤵
            • Creates scheduled task(s)
            PID:2768
        • C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe
          C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe
          2⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2128
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
            3⤵
              PID:2024
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F
              3⤵
              • Creates scheduled task(s)
              PID:1052

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe

          Filesize

          2.6MB

          MD5

          fa7fe85c6ea94c131e0b7e88c7d0fd01

          SHA1

          95990b3b8ba92503d19818d005a29e436384975e

          SHA256

          d08f111fb5df0aa87c60ca7f4336c4fa5fcef5915f7030b0c0d673077f5b3ac7

          SHA512

          5ab9285394d862ad8446d7db776ac7a536c15060e46fbfe62c5b63f03ef95a347186629cc8fe761929af80be139943af41dfe186717a060ef4b44ce72ec199dd

        • memory/748-53-0x00000000745B0000-0x0000000074C9E000-memory.dmp

          Filesize

          6.9MB

        • memory/748-51-0x00000000745B0000-0x0000000074C9E000-memory.dmp

          Filesize

          6.9MB

        • memory/748-52-0x0000000004BC0000-0x0000000004C00000-memory.dmp

          Filesize

          256KB

        • memory/1272-41-0x0000000000E70000-0x000000000111A000-memory.dmp

          Filesize

          2.7MB

        • memory/1624-1-0x0000000000560000-0x0000000000561000-memory.dmp

          Filesize

          4KB

        • memory/1624-0-0x0000000000CB0000-0x0000000000F5A000-memory.dmp

          Filesize

          2.7MB

        • memory/2024-64-0x0000000000400000-0x00000000004EA000-memory.dmp

          Filesize

          936KB

        • memory/2024-57-0x0000000000400000-0x00000000004EA000-memory.dmp

          Filesize

          936KB

        • memory/2024-61-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

          Filesize

          4KB

        • memory/2024-63-0x0000000000400000-0x00000000004EA000-memory.dmp

          Filesize

          936KB

        • memory/2024-65-0x00000000745B0000-0x0000000074C9E000-memory.dmp

          Filesize

          6.9MB

        • memory/2024-66-0x00000000048D0000-0x0000000004910000-memory.dmp

          Filesize

          256KB

        • memory/2392-34-0x0000000000090000-0x000000000017A000-memory.dmp

          Filesize

          936KB

        • memory/2392-39-0x00000000745B0000-0x0000000074C9E000-memory.dmp

          Filesize

          6.9MB

        • memory/2392-38-0x00000000047B0000-0x00000000047F0000-memory.dmp

          Filesize

          256KB

        • memory/2392-37-0x00000000745B0000-0x0000000074C9E000-memory.dmp

          Filesize

          6.9MB

        • memory/2392-35-0x0000000000090000-0x000000000017A000-memory.dmp

          Filesize

          936KB

        • memory/2392-27-0x0000000000090000-0x000000000017A000-memory.dmp

          Filesize

          936KB

        • memory/2484-24-0x0000000000E70000-0x000000000111A000-memory.dmp

          Filesize

          2.7MB

        • memory/2968-28-0x00000000745B0000-0x0000000074C9E000-memory.dmp

          Filesize

          6.9MB

        • memory/2968-36-0x0000000004DE0000-0x0000000004E20000-memory.dmp

          Filesize

          256KB

        • memory/2968-21-0x00000000008C0000-0x00000000008D0000-memory.dmp

          Filesize

          64KB

        • memory/2968-20-0x00000000006D0000-0x00000000006E8000-memory.dmp

          Filesize

          96KB

        • memory/2968-19-0x00000000006C0000-0x00000000006C8000-memory.dmp

          Filesize

          32KB

        • memory/2968-18-0x0000000000350000-0x0000000000362000-memory.dmp

          Filesize

          72KB

        • memory/2968-17-0x0000000000840000-0x000000000089C000-memory.dmp

          Filesize

          368KB

        • memory/2968-16-0x0000000000300000-0x000000000030E000-memory.dmp

          Filesize

          56KB

        • memory/2968-15-0x0000000004DE0000-0x0000000004E20000-memory.dmp

          Filesize

          256KB

        • memory/2968-14-0x00000000745B0000-0x0000000074C9E000-memory.dmp

          Filesize

          6.9MB

        • memory/2968-11-0x0000000000110000-0x00000000001FA000-memory.dmp

          Filesize

          936KB

        • memory/2968-10-0x0000000000110000-0x00000000001FA000-memory.dmp

          Filesize

          936KB

        • memory/2968-8-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

          Filesize

          4KB

        • memory/2968-4-0x0000000000110000-0x00000000001FA000-memory.dmp

          Filesize

          936KB

        • memory/2968-2-0x0000000000110000-0x00000000001FA000-memory.dmp

          Filesize

          936KB