Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-04-2024 01:39

General

  • Target

    c9e013f2006038b22d258f6d487afab62029c5d0c71a7ce8af85ae4ac00a444d.exe

  • Size

    3.0MB

  • MD5

    fb9c101e7ee4206d46e76123f639194c

  • SHA1

    5e83980f211ed8882cdbda90b374689d582e6cda

  • SHA256

    c9e013f2006038b22d258f6d487afab62029c5d0c71a7ce8af85ae4ac00a444d

  • SHA512

    60c3f32a31ed8d83aa1d915ed0ee0accffe8a6e3e88accc5037334f499e0ce02313a20dba9236261ab1fbe56c6c5836cdab51545c0d7668b941af27f6031ca74

  • SSDEEP

    49152:yldN8QFUwqYZeM9/ZzzBjMkPUayX82+YXAypQxb9ndo9JnCmGWncFf0I74gu3AM:y90wGGzBjryX82uypSb9ndo9JCm

Malware Config

Extracted

Family

orcus

C2

loocarpoint.duckdns.org:4782

Mutex

cc0d0b196e424f1bb95d117665f988e0

Attributes
  • autostart_method

    Disable

  • enable_keylogger

    false

  • install_path

    %programfiles%\Orcus\Orcus.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\kate_is_famous_holy_fuck

Signatures

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

  • Orcurs Rat Executable 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c9e013f2006038b22d258f6d487afab62029c5d0c71a7ce8af85ae4ac00a444d.exe
    "C:\Users\Admin\AppData\Local\Temp\c9e013f2006038b22d258f6d487afab62029c5d0c71a7ce8af85ae4ac00a444d.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:5012
    • C:\Program Files\Orcus\Orcus.exe
      "C:\Program Files\Orcus\Orcus.exe"
      2⤵
      • Executes dropped EXE
      • Modifies registry class
      PID:1684
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2548

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Orcus\Orcus.exe

    Filesize

    3.0MB

    MD5

    fb9c101e7ee4206d46e76123f639194c

    SHA1

    5e83980f211ed8882cdbda90b374689d582e6cda

    SHA256

    c9e013f2006038b22d258f6d487afab62029c5d0c71a7ce8af85ae4ac00a444d

    SHA512

    60c3f32a31ed8d83aa1d915ed0ee0accffe8a6e3e88accc5037334f499e0ce02313a20dba9236261ab1fbe56c6c5836cdab51545c0d7668b941af27f6031ca74

  • C:\Program Files\Orcus\Orcus.exe.config

    Filesize

    357B

    MD5

    a2b76cea3a59fa9af5ea21ff68139c98

    SHA1

    35d76475e6a54c168f536e30206578babff58274

    SHA256

    f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839

    SHA512

    b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad

  • memory/1684-20-0x00007FFCF2250000-0x00007FFCF2D11000-memory.dmp

    Filesize

    10.8MB

  • memory/1684-30-0x00000269CA0B0000-0x00000269CA0C0000-memory.dmp

    Filesize

    64KB

  • memory/1684-29-0x00007FFCF2250000-0x00007FFCF2D11000-memory.dmp

    Filesize

    10.8MB

  • memory/1684-25-0x00000269CA460000-0x00000269CA470000-memory.dmp

    Filesize

    64KB

  • memory/1684-24-0x00000269CA440000-0x00000269CA458000-memory.dmp

    Filesize

    96KB

  • memory/1684-23-0x00000269CA1C0000-0x00000269CA1D2000-memory.dmp

    Filesize

    72KB

  • memory/1684-22-0x00000269CA0B0000-0x00000269CA0C0000-memory.dmp

    Filesize

    64KB

  • memory/5012-4-0x0000016D3BFD0000-0x0000016D3BFE0000-memory.dmp

    Filesize

    64KB

  • memory/5012-21-0x00007FFCF2250000-0x00007FFCF2D11000-memory.dmp

    Filesize

    10.8MB

  • memory/5012-5-0x0000016D21DF0000-0x0000016D21E02000-memory.dmp

    Filesize

    72KB

  • memory/5012-0-0x0000016D21710000-0x0000016D21A0A000-memory.dmp

    Filesize

    3.0MB

  • memory/5012-3-0x00007FFCF2250000-0x00007FFCF2D11000-memory.dmp

    Filesize

    10.8MB

  • memory/5012-2-0x0000016D21DA0000-0x0000016D21DAE000-memory.dmp

    Filesize

    56KB

  • memory/5012-1-0x0000016D3BFE0000-0x0000016D3C03C000-memory.dmp

    Filesize

    368KB