Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
12-04-2024 01:08
Static task
static1
Behavioral task
behavioral1
Sample
e76dbf8a866a586d481874cd925ea5cc68388af1e988964982eeddda92b0256a.exe
Resource
win7-20240221-en
General
-
Target
e76dbf8a866a586d481874cd925ea5cc68388af1e988964982eeddda92b0256a.exe
-
Size
2.6MB
-
MD5
4d11477b7b25214d9953f9445b8b29d1
-
SHA1
5b9df82e77efc3b4620d016bdf76ba1c0676f591
-
SHA256
e76dbf8a866a586d481874cd925ea5cc68388af1e988964982eeddda92b0256a
-
SHA512
4247ba3dad5572d54799343aed4f1cefbf81476386b58a508169ed406eb9b59fffaa9f52575931cf439e4ff30352eb728e20e50fc1b9e477b6e80fde1b640337
-
SSDEEP
24576:SAHnh+eWsN3skA4RV1Hom2KXSmHdK3VqbE6przwKpwvEuM/SD0wugdDEl6NrL/NO:Vh+ZkldoPKiYdKr9s
Malware Config
Extracted
orcus
ligeon
ligeon.ddns.net:1606
b98fb09a59c24a81b9d17a55ccf2c036
-
autostart_method
Disable
-
enable_keylogger
true
-
install_path
%programfiles%\Orcus\Orcus.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
Orcus
-
watchdog_path
AppData\OrcusWatchdog.exe
Signatures
-
Orcurs Rat Executable 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1524-3-0x0000000000400000-0x00000000004EA000-memory.dmp orcus behavioral1/memory/1524-9-0x0000000000400000-0x00000000004EA000-memory.dmp orcus behavioral1/memory/1524-10-0x0000000000400000-0x00000000004EA000-memory.dmp orcus -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2664 cmd.exe -
Executes dropped EXE 3 IoCs
Processes:
setspn.exesetspn.exesetspn.exepid process 2884 setspn.exe 984 setspn.exe 2280 setspn.exe -
AutoIT Executable 5 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral1/memory/2120-0-0x00000000011E0000-0x000000000148A000-memory.dmp autoit_exe C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe autoit_exe behavioral1/memory/2884-23-0x0000000000C90000-0x0000000000F3A000-memory.dmp autoit_exe behavioral1/memory/984-37-0x0000000001050000-0x00000000012FA000-memory.dmp autoit_exe behavioral1/memory/2280-51-0x0000000000260000-0x000000000050A000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
e76dbf8a866a586d481874cd925ea5cc68388af1e988964982eeddda92b0256a.exesetspn.exesetspn.exesetspn.exedescription pid process target process PID 2120 set thread context of 1524 2120 e76dbf8a866a586d481874cd925ea5cc68388af1e988964982eeddda92b0256a.exe RegSvcs.exe PID 2884 set thread context of 2396 2884 setspn.exe RegSvcs.exe PID 984 set thread context of 1752 984 setspn.exe RegSvcs.exe PID 2280 set thread context of 1924 2280 setspn.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 2140 schtasks.exe 2732 schtasks.exe 2288 schtasks.exe 1468 schtasks.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
e76dbf8a866a586d481874cd925ea5cc68388af1e988964982eeddda92b0256a.exesetspn.exesetspn.exesetspn.exepid process 2120 e76dbf8a866a586d481874cd925ea5cc68388af1e988964982eeddda92b0256a.exe 2120 e76dbf8a866a586d481874cd925ea5cc68388af1e988964982eeddda92b0256a.exe 2884 setspn.exe 2884 setspn.exe 984 setspn.exe 984 setspn.exe 2280 setspn.exe 2280 setspn.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 1524 RegSvcs.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
RegSvcs.exepid process 1524 RegSvcs.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
e76dbf8a866a586d481874cd925ea5cc68388af1e988964982eeddda92b0256a.execmd.exetaskeng.exesetspn.exesetspn.exesetspn.exedescription pid process target process PID 2120 wrote to memory of 1524 2120 e76dbf8a866a586d481874cd925ea5cc68388af1e988964982eeddda92b0256a.exe RegSvcs.exe PID 2120 wrote to memory of 1524 2120 e76dbf8a866a586d481874cd925ea5cc68388af1e988964982eeddda92b0256a.exe RegSvcs.exe PID 2120 wrote to memory of 1524 2120 e76dbf8a866a586d481874cd925ea5cc68388af1e988964982eeddda92b0256a.exe RegSvcs.exe PID 2120 wrote to memory of 1524 2120 e76dbf8a866a586d481874cd925ea5cc68388af1e988964982eeddda92b0256a.exe RegSvcs.exe PID 2120 wrote to memory of 1524 2120 e76dbf8a866a586d481874cd925ea5cc68388af1e988964982eeddda92b0256a.exe RegSvcs.exe PID 2120 wrote to memory of 1524 2120 e76dbf8a866a586d481874cd925ea5cc68388af1e988964982eeddda92b0256a.exe RegSvcs.exe PID 2120 wrote to memory of 1524 2120 e76dbf8a866a586d481874cd925ea5cc68388af1e988964982eeddda92b0256a.exe RegSvcs.exe PID 2120 wrote to memory of 1524 2120 e76dbf8a866a586d481874cd925ea5cc68388af1e988964982eeddda92b0256a.exe RegSvcs.exe PID 2120 wrote to memory of 1524 2120 e76dbf8a866a586d481874cd925ea5cc68388af1e988964982eeddda92b0256a.exe RegSvcs.exe PID 2120 wrote to memory of 2140 2120 e76dbf8a866a586d481874cd925ea5cc68388af1e988964982eeddda92b0256a.exe schtasks.exe PID 2120 wrote to memory of 2140 2120 e76dbf8a866a586d481874cd925ea5cc68388af1e988964982eeddda92b0256a.exe schtasks.exe PID 2120 wrote to memory of 2140 2120 e76dbf8a866a586d481874cd925ea5cc68388af1e988964982eeddda92b0256a.exe schtasks.exe PID 2120 wrote to memory of 2140 2120 e76dbf8a866a586d481874cd925ea5cc68388af1e988964982eeddda92b0256a.exe schtasks.exe PID 2120 wrote to memory of 2664 2120 e76dbf8a866a586d481874cd925ea5cc68388af1e988964982eeddda92b0256a.exe cmd.exe PID 2120 wrote to memory of 2664 2120 e76dbf8a866a586d481874cd925ea5cc68388af1e988964982eeddda92b0256a.exe cmd.exe PID 2120 wrote to memory of 2664 2120 e76dbf8a866a586d481874cd925ea5cc68388af1e988964982eeddda92b0256a.exe cmd.exe PID 2120 wrote to memory of 2664 2120 e76dbf8a866a586d481874cd925ea5cc68388af1e988964982eeddda92b0256a.exe cmd.exe PID 2664 wrote to memory of 2552 2664 cmd.exe PING.EXE PID 2664 wrote to memory of 2552 2664 cmd.exe PING.EXE PID 2664 wrote to memory of 2552 2664 cmd.exe PING.EXE PID 2664 wrote to memory of 2552 2664 cmd.exe PING.EXE PID 2488 wrote to memory of 2884 2488 taskeng.exe setspn.exe PID 2488 wrote to memory of 2884 2488 taskeng.exe setspn.exe PID 2488 wrote to memory of 2884 2488 taskeng.exe setspn.exe PID 2488 wrote to memory of 2884 2488 taskeng.exe setspn.exe PID 2884 wrote to memory of 2396 2884 setspn.exe RegSvcs.exe PID 2884 wrote to memory of 2396 2884 setspn.exe RegSvcs.exe PID 2884 wrote to memory of 2396 2884 setspn.exe RegSvcs.exe PID 2884 wrote to memory of 2396 2884 setspn.exe RegSvcs.exe PID 2884 wrote to memory of 2396 2884 setspn.exe RegSvcs.exe PID 2884 wrote to memory of 2396 2884 setspn.exe RegSvcs.exe PID 2884 wrote to memory of 2396 2884 setspn.exe RegSvcs.exe PID 2884 wrote to memory of 2396 2884 setspn.exe RegSvcs.exe PID 2884 wrote to memory of 2396 2884 setspn.exe RegSvcs.exe PID 2884 wrote to memory of 2732 2884 setspn.exe schtasks.exe PID 2884 wrote to memory of 2732 2884 setspn.exe schtasks.exe PID 2884 wrote to memory of 2732 2884 setspn.exe schtasks.exe PID 2884 wrote to memory of 2732 2884 setspn.exe schtasks.exe PID 2488 wrote to memory of 984 2488 taskeng.exe setspn.exe PID 2488 wrote to memory of 984 2488 taskeng.exe setspn.exe PID 2488 wrote to memory of 984 2488 taskeng.exe setspn.exe PID 2488 wrote to memory of 984 2488 taskeng.exe setspn.exe PID 984 wrote to memory of 1752 984 setspn.exe RegSvcs.exe PID 984 wrote to memory of 1752 984 setspn.exe RegSvcs.exe PID 984 wrote to memory of 1752 984 setspn.exe RegSvcs.exe PID 984 wrote to memory of 1752 984 setspn.exe RegSvcs.exe PID 984 wrote to memory of 1752 984 setspn.exe RegSvcs.exe PID 984 wrote to memory of 1752 984 setspn.exe RegSvcs.exe PID 984 wrote to memory of 1752 984 setspn.exe RegSvcs.exe PID 984 wrote to memory of 1752 984 setspn.exe RegSvcs.exe PID 984 wrote to memory of 1752 984 setspn.exe RegSvcs.exe PID 984 wrote to memory of 2288 984 setspn.exe schtasks.exe PID 984 wrote to memory of 2288 984 setspn.exe schtasks.exe PID 984 wrote to memory of 2288 984 setspn.exe schtasks.exe PID 984 wrote to memory of 2288 984 setspn.exe schtasks.exe PID 2488 wrote to memory of 2280 2488 taskeng.exe setspn.exe PID 2488 wrote to memory of 2280 2488 taskeng.exe setspn.exe PID 2488 wrote to memory of 2280 2488 taskeng.exe setspn.exe PID 2488 wrote to memory of 2280 2488 taskeng.exe setspn.exe PID 2280 wrote to memory of 1924 2280 setspn.exe RegSvcs.exe PID 2280 wrote to memory of 1924 2280 setspn.exe RegSvcs.exe PID 2280 wrote to memory of 1924 2280 setspn.exe RegSvcs.exe PID 2280 wrote to memory of 1924 2280 setspn.exe RegSvcs.exe PID 2280 wrote to memory of 1924 2280 setspn.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e76dbf8a866a586d481874cd925ea5cc68388af1e988964982eeddda92b0256a.exe"C:\Users\Admin\AppData\Local\Temp\e76dbf8a866a586d481874cd925ea5cc68388af1e988964982eeddda92b0256a.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1524 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:2140 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /k ping 127.0.0.1 -t 0 & del C:\Users\Admin\AppData\Local\Temp\e76dbf8a866a586d481874cd925ea5cc68388af1e988964982eeddda92b0256a.exe & exit2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -t 03⤵
- Runs ping.exe
PID:2552
-
C:\Windows\system32\taskeng.exetaskeng.exe {DE1A5B4B-AE02-4110-8667-E11269F391D4} S-1-5-21-3787592910-3720486031-2929222812-1000:HSNHLVYA\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exeC:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵PID:2396
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F3⤵
- Creates scheduled task(s)
PID:2732 -
C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exeC:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:984 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵PID:1752
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F3⤵
- Creates scheduled task(s)
PID:2288 -
C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exeC:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵PID:1924
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F3⤵
- Creates scheduled task(s)
PID:1468
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.6MB
MD586e11fab5d426322464f6ea4df1022b1
SHA19c040085fe661185ec6d7f6e6ab4d7d8f00483bf
SHA256c4d81a54fb02055aa27e42d3460c76dd637378a34df6d932952f1fcc60c9fd88
SHA5127444293bd9a13d8a0ea4103b2f04231a71e8e1b4b45df43b55f432604e0ad06cf6c5c1685763bc4c0384e2f43ad2972c80120fd24f7e8d652756c4e081c5aafa