Analysis
-
max time kernel
147s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
12-04-2024 01:03
Static task
static1
Behavioral task
behavioral1
Sample
c1bb4878d2985dd8077358a034652f3ee13d8d22a92d407757538dd7fc667105.exe
Resource
win7-20240215-en
General
-
Target
c1bb4878d2985dd8077358a034652f3ee13d8d22a92d407757538dd7fc667105.exe
-
Size
2.6MB
-
MD5
be8f80724df234482960ce23d1ba3775
-
SHA1
2479394e9d3febf89636f427d5eb3faaec864465
-
SHA256
c1bb4878d2985dd8077358a034652f3ee13d8d22a92d407757538dd7fc667105
-
SHA512
90474b7659d9d31cbcfe8c946d3bbaec14b9f851b64f7d4f209c8dd3fcd99c82a9f6aed4c478bb64e597a33db09ad35c117804c5c89e2092f26a4bf1d21ff5a1
-
SSDEEP
24576:SAHnh+eWsN3skA4RV1Hom2KXSmHdK3VqbE6przwKpwvEuM/SD0wugdDEl6NrL/ND:Vh+ZkldoPKiYdKr9N
Malware Config
Extracted
orcus
ligeon
ligeon.ddns.net:1606
b98fb09a59c24a81b9d17a55ccf2c036
-
autostart_method
Disable
-
enable_keylogger
true
-
install_path
%programfiles%\Orcus\Orcus.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
Orcus
-
watchdog_path
AppData\OrcusWatchdog.exe
Signatures
-
Orcurs Rat Executable 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1992-2-0x0000000000400000-0x00000000004EA000-memory.dmp orcus -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
c1bb4878d2985dd8077358a034652f3ee13d8d22a92d407757538dd7fc667105.exesetspn.exesetspn.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation c1bb4878d2985dd8077358a034652f3ee13d8d22a92d407757538dd7fc667105.exe Key value queried \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation setspn.exe Key value queried \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation setspn.exe -
Executes dropped EXE 2 IoCs
Processes:
setspn.exesetspn.exepid process 2360 setspn.exe 2232 setspn.exe -
AutoIT Executable 4 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral2/memory/2132-0-0x0000000000AA0000-0x0000000000D4A000-memory.dmp autoit_exe C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe autoit_exe behavioral2/memory/2360-24-0x00000000002B0000-0x000000000055A000-memory.dmp autoit_exe behavioral2/memory/2232-36-0x00000000002B0000-0x000000000055A000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
c1bb4878d2985dd8077358a034652f3ee13d8d22a92d407757538dd7fc667105.exesetspn.exesetspn.exedescription pid process target process PID 2132 set thread context of 1992 2132 c1bb4878d2985dd8077358a034652f3ee13d8d22a92d407757538dd7fc667105.exe RegSvcs.exe PID 2360 set thread context of 4528 2360 setspn.exe RegSvcs.exe PID 2232 set thread context of 1392 2232 setspn.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 4036 schtasks.exe 1576 schtasks.exe 4740 schtasks.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
c1bb4878d2985dd8077358a034652f3ee13d8d22a92d407757538dd7fc667105.exesetspn.exesetspn.exepid process 2132 c1bb4878d2985dd8077358a034652f3ee13d8d22a92d407757538dd7fc667105.exe 2132 c1bb4878d2985dd8077358a034652f3ee13d8d22a92d407757538dd7fc667105.exe 2132 c1bb4878d2985dd8077358a034652f3ee13d8d22a92d407757538dd7fc667105.exe 2132 c1bb4878d2985dd8077358a034652f3ee13d8d22a92d407757538dd7fc667105.exe 2360 setspn.exe 2360 setspn.exe 2360 setspn.exe 2360 setspn.exe 2232 setspn.exe 2232 setspn.exe 2232 setspn.exe 2232 setspn.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 1992 RegSvcs.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
RegSvcs.exepid process 1992 RegSvcs.exe -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
c1bb4878d2985dd8077358a034652f3ee13d8d22a92d407757538dd7fc667105.execmd.exesetspn.exesetspn.exedescription pid process target process PID 2132 wrote to memory of 1992 2132 c1bb4878d2985dd8077358a034652f3ee13d8d22a92d407757538dd7fc667105.exe RegSvcs.exe PID 2132 wrote to memory of 1992 2132 c1bb4878d2985dd8077358a034652f3ee13d8d22a92d407757538dd7fc667105.exe RegSvcs.exe PID 2132 wrote to memory of 1992 2132 c1bb4878d2985dd8077358a034652f3ee13d8d22a92d407757538dd7fc667105.exe RegSvcs.exe PID 2132 wrote to memory of 1992 2132 c1bb4878d2985dd8077358a034652f3ee13d8d22a92d407757538dd7fc667105.exe RegSvcs.exe PID 2132 wrote to memory of 1992 2132 c1bb4878d2985dd8077358a034652f3ee13d8d22a92d407757538dd7fc667105.exe RegSvcs.exe PID 2132 wrote to memory of 4036 2132 c1bb4878d2985dd8077358a034652f3ee13d8d22a92d407757538dd7fc667105.exe schtasks.exe PID 2132 wrote to memory of 4036 2132 c1bb4878d2985dd8077358a034652f3ee13d8d22a92d407757538dd7fc667105.exe schtasks.exe PID 2132 wrote to memory of 4036 2132 c1bb4878d2985dd8077358a034652f3ee13d8d22a92d407757538dd7fc667105.exe schtasks.exe PID 2132 wrote to memory of 880 2132 c1bb4878d2985dd8077358a034652f3ee13d8d22a92d407757538dd7fc667105.exe cmd.exe PID 2132 wrote to memory of 880 2132 c1bb4878d2985dd8077358a034652f3ee13d8d22a92d407757538dd7fc667105.exe cmd.exe PID 2132 wrote to memory of 880 2132 c1bb4878d2985dd8077358a034652f3ee13d8d22a92d407757538dd7fc667105.exe cmd.exe PID 880 wrote to memory of 3612 880 cmd.exe PING.EXE PID 880 wrote to memory of 3612 880 cmd.exe PING.EXE PID 880 wrote to memory of 3612 880 cmd.exe PING.EXE PID 2360 wrote to memory of 4528 2360 setspn.exe RegSvcs.exe PID 2360 wrote to memory of 4528 2360 setspn.exe RegSvcs.exe PID 2360 wrote to memory of 4528 2360 setspn.exe RegSvcs.exe PID 2360 wrote to memory of 4528 2360 setspn.exe RegSvcs.exe PID 2360 wrote to memory of 4528 2360 setspn.exe RegSvcs.exe PID 2360 wrote to memory of 1576 2360 setspn.exe schtasks.exe PID 2360 wrote to memory of 1576 2360 setspn.exe schtasks.exe PID 2360 wrote to memory of 1576 2360 setspn.exe schtasks.exe PID 2232 wrote to memory of 1392 2232 setspn.exe RegSvcs.exe PID 2232 wrote to memory of 1392 2232 setspn.exe RegSvcs.exe PID 2232 wrote to memory of 1392 2232 setspn.exe RegSvcs.exe PID 2232 wrote to memory of 1392 2232 setspn.exe RegSvcs.exe PID 2232 wrote to memory of 1392 2232 setspn.exe RegSvcs.exe PID 2232 wrote to memory of 4740 2232 setspn.exe schtasks.exe PID 2232 wrote to memory of 4740 2232 setspn.exe schtasks.exe PID 2232 wrote to memory of 4740 2232 setspn.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c1bb4878d2985dd8077358a034652f3ee13d8d22a92d407757538dd7fc667105.exe"C:\Users\Admin\AppData\Local\Temp\c1bb4878d2985dd8077358a034652f3ee13d8d22a92d407757538dd7fc667105.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1992 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:4036 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /k ping 127.0.0.1 -t 0 & del C:\Users\Admin\AppData\Local\Temp\c1bb4878d2985dd8077358a034652f3ee13d8d22a92d407757538dd7fc667105.exe & exit2⤵
- Suspicious use of WriteProcessMemory
PID:880 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -t 03⤵
- Runs ping.exe
PID:3612
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3856 --field-trial-handle=2700,i,14629483171127516024,12350888228055326066,262144 --variations-seed-version /prefetch:81⤵PID:3020
-
C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exeC:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵PID:4528
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:1576
-
C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exeC:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵PID:1392
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:4740
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD50672db2ef13237d5cb85075ff4915942
SHA1ad8b4d3eb5e40791c47d48b22e273486f25f663f
SHA2560a933408890369b5a178f9c30aa93d2c94f425650815cf8e8310de4e90a3b519
SHA51284ad10ba5b695567d33a52f786405a5544aa49d8d23631ba9edf3afa877c5dbd81570d15bcf74bce5d9fb1afad2117d0a4ef913b396c0d923afefe615619c84b
-
Filesize
2.6MB
MD5315702d8abf5ff8fb668616614e36a51
SHA1b0b298a04102111314b96b70fac4efa0ff88ec87
SHA2565fdb9abf501285ad890b82df2f072a70cfbffa0d1d0b5af012c0532941a1ed29
SHA512e48cc8c9eb6fdc3b7bf15f1aa236a9c741fde1d675ce880532d33fd68a82e5e0e69c703edef27c66d1ba4bc77fe561432d0079da28aa57c735494a2d3f1c7f7a