Analysis

  • max time kernel
    168s
  • max time network
    173s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    12-04-2024 01:50

General

  • Target

    d6ac723ad6c3708612c5f636eb9312b5b56f1f2d42621286cb01a52dcde7d440.exe

  • Size

    2.6MB

  • MD5

    8471f457a12c512aafaea1b4ed4478f8

  • SHA1

    2e23e6fb3a549705154a13da70aa7dca47018032

  • SHA256

    d6ac723ad6c3708612c5f636eb9312b5b56f1f2d42621286cb01a52dcde7d440

  • SHA512

    68353f3b95bd20d18243cbbaf4de13c3b6f17820802b19a60eb80414000424882be697d085726db5e7b52f4a4f8c3927cba4c51f010deae03c59b6b6a5aedaf4

  • SSDEEP

    24576:SAHnh+eWsN3skA4RV1Hom2KXSmHdK3VqbE6przwKpwvEuM/SD0wugdDEl6NrL/Nw:Vh+ZkldoPKiYdKr9y

Malware Config

Extracted

Family

orcus

Botnet

ligeon

C2

ligeon.ddns.net:1606

Mutex

b98fb09a59c24a81b9d17a55ccf2c036

Attributes
  • autostart_method

    Disable

  • enable_keylogger

    true

  • install_path

    %programfiles%\Orcus\Orcus.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\OrcusWatchdog.exe

Signatures

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

  • Orcurs Rat Executable 3 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 3 IoCs
  • AutoIT Executable 5 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d6ac723ad6c3708612c5f636eb9312b5b56f1f2d42621286cb01a52dcde7d440.exe
    "C:\Users\Admin\AppData\Local\Temp\d6ac723ad6c3708612c5f636eb9312b5b56f1f2d42621286cb01a52dcde7d440.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2632
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2876
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F
      2⤵
      • Creates scheduled task(s)
      PID:2712
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /k ping 127.0.0.1 -t 0 & del C:\Users\Admin\AppData\Local\Temp\d6ac723ad6c3708612c5f636eb9312b5b56f1f2d42621286cb01a52dcde7d440.exe & exit
      2⤵
      • Deletes itself
      • Suspicious use of WriteProcessMemory
      PID:2640
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -t 0
        3⤵
        • Runs ping.exe
        PID:2404
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {2B3E2A5E-F505-46E7-A4E4-A354837F68B3} S-1-5-21-2461186416-2307104501-1787948496-1000:MGILJUBR\Admin:Interactive:[1]
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:764
    • C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe
      C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2620
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        3⤵
          PID:2476
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F
          3⤵
          • Creates scheduled task(s)
          PID:2684
      • C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe
        C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3028
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
          3⤵
            PID:2720
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F
            3⤵
            • Creates scheduled task(s)
            PID:2104
        • C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe
          C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe
          2⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:748
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
            3⤵
              PID:600
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F
              3⤵
              • Creates scheduled task(s)
              PID:1208

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe

          Filesize

          2.6MB

          MD5

          2845f6f8f562f4e70c3e78957c765b5b

          SHA1

          94a3e38a41629792e07beabc849cc913d9b64172

          SHA256

          fe49a489c84e292836641cb773b0252d85dbe9c60fe8961e36b7a3c1c01524cb

          SHA512

          2cc49334dccae70d42c6d36725fd6d1f28467396af79a83d8ae29da96e190f00f603b87358c38add0dadcf7614aec25a7b7cee44506a8e8e7564837ccf19783a

        • memory/600-65-0x0000000074900000-0x0000000074FEE000-memory.dmp

          Filesize

          6.9MB

        • memory/600-64-0x00000000005A0000-0x00000000005E0000-memory.dmp

          Filesize

          256KB

        • memory/600-63-0x0000000074900000-0x0000000074FEE000-memory.dmp

          Filesize

          6.9MB

        • memory/748-53-0x0000000001130000-0x00000000013DA000-memory.dmp

          Filesize

          2.7MB

        • memory/2476-36-0x0000000074900000-0x0000000074FEE000-memory.dmp

          Filesize

          6.9MB

        • memory/2476-35-0x0000000004DC0000-0x0000000004E00000-memory.dmp

          Filesize

          256KB

        • memory/2476-34-0x0000000074900000-0x0000000074FEE000-memory.dmp

          Filesize

          6.9MB

        • memory/2476-30-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

          Filesize

          4KB

        • memory/2620-24-0x00000000010B0000-0x000000000135A000-memory.dmp

          Filesize

          2.7MB

        • memory/2632-1-0x0000000000130000-0x0000000000131000-memory.dmp

          Filesize

          4KB

        • memory/2632-0-0x0000000000180000-0x000000000042A000-memory.dmp

          Filesize

          2.7MB

        • memory/2720-51-0x0000000074900000-0x0000000074FEE000-memory.dmp

          Filesize

          6.9MB

        • memory/2720-50-0x0000000074900000-0x0000000074FEE000-memory.dmp

          Filesize

          6.9MB

        • memory/2720-46-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

          Filesize

          4KB

        • memory/2876-21-0x00000000006F0000-0x0000000000700000-memory.dmp

          Filesize

          64KB

        • memory/2876-38-0x0000000000560000-0x00000000005A0000-memory.dmp

          Filesize

          256KB

        • memory/2876-19-0x0000000000500000-0x0000000000508000-memory.dmp

          Filesize

          32KB

        • memory/2876-18-0x00000000003F0000-0x0000000000402000-memory.dmp

          Filesize

          72KB

        • memory/2876-17-0x0000000000910000-0x000000000096C000-memory.dmp

          Filesize

          368KB

        • memory/2876-16-0x0000000000390000-0x000000000039E000-memory.dmp

          Filesize

          56KB

        • memory/2876-37-0x0000000074900000-0x0000000074FEE000-memory.dmp

          Filesize

          6.9MB

        • memory/2876-20-0x00000000005A0000-0x00000000005B8000-memory.dmp

          Filesize

          96KB

        • memory/2876-2-0x0000000000400000-0x00000000004EA000-memory.dmp

          Filesize

          936KB

        • memory/2876-15-0x0000000000560000-0x00000000005A0000-memory.dmp

          Filesize

          256KB

        • memory/2876-14-0x0000000074900000-0x0000000074FEE000-memory.dmp

          Filesize

          6.9MB

        • memory/2876-11-0x0000000000400000-0x00000000004EA000-memory.dmp

          Filesize

          936KB

        • memory/2876-10-0x0000000000400000-0x00000000004EA000-memory.dmp

          Filesize

          936KB

        • memory/2876-8-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

          Filesize

          4KB

        • memory/2876-4-0x0000000000400000-0x00000000004EA000-memory.dmp

          Filesize

          936KB

        • memory/3028-40-0x0000000001130000-0x00000000013DA000-memory.dmp

          Filesize

          2.7MB