Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    12-04-2024 01:08

General

  • Target

    e76dbf8a866a586d481874cd925ea5cc68388af1e988964982eeddda92b0256a.exe

  • Size

    2.6MB

  • MD5

    4d11477b7b25214d9953f9445b8b29d1

  • SHA1

    5b9df82e77efc3b4620d016bdf76ba1c0676f591

  • SHA256

    e76dbf8a866a586d481874cd925ea5cc68388af1e988964982eeddda92b0256a

  • SHA512

    4247ba3dad5572d54799343aed4f1cefbf81476386b58a508169ed406eb9b59fffaa9f52575931cf439e4ff30352eb728e20e50fc1b9e477b6e80fde1b640337

  • SSDEEP

    24576:SAHnh+eWsN3skA4RV1Hom2KXSmHdK3VqbE6przwKpwvEuM/SD0wugdDEl6NrL/NO:Vh+ZkldoPKiYdKr9s

Malware Config

Extracted

Family

orcus

Botnet

ligeon

C2

ligeon.ddns.net:1606

Mutex

b98fb09a59c24a81b9d17a55ccf2c036

Attributes
  • autostart_method

    Disable

  • enable_keylogger

    true

  • install_path

    %programfiles%\Orcus\Orcus.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\OrcusWatchdog.exe

Signatures

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

  • Orcurs Rat Executable 3 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 3 IoCs
  • AutoIT Executable 5 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e76dbf8a866a586d481874cd925ea5cc68388af1e988964982eeddda92b0256a.exe
    "C:\Users\Admin\AppData\Local\Temp\e76dbf8a866a586d481874cd925ea5cc68388af1e988964982eeddda92b0256a.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2120
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:1524
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F
      2⤵
      • Creates scheduled task(s)
      PID:2140
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /k ping 127.0.0.1 -t 0 & del C:\Users\Admin\AppData\Local\Temp\e76dbf8a866a586d481874cd925ea5cc68388af1e988964982eeddda92b0256a.exe & exit
      2⤵
      • Deletes itself
      • Suspicious use of WriteProcessMemory
      PID:2664
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -t 0
        3⤵
        • Runs ping.exe
        PID:2552
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {DE1A5B4B-AE02-4110-8667-E11269F391D4} S-1-5-21-3787592910-3720486031-2929222812-1000:HSNHLVYA\Admin:Interactive:[1]
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2488
    • C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe
      C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2884
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        3⤵
          PID:2396
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F
          3⤵
          • Creates scheduled task(s)
          PID:2732
      • C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe
        C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:984
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
          3⤵
            PID:1752
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F
            3⤵
            • Creates scheduled task(s)
            PID:2288
        • C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe
          C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe
          2⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2280
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
            3⤵
              PID:1924
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F
              3⤵
              • Creates scheduled task(s)
              PID:1468

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe

          Filesize

          2.6MB

          MD5

          86e11fab5d426322464f6ea4df1022b1

          SHA1

          9c040085fe661185ec6d7f6e6ab4d7d8f00483bf

          SHA256

          c4d81a54fb02055aa27e42d3460c76dd637378a34df6d932952f1fcc60c9fd88

          SHA512

          7444293bd9a13d8a0ea4103b2f04231a71e8e1b4b45df43b55f432604e0ad06cf6c5c1685763bc4c0384e2f43ad2972c80120fd24f7e8d652756c4e081c5aafa

        • memory/984-37-0x0000000001050000-0x00000000012FA000-memory.dmp

          Filesize

          2.7MB

        • memory/1524-13-0x0000000074160000-0x000000007484E000-memory.dmp

          Filesize

          6.9MB

        • memory/1524-17-0x0000000000370000-0x0000000000382000-memory.dmp

          Filesize

          72KB

        • memory/1524-20-0x0000000000680000-0x0000000000690000-memory.dmp

          Filesize

          64KB

        • memory/1524-9-0x0000000000400000-0x00000000004EA000-memory.dmp

          Filesize

          936KB

        • memory/1524-10-0x0000000000400000-0x00000000004EA000-memory.dmp

          Filesize

          936KB

        • memory/1524-2-0x0000000000400000-0x00000000004EA000-memory.dmp

          Filesize

          936KB

        • memory/1524-14-0x0000000004D30000-0x0000000004D70000-memory.dmp

          Filesize

          256KB

        • memory/1524-15-0x0000000000200000-0x000000000020E000-memory.dmp

          Filesize

          56KB

        • memory/1524-16-0x00000000009B0000-0x0000000000A0C000-memory.dmp

          Filesize

          368KB

        • memory/1524-27-0x0000000074160000-0x000000007484E000-memory.dmp

          Filesize

          6.9MB

        • memory/1524-18-0x00000000003D0000-0x00000000003D8000-memory.dmp

          Filesize

          32KB

        • memory/1524-19-0x00000000003E0000-0x00000000003F8000-memory.dmp

          Filesize

          96KB

        • memory/1524-7-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

          Filesize

          4KB

        • memory/1524-3-0x0000000000400000-0x00000000004EA000-memory.dmp

          Filesize

          936KB

        • memory/1752-48-0x0000000004C20000-0x0000000004C60000-memory.dmp

          Filesize

          256KB

        • memory/1752-47-0x0000000074160000-0x000000007484E000-memory.dmp

          Filesize

          6.9MB

        • memory/1752-49-0x0000000074160000-0x000000007484E000-memory.dmp

          Filesize

          6.9MB

        • memory/1924-64-0x0000000074160000-0x000000007484E000-memory.dmp

          Filesize

          6.9MB

        • memory/1924-62-0x0000000074160000-0x000000007484E000-memory.dmp

          Filesize

          6.9MB

        • memory/1924-63-0x0000000004910000-0x0000000004950000-memory.dmp

          Filesize

          256KB

        • memory/2120-1-0x00000000000B0000-0x00000000000B1000-memory.dmp

          Filesize

          4KB

        • memory/2120-0-0x00000000011E0000-0x000000000148A000-memory.dmp

          Filesize

          2.7MB

        • memory/2280-51-0x0000000000260000-0x000000000050A000-memory.dmp

          Filesize

          2.7MB

        • memory/2396-35-0x0000000074160000-0x000000007484E000-memory.dmp

          Filesize

          6.9MB

        • memory/2396-34-0x0000000074160000-0x000000007484E000-memory.dmp

          Filesize

          6.9MB

        • memory/2396-30-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

          Filesize

          4KB

        • memory/2884-23-0x0000000000C90000-0x0000000000F3A000-memory.dmp

          Filesize

          2.7MB