Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
12-04-2024 22:19
Static task
static1
Behavioral task
behavioral1
Sample
6f4fe8932a9950e7ef10385b0dc250375d747a0f79c4ff83f7ea247b4154e540.exe
Resource
win7-20240221-en
General
-
Target
6f4fe8932a9950e7ef10385b0dc250375d747a0f79c4ff83f7ea247b4154e540.exe
-
Size
2.6MB
-
MD5
5f4c17dd08313ff9a678db7e3e5ce11d
-
SHA1
e9539fff9f44d99bf5a14e32398031a3c416bfc2
-
SHA256
6f4fe8932a9950e7ef10385b0dc250375d747a0f79c4ff83f7ea247b4154e540
-
SHA512
488524d07bc7daa4656db295abede19b4f2f18d8bf063ddf98d59ab6f6aabb8f7bbbec0870b05aac8188fe5cc8a01da09c39e94349bea0d2ca78e77b1d3562d8
-
SSDEEP
24576:SAHnh+eWsN3skA4RV1Hom2KXSmHdK3VqbE6przwKpwvEuM/SD0wugdDEl6NrL/Na:Vh+ZkldoPKiYdKr9k
Malware Config
Extracted
orcus
ligeon
ligeon.ddns.net:1606
b98fb09a59c24a81b9d17a55ccf2c036
-
autostart_method
Disable
-
enable_keylogger
true
-
install_path
%programfiles%\Orcus\Orcus.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
Orcus
-
watchdog_path
AppData\OrcusWatchdog.exe
Signatures
-
Detects executables containing common artifacts observed in infostealers 9 IoCs
Processes:
resource yara_rule behavioral1/memory/2968-4-0x0000000000110000-0x00000000001FA000-memory.dmp INDICATOR_SUSPICIOUS_GENInfoStealer behavioral1/memory/2968-10-0x0000000000110000-0x00000000001FA000-memory.dmp INDICATOR_SUSPICIOUS_GENInfoStealer behavioral1/memory/2968-11-0x0000000000110000-0x00000000001FA000-memory.dmp INDICATOR_SUSPICIOUS_GENInfoStealer behavioral1/memory/2392-27-0x0000000000090000-0x000000000017A000-memory.dmp INDICATOR_SUSPICIOUS_GENInfoStealer behavioral1/memory/2392-34-0x0000000000090000-0x000000000017A000-memory.dmp INDICATOR_SUSPICIOUS_GENInfoStealer behavioral1/memory/2392-35-0x0000000000090000-0x000000000017A000-memory.dmp INDICATOR_SUSPICIOUS_GENInfoStealer behavioral1/memory/2024-57-0x0000000000400000-0x00000000004EA000-memory.dmp INDICATOR_SUSPICIOUS_GENInfoStealer behavioral1/memory/2024-63-0x0000000000400000-0x00000000004EA000-memory.dmp INDICATOR_SUSPICIOUS_GENInfoStealer behavioral1/memory/2024-64-0x0000000000400000-0x00000000004EA000-memory.dmp INDICATOR_SUSPICIOUS_GENInfoStealer -
Detects executables manipulated with Fody 9 IoCs
Processes:
resource yara_rule behavioral1/memory/2968-4-0x0000000000110000-0x00000000001FA000-memory.dmp INDICATOR_EXE_Packed_Fody behavioral1/memory/2968-10-0x0000000000110000-0x00000000001FA000-memory.dmp INDICATOR_EXE_Packed_Fody behavioral1/memory/2968-11-0x0000000000110000-0x00000000001FA000-memory.dmp INDICATOR_EXE_Packed_Fody behavioral1/memory/2392-27-0x0000000000090000-0x000000000017A000-memory.dmp INDICATOR_EXE_Packed_Fody behavioral1/memory/2392-34-0x0000000000090000-0x000000000017A000-memory.dmp INDICATOR_EXE_Packed_Fody behavioral1/memory/2392-35-0x0000000000090000-0x000000000017A000-memory.dmp INDICATOR_EXE_Packed_Fody behavioral1/memory/2024-57-0x0000000000400000-0x00000000004EA000-memory.dmp INDICATOR_EXE_Packed_Fody behavioral1/memory/2024-63-0x0000000000400000-0x00000000004EA000-memory.dmp INDICATOR_EXE_Packed_Fody behavioral1/memory/2024-64-0x0000000000400000-0x00000000004EA000-memory.dmp INDICATOR_EXE_Packed_Fody -
Orcurs Rat Executable 9 IoCs
Processes:
resource yara_rule behavioral1/memory/2968-4-0x0000000000110000-0x00000000001FA000-memory.dmp orcus behavioral1/memory/2968-10-0x0000000000110000-0x00000000001FA000-memory.dmp orcus behavioral1/memory/2968-11-0x0000000000110000-0x00000000001FA000-memory.dmp orcus behavioral1/memory/2392-27-0x0000000000090000-0x000000000017A000-memory.dmp orcus behavioral1/memory/2392-34-0x0000000000090000-0x000000000017A000-memory.dmp orcus behavioral1/memory/2392-35-0x0000000000090000-0x000000000017A000-memory.dmp orcus behavioral1/memory/2024-57-0x0000000000400000-0x00000000004EA000-memory.dmp orcus behavioral1/memory/2024-63-0x0000000000400000-0x00000000004EA000-memory.dmp orcus behavioral1/memory/2024-64-0x0000000000400000-0x00000000004EA000-memory.dmp orcus -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2676 cmd.exe -
Executes dropped EXE 3 IoCs
Processes:
setspn.exesetspn.exesetspn.exepid process 2484 setspn.exe 1272 setspn.exe 2128 setspn.exe -
AutoIT Executable 4 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral1/memory/1624-0-0x0000000000CB0000-0x0000000000F5A000-memory.dmp autoit_exe C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe autoit_exe behavioral1/memory/2484-24-0x0000000000E70000-0x000000000111A000-memory.dmp autoit_exe behavioral1/memory/1272-41-0x0000000000E70000-0x000000000111A000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
6f4fe8932a9950e7ef10385b0dc250375d747a0f79c4ff83f7ea247b4154e540.exesetspn.exesetspn.exesetspn.exedescription pid process target process PID 1624 set thread context of 2968 1624 6f4fe8932a9950e7ef10385b0dc250375d747a0f79c4ff83f7ea247b4154e540.exe RegSvcs.exe PID 2484 set thread context of 2392 2484 setspn.exe RegSvcs.exe PID 1272 set thread context of 748 1272 setspn.exe RegSvcs.exe PID 2128 set thread context of 2024 2128 setspn.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 1620 schtasks.exe 2768 schtasks.exe 1052 schtasks.exe 3020 schtasks.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
6f4fe8932a9950e7ef10385b0dc250375d747a0f79c4ff83f7ea247b4154e540.exesetspn.exesetspn.exesetspn.exepid process 1624 6f4fe8932a9950e7ef10385b0dc250375d747a0f79c4ff83f7ea247b4154e540.exe 1624 6f4fe8932a9950e7ef10385b0dc250375d747a0f79c4ff83f7ea247b4154e540.exe 2484 setspn.exe 2484 setspn.exe 1272 setspn.exe 1272 setspn.exe 2128 setspn.exe 2128 setspn.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 2968 RegSvcs.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
RegSvcs.exepid process 2968 RegSvcs.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
6f4fe8932a9950e7ef10385b0dc250375d747a0f79c4ff83f7ea247b4154e540.execmd.exetaskeng.exesetspn.exesetspn.exesetspn.exedescription pid process target process PID 1624 wrote to memory of 2968 1624 6f4fe8932a9950e7ef10385b0dc250375d747a0f79c4ff83f7ea247b4154e540.exe RegSvcs.exe PID 1624 wrote to memory of 2968 1624 6f4fe8932a9950e7ef10385b0dc250375d747a0f79c4ff83f7ea247b4154e540.exe RegSvcs.exe PID 1624 wrote to memory of 2968 1624 6f4fe8932a9950e7ef10385b0dc250375d747a0f79c4ff83f7ea247b4154e540.exe RegSvcs.exe PID 1624 wrote to memory of 2968 1624 6f4fe8932a9950e7ef10385b0dc250375d747a0f79c4ff83f7ea247b4154e540.exe RegSvcs.exe PID 1624 wrote to memory of 2968 1624 6f4fe8932a9950e7ef10385b0dc250375d747a0f79c4ff83f7ea247b4154e540.exe RegSvcs.exe PID 1624 wrote to memory of 2968 1624 6f4fe8932a9950e7ef10385b0dc250375d747a0f79c4ff83f7ea247b4154e540.exe RegSvcs.exe PID 1624 wrote to memory of 2968 1624 6f4fe8932a9950e7ef10385b0dc250375d747a0f79c4ff83f7ea247b4154e540.exe RegSvcs.exe PID 1624 wrote to memory of 2968 1624 6f4fe8932a9950e7ef10385b0dc250375d747a0f79c4ff83f7ea247b4154e540.exe RegSvcs.exe PID 1624 wrote to memory of 2968 1624 6f4fe8932a9950e7ef10385b0dc250375d747a0f79c4ff83f7ea247b4154e540.exe RegSvcs.exe PID 1624 wrote to memory of 3020 1624 6f4fe8932a9950e7ef10385b0dc250375d747a0f79c4ff83f7ea247b4154e540.exe schtasks.exe PID 1624 wrote to memory of 3020 1624 6f4fe8932a9950e7ef10385b0dc250375d747a0f79c4ff83f7ea247b4154e540.exe schtasks.exe PID 1624 wrote to memory of 3020 1624 6f4fe8932a9950e7ef10385b0dc250375d747a0f79c4ff83f7ea247b4154e540.exe schtasks.exe PID 1624 wrote to memory of 3020 1624 6f4fe8932a9950e7ef10385b0dc250375d747a0f79c4ff83f7ea247b4154e540.exe schtasks.exe PID 1624 wrote to memory of 2676 1624 6f4fe8932a9950e7ef10385b0dc250375d747a0f79c4ff83f7ea247b4154e540.exe cmd.exe PID 1624 wrote to memory of 2676 1624 6f4fe8932a9950e7ef10385b0dc250375d747a0f79c4ff83f7ea247b4154e540.exe cmd.exe PID 1624 wrote to memory of 2676 1624 6f4fe8932a9950e7ef10385b0dc250375d747a0f79c4ff83f7ea247b4154e540.exe cmd.exe PID 1624 wrote to memory of 2676 1624 6f4fe8932a9950e7ef10385b0dc250375d747a0f79c4ff83f7ea247b4154e540.exe cmd.exe PID 2676 wrote to memory of 2072 2676 cmd.exe PING.EXE PID 2676 wrote to memory of 2072 2676 cmd.exe PING.EXE PID 2676 wrote to memory of 2072 2676 cmd.exe PING.EXE PID 2676 wrote to memory of 2072 2676 cmd.exe PING.EXE PID 2404 wrote to memory of 2484 2404 taskeng.exe setspn.exe PID 2404 wrote to memory of 2484 2404 taskeng.exe setspn.exe PID 2404 wrote to memory of 2484 2404 taskeng.exe setspn.exe PID 2404 wrote to memory of 2484 2404 taskeng.exe setspn.exe PID 2484 wrote to memory of 2392 2484 setspn.exe RegSvcs.exe PID 2484 wrote to memory of 2392 2484 setspn.exe RegSvcs.exe PID 2484 wrote to memory of 2392 2484 setspn.exe RegSvcs.exe PID 2484 wrote to memory of 2392 2484 setspn.exe RegSvcs.exe PID 2484 wrote to memory of 2392 2484 setspn.exe RegSvcs.exe PID 2484 wrote to memory of 2392 2484 setspn.exe RegSvcs.exe PID 2484 wrote to memory of 2392 2484 setspn.exe RegSvcs.exe PID 2484 wrote to memory of 2392 2484 setspn.exe RegSvcs.exe PID 2484 wrote to memory of 2392 2484 setspn.exe RegSvcs.exe PID 2484 wrote to memory of 1620 2484 setspn.exe schtasks.exe PID 2484 wrote to memory of 1620 2484 setspn.exe schtasks.exe PID 2484 wrote to memory of 1620 2484 setspn.exe schtasks.exe PID 2484 wrote to memory of 1620 2484 setspn.exe schtasks.exe PID 2404 wrote to memory of 1272 2404 taskeng.exe setspn.exe PID 2404 wrote to memory of 1272 2404 taskeng.exe setspn.exe PID 2404 wrote to memory of 1272 2404 taskeng.exe setspn.exe PID 2404 wrote to memory of 1272 2404 taskeng.exe setspn.exe PID 1272 wrote to memory of 748 1272 setspn.exe RegSvcs.exe PID 1272 wrote to memory of 748 1272 setspn.exe RegSvcs.exe PID 1272 wrote to memory of 748 1272 setspn.exe RegSvcs.exe PID 1272 wrote to memory of 748 1272 setspn.exe RegSvcs.exe PID 1272 wrote to memory of 748 1272 setspn.exe RegSvcs.exe PID 1272 wrote to memory of 748 1272 setspn.exe RegSvcs.exe PID 1272 wrote to memory of 748 1272 setspn.exe RegSvcs.exe PID 1272 wrote to memory of 748 1272 setspn.exe RegSvcs.exe PID 1272 wrote to memory of 748 1272 setspn.exe RegSvcs.exe PID 1272 wrote to memory of 2768 1272 setspn.exe schtasks.exe PID 1272 wrote to memory of 2768 1272 setspn.exe schtasks.exe PID 1272 wrote to memory of 2768 1272 setspn.exe schtasks.exe PID 1272 wrote to memory of 2768 1272 setspn.exe schtasks.exe PID 2404 wrote to memory of 2128 2404 taskeng.exe setspn.exe PID 2404 wrote to memory of 2128 2404 taskeng.exe setspn.exe PID 2404 wrote to memory of 2128 2404 taskeng.exe setspn.exe PID 2404 wrote to memory of 2128 2404 taskeng.exe setspn.exe PID 2128 wrote to memory of 2024 2128 setspn.exe RegSvcs.exe PID 2128 wrote to memory of 2024 2128 setspn.exe RegSvcs.exe PID 2128 wrote to memory of 2024 2128 setspn.exe RegSvcs.exe PID 2128 wrote to memory of 2024 2128 setspn.exe RegSvcs.exe PID 2128 wrote to memory of 2024 2128 setspn.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6f4fe8932a9950e7ef10385b0dc250375d747a0f79c4ff83f7ea247b4154e540.exe"C:\Users\Admin\AppData\Local\Temp\6f4fe8932a9950e7ef10385b0dc250375d747a0f79c4ff83f7ea247b4154e540.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2968 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:3020 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /k ping 127.0.0.1 -t 0 & del C:\Users\Admin\AppData\Local\Temp\6f4fe8932a9950e7ef10385b0dc250375d747a0f79c4ff83f7ea247b4154e540.exe & exit2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -t 03⤵
- Runs ping.exe
PID:2072
-
C:\Windows\system32\taskeng.exetaskeng.exe {96B5E806-585E-401C-80B7-6426BE7EF058} S-1-5-21-330940541-141609230-1670313778-1000:KXIPPCKF\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exeC:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵PID:2392
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F3⤵
- Creates scheduled task(s)
PID:1620 -
C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exeC:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵PID:748
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F3⤵
- Creates scheduled task(s)
PID:2768 -
C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exeC:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵PID:2024
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F3⤵
- Creates scheduled task(s)
PID:1052
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.6MB
MD5fa7fe85c6ea94c131e0b7e88c7d0fd01
SHA195990b3b8ba92503d19818d005a29e436384975e
SHA256d08f111fb5df0aa87c60ca7f4336c4fa5fcef5915f7030b0c0d673077f5b3ac7
SHA5125ab9285394d862ad8446d7db776ac7a536c15060e46fbfe62c5b63f03ef95a347186629cc8fe761929af80be139943af41dfe186717a060ef4b44ce72ec199dd