Analysis
-
max time kernel
146s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
12-04-2024 01:44
Static task
static1
Behavioral task
behavioral1
Sample
9493166c5dffdf4306a1f048d605bf2deaa6d205c0b3f784705c9e34cde11c0d.exe
Resource
win7-20240221-en
General
-
Target
9493166c5dffdf4306a1f048d605bf2deaa6d205c0b3f784705c9e34cde11c0d.exe
-
Size
2.6MB
-
MD5
802ab14cdfbc0d972f94165b96d70704
-
SHA1
b304b72fa8359979e0c8640c73ebcc39ded92f8b
-
SHA256
9493166c5dffdf4306a1f048d605bf2deaa6d205c0b3f784705c9e34cde11c0d
-
SHA512
dd249bef419b0e0880884da339dc1615132b15994ac08fad3c62c02e2711be2c52d234ea40511c88eb3e894e9074510bc8a37fd0dd7775810579382fdaf48c41
-
SSDEEP
24576:SAHnh+eWsN3skA4RV1Hom2KXSmHdK3VqbE6przwKpwvEuM/SD0wugdDEl6NrL/Nq:Vh+ZkldoPKiYdKr9g
Malware Config
Extracted
orcus
ligeon
ligeon.ddns.net:1606
b98fb09a59c24a81b9d17a55ccf2c036
-
autostart_method
Disable
-
enable_keylogger
true
-
install_path
%programfiles%\Orcus\Orcus.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
Orcus
-
watchdog_path
AppData\OrcusWatchdog.exe
Signatures
-
Orcurs Rat Executable 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2072-1-0x0000000000400000-0x00000000004EA000-memory.dmp orcus -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
setspn.exesetspn.exe9493166c5dffdf4306a1f048d605bf2deaa6d205c0b3f784705c9e34cde11c0d.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation setspn.exe Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation setspn.exe Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation 9493166c5dffdf4306a1f048d605bf2deaa6d205c0b3f784705c9e34cde11c0d.exe -
Executes dropped EXE 2 IoCs
Processes:
setspn.exesetspn.exepid process 4016 setspn.exe 4940 setspn.exe -
AutoIT Executable 4 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral2/memory/4684-0-0x0000000000BF0000-0x0000000000E9A000-memory.dmp autoit_exe C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe autoit_exe behavioral2/memory/4016-24-0x00000000009F0000-0x0000000000C9A000-memory.dmp autoit_exe behavioral2/memory/4940-36-0x00000000009F0000-0x0000000000C9A000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
9493166c5dffdf4306a1f048d605bf2deaa6d205c0b3f784705c9e34cde11c0d.exesetspn.exesetspn.exedescription pid process target process PID 4684 set thread context of 2072 4684 9493166c5dffdf4306a1f048d605bf2deaa6d205c0b3f784705c9e34cde11c0d.exe RegSvcs.exe PID 4016 set thread context of 2700 4016 setspn.exe RegSvcs.exe PID 4940 set thread context of 3488 4940 setspn.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 2768 schtasks.exe 464 schtasks.exe 4440 schtasks.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
9493166c5dffdf4306a1f048d605bf2deaa6d205c0b3f784705c9e34cde11c0d.exesetspn.exesetspn.exepid process 4684 9493166c5dffdf4306a1f048d605bf2deaa6d205c0b3f784705c9e34cde11c0d.exe 4684 9493166c5dffdf4306a1f048d605bf2deaa6d205c0b3f784705c9e34cde11c0d.exe 4684 9493166c5dffdf4306a1f048d605bf2deaa6d205c0b3f784705c9e34cde11c0d.exe 4684 9493166c5dffdf4306a1f048d605bf2deaa6d205c0b3f784705c9e34cde11c0d.exe 4016 setspn.exe 4016 setspn.exe 4016 setspn.exe 4016 setspn.exe 4940 setspn.exe 4940 setspn.exe 4940 setspn.exe 4940 setspn.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 2072 RegSvcs.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
RegSvcs.exepid process 2072 RegSvcs.exe -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
9493166c5dffdf4306a1f048d605bf2deaa6d205c0b3f784705c9e34cde11c0d.execmd.exesetspn.exesetspn.exedescription pid process target process PID 4684 wrote to memory of 2072 4684 9493166c5dffdf4306a1f048d605bf2deaa6d205c0b3f784705c9e34cde11c0d.exe RegSvcs.exe PID 4684 wrote to memory of 2072 4684 9493166c5dffdf4306a1f048d605bf2deaa6d205c0b3f784705c9e34cde11c0d.exe RegSvcs.exe PID 4684 wrote to memory of 2072 4684 9493166c5dffdf4306a1f048d605bf2deaa6d205c0b3f784705c9e34cde11c0d.exe RegSvcs.exe PID 4684 wrote to memory of 2072 4684 9493166c5dffdf4306a1f048d605bf2deaa6d205c0b3f784705c9e34cde11c0d.exe RegSvcs.exe PID 4684 wrote to memory of 2072 4684 9493166c5dffdf4306a1f048d605bf2deaa6d205c0b3f784705c9e34cde11c0d.exe RegSvcs.exe PID 4684 wrote to memory of 2768 4684 9493166c5dffdf4306a1f048d605bf2deaa6d205c0b3f784705c9e34cde11c0d.exe schtasks.exe PID 4684 wrote to memory of 2768 4684 9493166c5dffdf4306a1f048d605bf2deaa6d205c0b3f784705c9e34cde11c0d.exe schtasks.exe PID 4684 wrote to memory of 2768 4684 9493166c5dffdf4306a1f048d605bf2deaa6d205c0b3f784705c9e34cde11c0d.exe schtasks.exe PID 4684 wrote to memory of 2764 4684 9493166c5dffdf4306a1f048d605bf2deaa6d205c0b3f784705c9e34cde11c0d.exe cmd.exe PID 4684 wrote to memory of 2764 4684 9493166c5dffdf4306a1f048d605bf2deaa6d205c0b3f784705c9e34cde11c0d.exe cmd.exe PID 4684 wrote to memory of 2764 4684 9493166c5dffdf4306a1f048d605bf2deaa6d205c0b3f784705c9e34cde11c0d.exe cmd.exe PID 2764 wrote to memory of 3424 2764 cmd.exe PING.EXE PID 2764 wrote to memory of 3424 2764 cmd.exe PING.EXE PID 2764 wrote to memory of 3424 2764 cmd.exe PING.EXE PID 4016 wrote to memory of 2700 4016 setspn.exe RegSvcs.exe PID 4016 wrote to memory of 2700 4016 setspn.exe RegSvcs.exe PID 4016 wrote to memory of 2700 4016 setspn.exe RegSvcs.exe PID 4016 wrote to memory of 2700 4016 setspn.exe RegSvcs.exe PID 4016 wrote to memory of 2700 4016 setspn.exe RegSvcs.exe PID 4016 wrote to memory of 464 4016 setspn.exe schtasks.exe PID 4016 wrote to memory of 464 4016 setspn.exe schtasks.exe PID 4016 wrote to memory of 464 4016 setspn.exe schtasks.exe PID 4940 wrote to memory of 3488 4940 setspn.exe RegSvcs.exe PID 4940 wrote to memory of 3488 4940 setspn.exe RegSvcs.exe PID 4940 wrote to memory of 3488 4940 setspn.exe RegSvcs.exe PID 4940 wrote to memory of 3488 4940 setspn.exe RegSvcs.exe PID 4940 wrote to memory of 3488 4940 setspn.exe RegSvcs.exe PID 4940 wrote to memory of 4440 4940 setspn.exe schtasks.exe PID 4940 wrote to memory of 4440 4940 setspn.exe schtasks.exe PID 4940 wrote to memory of 4440 4940 setspn.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9493166c5dffdf4306a1f048d605bf2deaa6d205c0b3f784705c9e34cde11c0d.exe"C:\Users\Admin\AppData\Local\Temp\9493166c5dffdf4306a1f048d605bf2deaa6d205c0b3f784705c9e34cde11c0d.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2072 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:2768 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /k ping 127.0.0.1 -t 0 & del C:\Users\Admin\AppData\Local\Temp\9493166c5dffdf4306a1f048d605bf2deaa6d205c0b3f784705c9e34cde11c0d.exe & exit2⤵
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -t 03⤵
- Runs ping.exe
PID:3424
-
C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exeC:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵PID:2700
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:464
-
C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exeC:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵PID:3488
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:4440
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD50672db2ef13237d5cb85075ff4915942
SHA1ad8b4d3eb5e40791c47d48b22e273486f25f663f
SHA2560a933408890369b5a178f9c30aa93d2c94f425650815cf8e8310de4e90a3b519
SHA51284ad10ba5b695567d33a52f786405a5544aa49d8d23631ba9edf3afa877c5dbd81570d15bcf74bce5d9fb1afad2117d0a4ef913b396c0d923afefe615619c84b
-
Filesize
2.6MB
MD5a4941c673cc040fdc9b05c8270146e64
SHA1de79633a08ddd539920976cc77cf03f4242396b7
SHA25635f4fad071d66f6d3bb9e39f39497296478aaf7e69cea3376565df21bbffaa68
SHA51267da3aa6bc66f9ae99b88b021ab88ac299c42821fede7342c6a5f729d0f083f766a3adef6283b7bdb4a95dcc7a188f7dfe9407224fc2d12b5d595152c2691e68