Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
12-04-2024 01:44
Static task
static1
Behavioral task
behavioral1
Sample
02be5e1ff3d3187c1fd3a389210dadb5a59c8f9382736e50fe5e82f9c39acb3e.exe
Resource
win7-20240221-en
General
-
Target
02be5e1ff3d3187c1fd3a389210dadb5a59c8f9382736e50fe5e82f9c39acb3e.exe
-
Size
2.6MB
-
MD5
2881da0a29f1c8396704b74d8d583061
-
SHA1
6b157a9182997360d4adc3aade23a961564619d2
-
SHA256
02be5e1ff3d3187c1fd3a389210dadb5a59c8f9382736e50fe5e82f9c39acb3e
-
SHA512
4b8e58da698ce5a630237a3d80e1122347998c32448dca94eea1c2fb7cba97b44721132db65eed58cf47bf692030fd7204f468140ecb68421a894ff8b4a256f4
-
SSDEEP
24576:SAHnh+eWsN3skA4RV1Hom2KXSmHdK3VqbE6przwKpwvEuM/SD0wugdDEl6NrL/NP:Vh+ZkldoPKiYdKr9d
Malware Config
Extracted
orcus
ligeon
ligeon.ddns.net:1606
b98fb09a59c24a81b9d17a55ccf2c036
-
autostart_method
Disable
-
enable_keylogger
true
-
install_path
%programfiles%\Orcus\Orcus.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
Orcus
-
watchdog_path
AppData\OrcusWatchdog.exe
Signatures
-
Orcurs Rat Executable 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1604-1-0x0000000000400000-0x00000000004EA000-memory.dmp orcus behavioral2/memory/1664-26-0x0000000000600000-0x00000000006EA000-memory.dmp orcus -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
setspn.exe02be5e1ff3d3187c1fd3a389210dadb5a59c8f9382736e50fe5e82f9c39acb3e.exesetspn.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation setspn.exe Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation 02be5e1ff3d3187c1fd3a389210dadb5a59c8f9382736e50fe5e82f9c39acb3e.exe Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation setspn.exe -
Executes dropped EXE 2 IoCs
Processes:
setspn.exesetspn.exepid process 4112 setspn.exe 4628 setspn.exe -
AutoIT Executable 4 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral2/memory/2280-0-0x0000000000540000-0x00000000007EA000-memory.dmp autoit_exe C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe autoit_exe behavioral2/memory/4112-24-0x0000000000700000-0x00000000009AA000-memory.dmp autoit_exe behavioral2/memory/4628-36-0x0000000000700000-0x00000000009AA000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
02be5e1ff3d3187c1fd3a389210dadb5a59c8f9382736e50fe5e82f9c39acb3e.exesetspn.exesetspn.exedescription pid process target process PID 2280 set thread context of 1604 2280 02be5e1ff3d3187c1fd3a389210dadb5a59c8f9382736e50fe5e82f9c39acb3e.exe RegSvcs.exe PID 4112 set thread context of 1664 4112 setspn.exe RegSvcs.exe PID 4628 set thread context of 4772 4628 setspn.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 4768 schtasks.exe 3504 schtasks.exe 2564 schtasks.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
02be5e1ff3d3187c1fd3a389210dadb5a59c8f9382736e50fe5e82f9c39acb3e.exesetspn.exesetspn.exepid process 2280 02be5e1ff3d3187c1fd3a389210dadb5a59c8f9382736e50fe5e82f9c39acb3e.exe 2280 02be5e1ff3d3187c1fd3a389210dadb5a59c8f9382736e50fe5e82f9c39acb3e.exe 2280 02be5e1ff3d3187c1fd3a389210dadb5a59c8f9382736e50fe5e82f9c39acb3e.exe 2280 02be5e1ff3d3187c1fd3a389210dadb5a59c8f9382736e50fe5e82f9c39acb3e.exe 4112 setspn.exe 4112 setspn.exe 4112 setspn.exe 4112 setspn.exe 4628 setspn.exe 4628 setspn.exe 4628 setspn.exe 4628 setspn.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 1604 RegSvcs.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
RegSvcs.exepid process 1604 RegSvcs.exe -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
02be5e1ff3d3187c1fd3a389210dadb5a59c8f9382736e50fe5e82f9c39acb3e.execmd.exesetspn.exesetspn.exedescription pid process target process PID 2280 wrote to memory of 1604 2280 02be5e1ff3d3187c1fd3a389210dadb5a59c8f9382736e50fe5e82f9c39acb3e.exe RegSvcs.exe PID 2280 wrote to memory of 1604 2280 02be5e1ff3d3187c1fd3a389210dadb5a59c8f9382736e50fe5e82f9c39acb3e.exe RegSvcs.exe PID 2280 wrote to memory of 1604 2280 02be5e1ff3d3187c1fd3a389210dadb5a59c8f9382736e50fe5e82f9c39acb3e.exe RegSvcs.exe PID 2280 wrote to memory of 1604 2280 02be5e1ff3d3187c1fd3a389210dadb5a59c8f9382736e50fe5e82f9c39acb3e.exe RegSvcs.exe PID 2280 wrote to memory of 1604 2280 02be5e1ff3d3187c1fd3a389210dadb5a59c8f9382736e50fe5e82f9c39acb3e.exe RegSvcs.exe PID 2280 wrote to memory of 3504 2280 02be5e1ff3d3187c1fd3a389210dadb5a59c8f9382736e50fe5e82f9c39acb3e.exe schtasks.exe PID 2280 wrote to memory of 3504 2280 02be5e1ff3d3187c1fd3a389210dadb5a59c8f9382736e50fe5e82f9c39acb3e.exe schtasks.exe PID 2280 wrote to memory of 3504 2280 02be5e1ff3d3187c1fd3a389210dadb5a59c8f9382736e50fe5e82f9c39acb3e.exe schtasks.exe PID 2280 wrote to memory of 3740 2280 02be5e1ff3d3187c1fd3a389210dadb5a59c8f9382736e50fe5e82f9c39acb3e.exe cmd.exe PID 2280 wrote to memory of 3740 2280 02be5e1ff3d3187c1fd3a389210dadb5a59c8f9382736e50fe5e82f9c39acb3e.exe cmd.exe PID 2280 wrote to memory of 3740 2280 02be5e1ff3d3187c1fd3a389210dadb5a59c8f9382736e50fe5e82f9c39acb3e.exe cmd.exe PID 3740 wrote to memory of 1848 3740 cmd.exe PING.EXE PID 3740 wrote to memory of 1848 3740 cmd.exe PING.EXE PID 3740 wrote to memory of 1848 3740 cmd.exe PING.EXE PID 4112 wrote to memory of 1664 4112 setspn.exe RegSvcs.exe PID 4112 wrote to memory of 1664 4112 setspn.exe RegSvcs.exe PID 4112 wrote to memory of 1664 4112 setspn.exe RegSvcs.exe PID 4112 wrote to memory of 1664 4112 setspn.exe RegSvcs.exe PID 4112 wrote to memory of 1664 4112 setspn.exe RegSvcs.exe PID 4112 wrote to memory of 2564 4112 setspn.exe schtasks.exe PID 4112 wrote to memory of 2564 4112 setspn.exe schtasks.exe PID 4112 wrote to memory of 2564 4112 setspn.exe schtasks.exe PID 4628 wrote to memory of 4772 4628 setspn.exe RegSvcs.exe PID 4628 wrote to memory of 4772 4628 setspn.exe RegSvcs.exe PID 4628 wrote to memory of 4772 4628 setspn.exe RegSvcs.exe PID 4628 wrote to memory of 4772 4628 setspn.exe RegSvcs.exe PID 4628 wrote to memory of 4772 4628 setspn.exe RegSvcs.exe PID 4628 wrote to memory of 4768 4628 setspn.exe schtasks.exe PID 4628 wrote to memory of 4768 4628 setspn.exe schtasks.exe PID 4628 wrote to memory of 4768 4628 setspn.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\02be5e1ff3d3187c1fd3a389210dadb5a59c8f9382736e50fe5e82f9c39acb3e.exe"C:\Users\Admin\AppData\Local\Temp\02be5e1ff3d3187c1fd3a389210dadb5a59c8f9382736e50fe5e82f9c39acb3e.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1604 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:3504 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /k ping 127.0.0.1 -t 0 & del C:\Users\Admin\AppData\Local\Temp\02be5e1ff3d3187c1fd3a389210dadb5a59c8f9382736e50fe5e82f9c39acb3e.exe & exit2⤵
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -t 03⤵
- Runs ping.exe
PID:1848
-
C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exeC:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵PID:1664
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:2564
-
C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exeC:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵PID:4772
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:4768
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD50672db2ef13237d5cb85075ff4915942
SHA1ad8b4d3eb5e40791c47d48b22e273486f25f663f
SHA2560a933408890369b5a178f9c30aa93d2c94f425650815cf8e8310de4e90a3b519
SHA51284ad10ba5b695567d33a52f786405a5544aa49d8d23631ba9edf3afa877c5dbd81570d15bcf74bce5d9fb1afad2117d0a4ef913b396c0d923afefe615619c84b
-
Filesize
2.6MB
MD50adbd64b1acaf106bc1896574b43a261
SHA1352cdba221d19837930e63255dc4be1ee1c63f28
SHA2565743307aafc536348e8f56d3f9f092d00fc2b578642d9fae41e9342dd618525b
SHA512558c4be07392442acfac02c33a6afe9905a1faa73714d72966274b82e115266c15ed40cc7d14358fcc652c2b3f49175c808ce2524c22eaeb57fc976ceea3535f