Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
12-04-2024 01:08
Static task
static1
Behavioral task
behavioral1
Sample
e76dbf8a866a586d481874cd925ea5cc68388af1e988964982eeddda92b0256a.exe
Resource
win7-20240221-en
General
-
Target
e76dbf8a866a586d481874cd925ea5cc68388af1e988964982eeddda92b0256a.exe
-
Size
2.6MB
-
MD5
4d11477b7b25214d9953f9445b8b29d1
-
SHA1
5b9df82e77efc3b4620d016bdf76ba1c0676f591
-
SHA256
e76dbf8a866a586d481874cd925ea5cc68388af1e988964982eeddda92b0256a
-
SHA512
4247ba3dad5572d54799343aed4f1cefbf81476386b58a508169ed406eb9b59fffaa9f52575931cf439e4ff30352eb728e20e50fc1b9e477b6e80fde1b640337
-
SSDEEP
24576:SAHnh+eWsN3skA4RV1Hom2KXSmHdK3VqbE6przwKpwvEuM/SD0wugdDEl6NrL/NO:Vh+ZkldoPKiYdKr9s
Malware Config
Extracted
orcus
ligeon
ligeon.ddns.net:1606
b98fb09a59c24a81b9d17a55ccf2c036
-
autostart_method
Disable
-
enable_keylogger
true
-
install_path
%programfiles%\Orcus\Orcus.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
Orcus
-
watchdog_path
AppData\OrcusWatchdog.exe
Signatures
-
Orcurs Rat Executable 3 IoCs
Processes:
resource yara_rule behavioral2/memory/2416-2-0x0000000000400000-0x00000000004EA000-memory.dmp orcus behavioral2/memory/4160-24-0x0000000000800000-0x00000000008EA000-memory.dmp orcus behavioral2/memory/552-37-0x0000000000500000-0x00000000005EA000-memory.dmp orcus -
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
e76dbf8a866a586d481874cd925ea5cc68388af1e988964982eeddda92b0256a.exesetspn.exesetspn.exesetspn.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation e76dbf8a866a586d481874cd925ea5cc68388af1e988964982eeddda92b0256a.exe Key value queried \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation setspn.exe Key value queried \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation setspn.exe Key value queried \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation setspn.exe -
Executes dropped EXE 3 IoCs
Processes:
setspn.exesetspn.exesetspn.exepid process 660 setspn.exe 3588 setspn.exe 3720 setspn.exe -
AutoIT Executable 5 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral2/memory/4808-0-0x0000000000FA0000-0x000000000124A000-memory.dmp autoit_exe C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe autoit_exe behavioral2/memory/660-22-0x0000000000B80000-0x0000000000E2A000-memory.dmp autoit_exe behavioral2/memory/3588-36-0x0000000000B80000-0x0000000000E2A000-memory.dmp autoit_exe behavioral2/memory/3720-47-0x0000000000B80000-0x0000000000E2A000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
e76dbf8a866a586d481874cd925ea5cc68388af1e988964982eeddda92b0256a.exesetspn.exesetspn.exesetspn.exedescription pid process target process PID 4808 set thread context of 2416 4808 e76dbf8a866a586d481874cd925ea5cc68388af1e988964982eeddda92b0256a.exe RegSvcs.exe PID 660 set thread context of 4160 660 setspn.exe RegSvcs.exe PID 3588 set thread context of 552 3588 setspn.exe RegSvcs.exe PID 3720 set thread context of 1828 3720 setspn.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 2144 schtasks.exe 4524 schtasks.exe 4464 schtasks.exe 960 schtasks.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
e76dbf8a866a586d481874cd925ea5cc68388af1e988964982eeddda92b0256a.exesetspn.exesetspn.exesetspn.exepid process 4808 e76dbf8a866a586d481874cd925ea5cc68388af1e988964982eeddda92b0256a.exe 4808 e76dbf8a866a586d481874cd925ea5cc68388af1e988964982eeddda92b0256a.exe 4808 e76dbf8a866a586d481874cd925ea5cc68388af1e988964982eeddda92b0256a.exe 4808 e76dbf8a866a586d481874cd925ea5cc68388af1e988964982eeddda92b0256a.exe 660 setspn.exe 660 setspn.exe 660 setspn.exe 660 setspn.exe 3588 setspn.exe 3588 setspn.exe 3588 setspn.exe 3588 setspn.exe 3720 setspn.exe 3720 setspn.exe 3720 setspn.exe 3720 setspn.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 2416 RegSvcs.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
RegSvcs.exepid process 2416 RegSvcs.exe -
Suspicious use of WriteProcessMemory 38 IoCs
Processes:
e76dbf8a866a586d481874cd925ea5cc68388af1e988964982eeddda92b0256a.execmd.exesetspn.exesetspn.exesetspn.exedescription pid process target process PID 4808 wrote to memory of 2416 4808 e76dbf8a866a586d481874cd925ea5cc68388af1e988964982eeddda92b0256a.exe RegSvcs.exe PID 4808 wrote to memory of 2416 4808 e76dbf8a866a586d481874cd925ea5cc68388af1e988964982eeddda92b0256a.exe RegSvcs.exe PID 4808 wrote to memory of 2416 4808 e76dbf8a866a586d481874cd925ea5cc68388af1e988964982eeddda92b0256a.exe RegSvcs.exe PID 4808 wrote to memory of 2416 4808 e76dbf8a866a586d481874cd925ea5cc68388af1e988964982eeddda92b0256a.exe RegSvcs.exe PID 4808 wrote to memory of 2416 4808 e76dbf8a866a586d481874cd925ea5cc68388af1e988964982eeddda92b0256a.exe RegSvcs.exe PID 4808 wrote to memory of 2144 4808 e76dbf8a866a586d481874cd925ea5cc68388af1e988964982eeddda92b0256a.exe schtasks.exe PID 4808 wrote to memory of 2144 4808 e76dbf8a866a586d481874cd925ea5cc68388af1e988964982eeddda92b0256a.exe schtasks.exe PID 4808 wrote to memory of 2144 4808 e76dbf8a866a586d481874cd925ea5cc68388af1e988964982eeddda92b0256a.exe schtasks.exe PID 4808 wrote to memory of 4256 4808 e76dbf8a866a586d481874cd925ea5cc68388af1e988964982eeddda92b0256a.exe cmd.exe PID 4808 wrote to memory of 4256 4808 e76dbf8a866a586d481874cd925ea5cc68388af1e988964982eeddda92b0256a.exe cmd.exe PID 4808 wrote to memory of 4256 4808 e76dbf8a866a586d481874cd925ea5cc68388af1e988964982eeddda92b0256a.exe cmd.exe PID 4256 wrote to memory of 1064 4256 cmd.exe PING.EXE PID 4256 wrote to memory of 1064 4256 cmd.exe PING.EXE PID 4256 wrote to memory of 1064 4256 cmd.exe PING.EXE PID 660 wrote to memory of 4160 660 setspn.exe RegSvcs.exe PID 660 wrote to memory of 4160 660 setspn.exe RegSvcs.exe PID 660 wrote to memory of 4160 660 setspn.exe RegSvcs.exe PID 660 wrote to memory of 4160 660 setspn.exe RegSvcs.exe PID 660 wrote to memory of 4160 660 setspn.exe RegSvcs.exe PID 660 wrote to memory of 4524 660 setspn.exe schtasks.exe PID 660 wrote to memory of 4524 660 setspn.exe schtasks.exe PID 660 wrote to memory of 4524 660 setspn.exe schtasks.exe PID 3588 wrote to memory of 552 3588 setspn.exe RegSvcs.exe PID 3588 wrote to memory of 552 3588 setspn.exe RegSvcs.exe PID 3588 wrote to memory of 552 3588 setspn.exe RegSvcs.exe PID 3588 wrote to memory of 552 3588 setspn.exe RegSvcs.exe PID 3588 wrote to memory of 552 3588 setspn.exe RegSvcs.exe PID 3588 wrote to memory of 4464 3588 setspn.exe schtasks.exe PID 3588 wrote to memory of 4464 3588 setspn.exe schtasks.exe PID 3588 wrote to memory of 4464 3588 setspn.exe schtasks.exe PID 3720 wrote to memory of 1828 3720 setspn.exe RegSvcs.exe PID 3720 wrote to memory of 1828 3720 setspn.exe RegSvcs.exe PID 3720 wrote to memory of 1828 3720 setspn.exe RegSvcs.exe PID 3720 wrote to memory of 1828 3720 setspn.exe RegSvcs.exe PID 3720 wrote to memory of 1828 3720 setspn.exe RegSvcs.exe PID 3720 wrote to memory of 960 3720 setspn.exe schtasks.exe PID 3720 wrote to memory of 960 3720 setspn.exe schtasks.exe PID 3720 wrote to memory of 960 3720 setspn.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e76dbf8a866a586d481874cd925ea5cc68388af1e988964982eeddda92b0256a.exe"C:\Users\Admin\AppData\Local\Temp\e76dbf8a866a586d481874cd925ea5cc68388af1e988964982eeddda92b0256a.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2416 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:2144 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /k ping 127.0.0.1 -t 0 & del C:\Users\Admin\AppData\Local\Temp\e76dbf8a866a586d481874cd925ea5cc68388af1e988964982eeddda92b0256a.exe & exit2⤵
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -t 03⤵
- Runs ping.exe
PID:1064
-
C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exeC:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:660 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵PID:4160
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:4524
-
C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exeC:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵PID:552
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:4464
-
C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exeC:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵PID:1828
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:960
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD50672db2ef13237d5cb85075ff4915942
SHA1ad8b4d3eb5e40791c47d48b22e273486f25f663f
SHA2560a933408890369b5a178f9c30aa93d2c94f425650815cf8e8310de4e90a3b519
SHA51284ad10ba5b695567d33a52f786405a5544aa49d8d23631ba9edf3afa877c5dbd81570d15bcf74bce5d9fb1afad2117d0a4ef913b396c0d923afefe615619c84b
-
Filesize
2.6MB
MD55b6ce58c37c00a65706faebe2d5a945c
SHA1015fe36a246f01ae595704af2ba3efc7c825de26
SHA256297940ca84a5c91ca45126ffb720de3333ae72402aab5214820db06aee838832
SHA51261dff0edd063684ffa8783abd53e2ae1ce2330a1e8ee0a6c80605b6fff61a18339810218253a927a004a3194aea3cb3a0ff6648a7c5a2a797d5bcad0dc415c03