Analysis
-
max time kernel
139s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
12-04-2024 01:44
Static task
static1
Behavioral task
behavioral1
Sample
9493166c5dffdf4306a1f048d605bf2deaa6d205c0b3f784705c9e34cde11c0d.exe
Resource
win7-20240221-en
General
-
Target
9493166c5dffdf4306a1f048d605bf2deaa6d205c0b3f784705c9e34cde11c0d.exe
-
Size
2.6MB
-
MD5
802ab14cdfbc0d972f94165b96d70704
-
SHA1
b304b72fa8359979e0c8640c73ebcc39ded92f8b
-
SHA256
9493166c5dffdf4306a1f048d605bf2deaa6d205c0b3f784705c9e34cde11c0d
-
SHA512
dd249bef419b0e0880884da339dc1615132b15994ac08fad3c62c02e2711be2c52d234ea40511c88eb3e894e9074510bc8a37fd0dd7775810579382fdaf48c41
-
SSDEEP
24576:SAHnh+eWsN3skA4RV1Hom2KXSmHdK3VqbE6przwKpwvEuM/SD0wugdDEl6NrL/Nq:Vh+ZkldoPKiYdKr9g
Malware Config
Extracted
orcus
ligeon
ligeon.ddns.net:1606
b98fb09a59c24a81b9d17a55ccf2c036
-
autostart_method
Disable
-
enable_keylogger
true
-
install_path
%programfiles%\Orcus\Orcus.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
Orcus
-
watchdog_path
AppData\OrcusWatchdog.exe
Signatures
-
Orcurs Rat Executable 9 IoCs
Processes:
resource yara_rule behavioral1/memory/3052-3-0x0000000000190000-0x000000000027A000-memory.dmp orcus behavioral1/memory/3052-9-0x0000000000190000-0x000000000027A000-memory.dmp orcus behavioral1/memory/3052-10-0x0000000000190000-0x000000000027A000-memory.dmp orcus behavioral1/memory/2788-27-0x0000000000150000-0x000000000023A000-memory.dmp orcus behavioral1/memory/2788-33-0x0000000000150000-0x000000000023A000-memory.dmp orcus behavioral1/memory/2788-34-0x0000000000150000-0x000000000023A000-memory.dmp orcus behavioral1/memory/2880-42-0x0000000000400000-0x00000000004EA000-memory.dmp orcus behavioral1/memory/2880-48-0x0000000000400000-0x00000000004EA000-memory.dmp orcus behavioral1/memory/2880-49-0x0000000000400000-0x00000000004EA000-memory.dmp orcus -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 3032 cmd.exe -
Executes dropped EXE 2 IoCs
Processes:
setspn.exesetspn.exepid process 1080 setspn.exe 1740 setspn.exe -
AutoIT Executable 4 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral1/memory/2844-0-0x0000000000C30000-0x0000000000EDA000-memory.dmp autoit_exe C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe autoit_exe behavioral1/memory/1080-25-0x0000000000920000-0x0000000000BCA000-memory.dmp autoit_exe behavioral1/memory/1740-39-0x0000000000330000-0x00000000005DA000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
9493166c5dffdf4306a1f048d605bf2deaa6d205c0b3f784705c9e34cde11c0d.exesetspn.exesetspn.exedescription pid process target process PID 2844 set thread context of 3052 2844 9493166c5dffdf4306a1f048d605bf2deaa6d205c0b3f784705c9e34cde11c0d.exe RegSvcs.exe PID 1080 set thread context of 2788 1080 setspn.exe RegSvcs.exe PID 1740 set thread context of 2880 1740 setspn.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 2740 schtasks.exe 1396 schtasks.exe 868 schtasks.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
9493166c5dffdf4306a1f048d605bf2deaa6d205c0b3f784705c9e34cde11c0d.exesetspn.exesetspn.exepid process 2844 9493166c5dffdf4306a1f048d605bf2deaa6d205c0b3f784705c9e34cde11c0d.exe 2844 9493166c5dffdf4306a1f048d605bf2deaa6d205c0b3f784705c9e34cde11c0d.exe 1080 setspn.exe 1080 setspn.exe 1740 setspn.exe 1740 setspn.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 3052 RegSvcs.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
RegSvcs.exepid process 3052 RegSvcs.exe -
Suspicious use of WriteProcessMemory 55 IoCs
Processes:
9493166c5dffdf4306a1f048d605bf2deaa6d205c0b3f784705c9e34cde11c0d.execmd.exetaskeng.exesetspn.exesetspn.exedescription pid process target process PID 2844 wrote to memory of 3052 2844 9493166c5dffdf4306a1f048d605bf2deaa6d205c0b3f784705c9e34cde11c0d.exe RegSvcs.exe PID 2844 wrote to memory of 3052 2844 9493166c5dffdf4306a1f048d605bf2deaa6d205c0b3f784705c9e34cde11c0d.exe RegSvcs.exe PID 2844 wrote to memory of 3052 2844 9493166c5dffdf4306a1f048d605bf2deaa6d205c0b3f784705c9e34cde11c0d.exe RegSvcs.exe PID 2844 wrote to memory of 3052 2844 9493166c5dffdf4306a1f048d605bf2deaa6d205c0b3f784705c9e34cde11c0d.exe RegSvcs.exe PID 2844 wrote to memory of 3052 2844 9493166c5dffdf4306a1f048d605bf2deaa6d205c0b3f784705c9e34cde11c0d.exe RegSvcs.exe PID 2844 wrote to memory of 3052 2844 9493166c5dffdf4306a1f048d605bf2deaa6d205c0b3f784705c9e34cde11c0d.exe RegSvcs.exe PID 2844 wrote to memory of 3052 2844 9493166c5dffdf4306a1f048d605bf2deaa6d205c0b3f784705c9e34cde11c0d.exe RegSvcs.exe PID 2844 wrote to memory of 3052 2844 9493166c5dffdf4306a1f048d605bf2deaa6d205c0b3f784705c9e34cde11c0d.exe RegSvcs.exe PID 2844 wrote to memory of 3052 2844 9493166c5dffdf4306a1f048d605bf2deaa6d205c0b3f784705c9e34cde11c0d.exe RegSvcs.exe PID 2844 wrote to memory of 2740 2844 9493166c5dffdf4306a1f048d605bf2deaa6d205c0b3f784705c9e34cde11c0d.exe schtasks.exe PID 2844 wrote to memory of 2740 2844 9493166c5dffdf4306a1f048d605bf2deaa6d205c0b3f784705c9e34cde11c0d.exe schtasks.exe PID 2844 wrote to memory of 2740 2844 9493166c5dffdf4306a1f048d605bf2deaa6d205c0b3f784705c9e34cde11c0d.exe schtasks.exe PID 2844 wrote to memory of 2740 2844 9493166c5dffdf4306a1f048d605bf2deaa6d205c0b3f784705c9e34cde11c0d.exe schtasks.exe PID 2844 wrote to memory of 3032 2844 9493166c5dffdf4306a1f048d605bf2deaa6d205c0b3f784705c9e34cde11c0d.exe cmd.exe PID 2844 wrote to memory of 3032 2844 9493166c5dffdf4306a1f048d605bf2deaa6d205c0b3f784705c9e34cde11c0d.exe cmd.exe PID 2844 wrote to memory of 3032 2844 9493166c5dffdf4306a1f048d605bf2deaa6d205c0b3f784705c9e34cde11c0d.exe cmd.exe PID 2844 wrote to memory of 3032 2844 9493166c5dffdf4306a1f048d605bf2deaa6d205c0b3f784705c9e34cde11c0d.exe cmd.exe PID 3032 wrote to memory of 2108 3032 cmd.exe PING.EXE PID 3032 wrote to memory of 2108 3032 cmd.exe PING.EXE PID 3032 wrote to memory of 2108 3032 cmd.exe PING.EXE PID 3032 wrote to memory of 2108 3032 cmd.exe PING.EXE PID 2928 wrote to memory of 1080 2928 taskeng.exe setspn.exe PID 2928 wrote to memory of 1080 2928 taskeng.exe setspn.exe PID 2928 wrote to memory of 1080 2928 taskeng.exe setspn.exe PID 2928 wrote to memory of 1080 2928 taskeng.exe setspn.exe PID 1080 wrote to memory of 2788 1080 setspn.exe RegSvcs.exe PID 1080 wrote to memory of 2788 1080 setspn.exe RegSvcs.exe PID 1080 wrote to memory of 2788 1080 setspn.exe RegSvcs.exe PID 1080 wrote to memory of 2788 1080 setspn.exe RegSvcs.exe PID 1080 wrote to memory of 2788 1080 setspn.exe RegSvcs.exe PID 1080 wrote to memory of 2788 1080 setspn.exe RegSvcs.exe PID 1080 wrote to memory of 2788 1080 setspn.exe RegSvcs.exe PID 1080 wrote to memory of 2788 1080 setspn.exe RegSvcs.exe PID 1080 wrote to memory of 2788 1080 setspn.exe RegSvcs.exe PID 1080 wrote to memory of 1396 1080 setspn.exe schtasks.exe PID 1080 wrote to memory of 1396 1080 setspn.exe schtasks.exe PID 1080 wrote to memory of 1396 1080 setspn.exe schtasks.exe PID 1080 wrote to memory of 1396 1080 setspn.exe schtasks.exe PID 2928 wrote to memory of 1740 2928 taskeng.exe setspn.exe PID 2928 wrote to memory of 1740 2928 taskeng.exe setspn.exe PID 2928 wrote to memory of 1740 2928 taskeng.exe setspn.exe PID 2928 wrote to memory of 1740 2928 taskeng.exe setspn.exe PID 1740 wrote to memory of 2880 1740 setspn.exe RegSvcs.exe PID 1740 wrote to memory of 2880 1740 setspn.exe RegSvcs.exe PID 1740 wrote to memory of 2880 1740 setspn.exe RegSvcs.exe PID 1740 wrote to memory of 2880 1740 setspn.exe RegSvcs.exe PID 1740 wrote to memory of 2880 1740 setspn.exe RegSvcs.exe PID 1740 wrote to memory of 2880 1740 setspn.exe RegSvcs.exe PID 1740 wrote to memory of 2880 1740 setspn.exe RegSvcs.exe PID 1740 wrote to memory of 2880 1740 setspn.exe RegSvcs.exe PID 1740 wrote to memory of 2880 1740 setspn.exe RegSvcs.exe PID 1740 wrote to memory of 868 1740 setspn.exe schtasks.exe PID 1740 wrote to memory of 868 1740 setspn.exe schtasks.exe PID 1740 wrote to memory of 868 1740 setspn.exe schtasks.exe PID 1740 wrote to memory of 868 1740 setspn.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9493166c5dffdf4306a1f048d605bf2deaa6d205c0b3f784705c9e34cde11c0d.exe"C:\Users\Admin\AppData\Local\Temp\9493166c5dffdf4306a1f048d605bf2deaa6d205c0b3f784705c9e34cde11c0d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3052 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:2740 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /k ping 127.0.0.1 -t 0 & del C:\Users\Admin\AppData\Local\Temp\9493166c5dffdf4306a1f048d605bf2deaa6d205c0b3f784705c9e34cde11c0d.exe & exit2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -t 03⤵
- Runs ping.exe
PID:2108
-
C:\Windows\system32\taskeng.exetaskeng.exe {1CB16B23-3DB8-4C5D-9576-2400E1FD8FEF} S-1-5-21-3452737119-3959686427-228443150-1000:QGTQZTRE\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exeC:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵PID:2788
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F3⤵
- Creates scheduled task(s)
PID:1396 -
C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exeC:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵PID:2880
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F3⤵
- Creates scheduled task(s)
PID:868
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.6MB
MD5fa4e0068deb665f1dbb02eb507019eb1
SHA1993fd6337e03756a43a30309ec3ca2f3cadaff15
SHA25607bd83807aede329f1e6b621034405199fbbb49054ee02ba5f384c3e2a3e378d
SHA5122afc8cbe6887eeab2d0a895132fd003063a028b07049c15f391185bd21c682326146ee5b9c50a9df1521abd8bccd2fb7c77ce4a906bd98ae3416f1e09d82a386