Analysis
-
max time kernel
142s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
12-04-2024 01:03
Static task
static1
Behavioral task
behavioral1
Sample
b458308592c513e31bbb21c66d91c69a9875379170696629ee529a2b73505dd6.exe
Resource
win7-20231129-en
General
-
Target
b458308592c513e31bbb21c66d91c69a9875379170696629ee529a2b73505dd6.exe
-
Size
2.6MB
-
MD5
1f3265ce6fd5450943cfc07a7b7971c1
-
SHA1
7df873fa54d45543871e195b9ff9491b9c4d159d
-
SHA256
b458308592c513e31bbb21c66d91c69a9875379170696629ee529a2b73505dd6
-
SHA512
bc8dbf287727c5f15c91cda4ce45d8ce05268cb9e0ba1e735f9b835294c7af0e12440fe87818219fe56a27122418dacf948380a48b27defca020a7387517fac4
-
SSDEEP
24576:QAHnh+eWsN3skA4RV1Hom2KXSmHdqf0K44JzixdvW80EXLq31gEfUvWDyBFZpxxn:Hh+ZkldoPKiYdqd6f
Malware Config
Extracted
orcus
ligeon
ligeon.ddns.net:1606
b98fb09a59c24a81b9d17a55ccf2c036
-
autostart_method
Disable
-
enable_keylogger
true
-
install_path
%programfiles%\Orcus\Orcus.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
Orcus
-
watchdog_path
AppData\OrcusWatchdog.exe
Signatures
-
Orcurs Rat Executable 6 IoCs
Processes:
resource yara_rule behavioral1/memory/2792-3-0x0000000000400000-0x00000000004EA000-memory.dmp orcus behavioral1/memory/2792-9-0x0000000000400000-0x00000000004EA000-memory.dmp orcus behavioral1/memory/2792-10-0x0000000000400000-0x00000000004EA000-memory.dmp orcus behavioral1/memory/540-42-0x0000000000090000-0x000000000017A000-memory.dmp orcus behavioral1/memory/540-49-0x0000000000090000-0x000000000017A000-memory.dmp orcus behavioral1/memory/540-48-0x0000000000090000-0x000000000017A000-memory.dmp orcus -
Executes dropped EXE 2 IoCs
Processes:
setspn.exesetspn.exepid process 1748 setspn.exe 596 setspn.exe -
AutoIT Executable 4 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral1/memory/2936-0-0x0000000000B00000-0x0000000000DAA000-memory.dmp autoit_exe C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe autoit_exe behavioral1/memory/1748-25-0x0000000001130000-0x00000000013DA000-memory.dmp autoit_exe behavioral1/memory/596-39-0x0000000000090000-0x000000000033A000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
b458308592c513e31bbb21c66d91c69a9875379170696629ee529a2b73505dd6.exesetspn.exesetspn.exedescription pid process target process PID 2936 set thread context of 2792 2936 b458308592c513e31bbb21c66d91c69a9875379170696629ee529a2b73505dd6.exe RegSvcs.exe PID 1748 set thread context of 2008 1748 setspn.exe RegSvcs.exe PID 596 set thread context of 540 596 setspn.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 2852 schtasks.exe 2192 schtasks.exe 840 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
b458308592c513e31bbb21c66d91c69a9875379170696629ee529a2b73505dd6.exesetspn.exesetspn.exepid process 2936 b458308592c513e31bbb21c66d91c69a9875379170696629ee529a2b73505dd6.exe 2936 b458308592c513e31bbb21c66d91c69a9875379170696629ee529a2b73505dd6.exe 1748 setspn.exe 1748 setspn.exe 596 setspn.exe 596 setspn.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 2792 RegSvcs.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
RegSvcs.exepid process 2792 RegSvcs.exe -
Suspicious use of WriteProcessMemory 47 IoCs
Processes:
b458308592c513e31bbb21c66d91c69a9875379170696629ee529a2b73505dd6.exetaskeng.exesetspn.exesetspn.exedescription pid process target process PID 2936 wrote to memory of 2792 2936 b458308592c513e31bbb21c66d91c69a9875379170696629ee529a2b73505dd6.exe RegSvcs.exe PID 2936 wrote to memory of 2792 2936 b458308592c513e31bbb21c66d91c69a9875379170696629ee529a2b73505dd6.exe RegSvcs.exe PID 2936 wrote to memory of 2792 2936 b458308592c513e31bbb21c66d91c69a9875379170696629ee529a2b73505dd6.exe RegSvcs.exe PID 2936 wrote to memory of 2792 2936 b458308592c513e31bbb21c66d91c69a9875379170696629ee529a2b73505dd6.exe RegSvcs.exe PID 2936 wrote to memory of 2792 2936 b458308592c513e31bbb21c66d91c69a9875379170696629ee529a2b73505dd6.exe RegSvcs.exe PID 2936 wrote to memory of 2792 2936 b458308592c513e31bbb21c66d91c69a9875379170696629ee529a2b73505dd6.exe RegSvcs.exe PID 2936 wrote to memory of 2792 2936 b458308592c513e31bbb21c66d91c69a9875379170696629ee529a2b73505dd6.exe RegSvcs.exe PID 2936 wrote to memory of 2792 2936 b458308592c513e31bbb21c66d91c69a9875379170696629ee529a2b73505dd6.exe RegSvcs.exe PID 2936 wrote to memory of 2792 2936 b458308592c513e31bbb21c66d91c69a9875379170696629ee529a2b73505dd6.exe RegSvcs.exe PID 2936 wrote to memory of 2852 2936 b458308592c513e31bbb21c66d91c69a9875379170696629ee529a2b73505dd6.exe schtasks.exe PID 2936 wrote to memory of 2852 2936 b458308592c513e31bbb21c66d91c69a9875379170696629ee529a2b73505dd6.exe schtasks.exe PID 2936 wrote to memory of 2852 2936 b458308592c513e31bbb21c66d91c69a9875379170696629ee529a2b73505dd6.exe schtasks.exe PID 2936 wrote to memory of 2852 2936 b458308592c513e31bbb21c66d91c69a9875379170696629ee529a2b73505dd6.exe schtasks.exe PID 1992 wrote to memory of 1748 1992 taskeng.exe setspn.exe PID 1992 wrote to memory of 1748 1992 taskeng.exe setspn.exe PID 1992 wrote to memory of 1748 1992 taskeng.exe setspn.exe PID 1992 wrote to memory of 1748 1992 taskeng.exe setspn.exe PID 1748 wrote to memory of 2008 1748 setspn.exe RegSvcs.exe PID 1748 wrote to memory of 2008 1748 setspn.exe RegSvcs.exe PID 1748 wrote to memory of 2008 1748 setspn.exe RegSvcs.exe PID 1748 wrote to memory of 2008 1748 setspn.exe RegSvcs.exe PID 1748 wrote to memory of 2008 1748 setspn.exe RegSvcs.exe PID 1748 wrote to memory of 2008 1748 setspn.exe RegSvcs.exe PID 1748 wrote to memory of 2008 1748 setspn.exe RegSvcs.exe PID 1748 wrote to memory of 2008 1748 setspn.exe RegSvcs.exe PID 1748 wrote to memory of 2008 1748 setspn.exe RegSvcs.exe PID 1748 wrote to memory of 2192 1748 setspn.exe schtasks.exe PID 1748 wrote to memory of 2192 1748 setspn.exe schtasks.exe PID 1748 wrote to memory of 2192 1748 setspn.exe schtasks.exe PID 1748 wrote to memory of 2192 1748 setspn.exe schtasks.exe PID 1992 wrote to memory of 596 1992 taskeng.exe setspn.exe PID 1992 wrote to memory of 596 1992 taskeng.exe setspn.exe PID 1992 wrote to memory of 596 1992 taskeng.exe setspn.exe PID 1992 wrote to memory of 596 1992 taskeng.exe setspn.exe PID 596 wrote to memory of 540 596 setspn.exe RegSvcs.exe PID 596 wrote to memory of 540 596 setspn.exe RegSvcs.exe PID 596 wrote to memory of 540 596 setspn.exe RegSvcs.exe PID 596 wrote to memory of 540 596 setspn.exe RegSvcs.exe PID 596 wrote to memory of 540 596 setspn.exe RegSvcs.exe PID 596 wrote to memory of 540 596 setspn.exe RegSvcs.exe PID 596 wrote to memory of 540 596 setspn.exe RegSvcs.exe PID 596 wrote to memory of 540 596 setspn.exe RegSvcs.exe PID 596 wrote to memory of 540 596 setspn.exe RegSvcs.exe PID 596 wrote to memory of 840 596 setspn.exe schtasks.exe PID 596 wrote to memory of 840 596 setspn.exe schtasks.exe PID 596 wrote to memory of 840 596 setspn.exe schtasks.exe PID 596 wrote to memory of 840 596 setspn.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b458308592c513e31bbb21c66d91c69a9875379170696629ee529a2b73505dd6.exe"C:\Users\Admin\AppData\Local\Temp\b458308592c513e31bbb21c66d91c69a9875379170696629ee529a2b73505dd6.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2792 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:2852
-
C:\Windows\system32\taskeng.exetaskeng.exe {659571C1-4900-4EC1-BFAB-EA039E66A74E} S-1-5-21-3627615824-4061627003-3019543961-1000:SCFGBRBT\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exeC:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵PID:2008
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F3⤵
- Creates scheduled task(s)
PID:2192 -
C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exeC:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:596 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵PID:540
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F3⤵
- Creates scheduled task(s)
PID:840
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.6MB
MD53a04d9108713722bff0fc831f80a898a
SHA17a8a5964c9cb4498914c8c2ab7b787e48caa5513
SHA256b5742d934342485496ce462c5a10c6ac4ca5e83480f1c733ebd5c00adc1dfaf0
SHA512bf74acad2082ca7273f1a9ad53a86c80f83df9211beb903086bc99c8e1fb00efc43ffacc836fef09a4877caa3b9a3f577835d931854b28acfcb90b9e3fd1c051