Analysis
-
max time kernel
154s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
12-04-2024 22:19
Static task
static1
Behavioral task
behavioral1
Sample
6f4fe8932a9950e7ef10385b0dc250375d747a0f79c4ff83f7ea247b4154e540.exe
Resource
win7-20240221-en
General
-
Target
6f4fe8932a9950e7ef10385b0dc250375d747a0f79c4ff83f7ea247b4154e540.exe
-
Size
2.6MB
-
MD5
5f4c17dd08313ff9a678db7e3e5ce11d
-
SHA1
e9539fff9f44d99bf5a14e32398031a3c416bfc2
-
SHA256
6f4fe8932a9950e7ef10385b0dc250375d747a0f79c4ff83f7ea247b4154e540
-
SHA512
488524d07bc7daa4656db295abede19b4f2f18d8bf063ddf98d59ab6f6aabb8f7bbbec0870b05aac8188fe5cc8a01da09c39e94349bea0d2ca78e77b1d3562d8
-
SSDEEP
24576:SAHnh+eWsN3skA4RV1Hom2KXSmHdK3VqbE6przwKpwvEuM/SD0wugdDEl6NrL/Na:Vh+ZkldoPKiYdKr9k
Malware Config
Extracted
orcus
ligeon
ligeon.ddns.net:1606
b98fb09a59c24a81b9d17a55ccf2c036
-
autostart_method
Disable
-
enable_keylogger
true
-
install_path
%programfiles%\Orcus\Orcus.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
Orcus
-
watchdog_path
AppData\OrcusWatchdog.exe
Signatures
-
Detects executables containing common artifacts observed in infostealers 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3724-2-0x0000000000500000-0x00000000005EA000-memory.dmp INDICATOR_SUSPICIOUS_GENInfoStealer behavioral2/memory/4928-26-0x0000000000400000-0x00000000004EA000-memory.dmp INDICATOR_SUSPICIOUS_GENInfoStealer behavioral2/memory/3808-37-0x0000000000900000-0x00000000009EA000-memory.dmp INDICATOR_SUSPICIOUS_GENInfoStealer -
Detects executables manipulated with Fody 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3724-2-0x0000000000500000-0x00000000005EA000-memory.dmp INDICATOR_EXE_Packed_Fody behavioral2/memory/4928-26-0x0000000000400000-0x00000000004EA000-memory.dmp INDICATOR_EXE_Packed_Fody behavioral2/memory/3808-37-0x0000000000900000-0x00000000009EA000-memory.dmp INDICATOR_EXE_Packed_Fody -
Orcurs Rat Executable 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3724-2-0x0000000000500000-0x00000000005EA000-memory.dmp orcus behavioral2/memory/4928-26-0x0000000000400000-0x00000000004EA000-memory.dmp orcus behavioral2/memory/3808-37-0x0000000000900000-0x00000000009EA000-memory.dmp orcus -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
6f4fe8932a9950e7ef10385b0dc250375d747a0f79c4ff83f7ea247b4154e540.exesetspn.exesetspn.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3198953144-1466794930-246379610-1000\Control Panel\International\Geo\Nation 6f4fe8932a9950e7ef10385b0dc250375d747a0f79c4ff83f7ea247b4154e540.exe Key value queried \REGISTRY\USER\S-1-5-21-3198953144-1466794930-246379610-1000\Control Panel\International\Geo\Nation setspn.exe Key value queried \REGISTRY\USER\S-1-5-21-3198953144-1466794930-246379610-1000\Control Panel\International\Geo\Nation setspn.exe -
Executes dropped EXE 2 IoCs
Processes:
setspn.exesetspn.exepid process 3220 setspn.exe 4564 setspn.exe -
AutoIT Executable 4 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral2/memory/2828-0-0x0000000000C30000-0x0000000000EDA000-memory.dmp autoit_exe C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe autoit_exe behavioral2/memory/3220-24-0x0000000000AC0000-0x0000000000D6A000-memory.dmp autoit_exe behavioral2/memory/4564-36-0x0000000000AC0000-0x0000000000D6A000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
6f4fe8932a9950e7ef10385b0dc250375d747a0f79c4ff83f7ea247b4154e540.exesetspn.exesetspn.exedescription pid process target process PID 2828 set thread context of 3724 2828 6f4fe8932a9950e7ef10385b0dc250375d747a0f79c4ff83f7ea247b4154e540.exe RegSvcs.exe PID 3220 set thread context of 4928 3220 setspn.exe RegSvcs.exe PID 4564 set thread context of 3808 4564 setspn.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 4844 schtasks.exe 3648 schtasks.exe 4704 schtasks.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
6f4fe8932a9950e7ef10385b0dc250375d747a0f79c4ff83f7ea247b4154e540.exesetspn.exesetspn.exepid process 2828 6f4fe8932a9950e7ef10385b0dc250375d747a0f79c4ff83f7ea247b4154e540.exe 2828 6f4fe8932a9950e7ef10385b0dc250375d747a0f79c4ff83f7ea247b4154e540.exe 2828 6f4fe8932a9950e7ef10385b0dc250375d747a0f79c4ff83f7ea247b4154e540.exe 2828 6f4fe8932a9950e7ef10385b0dc250375d747a0f79c4ff83f7ea247b4154e540.exe 3220 setspn.exe 3220 setspn.exe 3220 setspn.exe 3220 setspn.exe 4564 setspn.exe 4564 setspn.exe 4564 setspn.exe 4564 setspn.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 3724 RegSvcs.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
RegSvcs.exepid process 3724 RegSvcs.exe -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
6f4fe8932a9950e7ef10385b0dc250375d747a0f79c4ff83f7ea247b4154e540.execmd.exesetspn.exesetspn.exedescription pid process target process PID 2828 wrote to memory of 3724 2828 6f4fe8932a9950e7ef10385b0dc250375d747a0f79c4ff83f7ea247b4154e540.exe RegSvcs.exe PID 2828 wrote to memory of 3724 2828 6f4fe8932a9950e7ef10385b0dc250375d747a0f79c4ff83f7ea247b4154e540.exe RegSvcs.exe PID 2828 wrote to memory of 3724 2828 6f4fe8932a9950e7ef10385b0dc250375d747a0f79c4ff83f7ea247b4154e540.exe RegSvcs.exe PID 2828 wrote to memory of 3724 2828 6f4fe8932a9950e7ef10385b0dc250375d747a0f79c4ff83f7ea247b4154e540.exe RegSvcs.exe PID 2828 wrote to memory of 3724 2828 6f4fe8932a9950e7ef10385b0dc250375d747a0f79c4ff83f7ea247b4154e540.exe RegSvcs.exe PID 2828 wrote to memory of 4844 2828 6f4fe8932a9950e7ef10385b0dc250375d747a0f79c4ff83f7ea247b4154e540.exe schtasks.exe PID 2828 wrote to memory of 4844 2828 6f4fe8932a9950e7ef10385b0dc250375d747a0f79c4ff83f7ea247b4154e540.exe schtasks.exe PID 2828 wrote to memory of 4844 2828 6f4fe8932a9950e7ef10385b0dc250375d747a0f79c4ff83f7ea247b4154e540.exe schtasks.exe PID 2828 wrote to memory of 2072 2828 6f4fe8932a9950e7ef10385b0dc250375d747a0f79c4ff83f7ea247b4154e540.exe cmd.exe PID 2828 wrote to memory of 2072 2828 6f4fe8932a9950e7ef10385b0dc250375d747a0f79c4ff83f7ea247b4154e540.exe cmd.exe PID 2828 wrote to memory of 2072 2828 6f4fe8932a9950e7ef10385b0dc250375d747a0f79c4ff83f7ea247b4154e540.exe cmd.exe PID 2072 wrote to memory of 1108 2072 cmd.exe PING.EXE PID 2072 wrote to memory of 1108 2072 cmd.exe PING.EXE PID 2072 wrote to memory of 1108 2072 cmd.exe PING.EXE PID 3220 wrote to memory of 4928 3220 setspn.exe RegSvcs.exe PID 3220 wrote to memory of 4928 3220 setspn.exe RegSvcs.exe PID 3220 wrote to memory of 4928 3220 setspn.exe RegSvcs.exe PID 3220 wrote to memory of 4928 3220 setspn.exe RegSvcs.exe PID 3220 wrote to memory of 4928 3220 setspn.exe RegSvcs.exe PID 3220 wrote to memory of 3648 3220 setspn.exe schtasks.exe PID 3220 wrote to memory of 3648 3220 setspn.exe schtasks.exe PID 3220 wrote to memory of 3648 3220 setspn.exe schtasks.exe PID 4564 wrote to memory of 3808 4564 setspn.exe RegSvcs.exe PID 4564 wrote to memory of 3808 4564 setspn.exe RegSvcs.exe PID 4564 wrote to memory of 3808 4564 setspn.exe RegSvcs.exe PID 4564 wrote to memory of 3808 4564 setspn.exe RegSvcs.exe PID 4564 wrote to memory of 3808 4564 setspn.exe RegSvcs.exe PID 4564 wrote to memory of 4704 4564 setspn.exe schtasks.exe PID 4564 wrote to memory of 4704 4564 setspn.exe schtasks.exe PID 4564 wrote to memory of 4704 4564 setspn.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6f4fe8932a9950e7ef10385b0dc250375d747a0f79c4ff83f7ea247b4154e540.exe"C:\Users\Admin\AppData\Local\Temp\6f4fe8932a9950e7ef10385b0dc250375d747a0f79c4ff83f7ea247b4154e540.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3724 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:4844 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /k ping 127.0.0.1 -t 0 & del C:\Users\Admin\AppData\Local\Temp\6f4fe8932a9950e7ef10385b0dc250375d747a0f79c4ff83f7ea247b4154e540.exe & exit2⤵
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -t 03⤵
- Runs ping.exe
PID:1108
-
C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exeC:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵PID:4928
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:3648
-
C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exeC:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵PID:3808
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:4704
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD50672db2ef13237d5cb85075ff4915942
SHA1ad8b4d3eb5e40791c47d48b22e273486f25f663f
SHA2560a933408890369b5a178f9c30aa93d2c94f425650815cf8e8310de4e90a3b519
SHA51284ad10ba5b695567d33a52f786405a5544aa49d8d23631ba9edf3afa877c5dbd81570d15bcf74bce5d9fb1afad2117d0a4ef913b396c0d923afefe615619c84b
-
Filesize
2.6MB
MD57fdf2383de62605899eb6eef180d7c90
SHA1024c572aa6aeb4234aa54445fc325f6d347fca3e
SHA2562026935bb67c0de3347c28d4f713861f97d6dc9c42d89d47ebe0713d2f04f21e
SHA512ebb11d0cf82eaa0112c7ad9da2041d8a947f7dac83782d927ad0739e746a6d59e25e2ff4f1154e4fe69bac63ae6873a555324a9e5b3be7ea635feea3e58966bd