Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
12-04-2024 01:21
Static task
static1
Behavioral task
behavioral1
Sample
1b670ff7d1762cf8ace33e878b4d4364af807690ebf4baa0fb817d1beeb7d793.exe
Resource
win7-20240221-en
General
-
Target
1b670ff7d1762cf8ace33e878b4d4364af807690ebf4baa0fb817d1beeb7d793.exe
-
Size
2.6MB
-
MD5
8d53a3e657af6caeb670bab7ddfa29fa
-
SHA1
96d5ee1307916044d6b1e4f3d867a282c020bb20
-
SHA256
1b670ff7d1762cf8ace33e878b4d4364af807690ebf4baa0fb817d1beeb7d793
-
SHA512
86f4bb8190928f6458efb46008789d80652a743fd8edab6f2744182969f39f5ccd01feb14cc2cd8a52fa0574b0ebad3fff46c392251fcf271bb553a08e049eb8
-
SSDEEP
24576:SAHnh+eWsN3skA4RV1Hom2KXSmHdK3VqbE6przwKpwvEuM/SD0wugdDEl6NrL/NQ:Vh+ZkldoPKiYdKr9K
Malware Config
Extracted
orcus
ligeon
ligeon.ddns.net:1606
b98fb09a59c24a81b9d17a55ccf2c036
-
autostart_method
Disable
-
enable_keylogger
true
-
install_path
%programfiles%\Orcus\Orcus.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
Orcus
-
watchdog_path
AppData\OrcusWatchdog.exe
Signatures
-
Orcurs Rat Executable 9 IoCs
Processes:
resource yara_rule behavioral1/memory/1664-3-0x00000000001B0000-0x000000000029A000-memory.dmp orcus behavioral1/memory/1664-9-0x00000000001B0000-0x000000000029A000-memory.dmp orcus behavioral1/memory/1664-10-0x00000000001B0000-0x000000000029A000-memory.dmp orcus behavioral1/memory/2264-25-0x0000000000120000-0x000000000020A000-memory.dmp orcus behavioral1/memory/2264-31-0x0000000000120000-0x000000000020A000-memory.dmp orcus behavioral1/memory/2264-32-0x0000000000120000-0x000000000020A000-memory.dmp orcus behavioral1/memory/1092-39-0x0000000000400000-0x00000000004EA000-memory.dmp orcus behavioral1/memory/1092-45-0x0000000000400000-0x00000000004EA000-memory.dmp orcus behavioral1/memory/1092-46-0x0000000000400000-0x00000000004EA000-memory.dmp orcus -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2700 cmd.exe -
Executes dropped EXE 3 IoCs
Processes:
setspn.exesetspn.exesetspn.exepid process 1564 setspn.exe 1132 setspn.exe 1592 setspn.exe -
AutoIT Executable 5 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral1/memory/2324-0-0x0000000000950000-0x0000000000BFA000-memory.dmp autoit_exe C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe autoit_exe behavioral1/memory/1564-23-0x0000000000CE0000-0x0000000000F8A000-memory.dmp autoit_exe behavioral1/memory/1132-37-0x0000000001070000-0x000000000131A000-memory.dmp autoit_exe behavioral1/memory/1592-51-0x0000000001070000-0x000000000131A000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
1b670ff7d1762cf8ace33e878b4d4364af807690ebf4baa0fb817d1beeb7d793.exesetspn.exesetspn.exesetspn.exedescription pid process target process PID 2324 set thread context of 1664 2324 1b670ff7d1762cf8ace33e878b4d4364af807690ebf4baa0fb817d1beeb7d793.exe RegSvcs.exe PID 1564 set thread context of 2264 1564 setspn.exe RegSvcs.exe PID 1132 set thread context of 1092 1132 setspn.exe RegSvcs.exe PID 1592 set thread context of 2168 1592 setspn.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 268 schtasks.exe 2016 schtasks.exe 1076 schtasks.exe 2516 schtasks.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
1b670ff7d1762cf8ace33e878b4d4364af807690ebf4baa0fb817d1beeb7d793.exesetspn.exesetspn.exesetspn.exepid process 2324 1b670ff7d1762cf8ace33e878b4d4364af807690ebf4baa0fb817d1beeb7d793.exe 2324 1b670ff7d1762cf8ace33e878b4d4364af807690ebf4baa0fb817d1beeb7d793.exe 1564 setspn.exe 1564 setspn.exe 1132 setspn.exe 1132 setspn.exe 1592 setspn.exe 1592 setspn.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 1664 RegSvcs.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
RegSvcs.exepid process 1664 RegSvcs.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1b670ff7d1762cf8ace33e878b4d4364af807690ebf4baa0fb817d1beeb7d793.execmd.exetaskeng.exesetspn.exesetspn.exesetspn.exedescription pid process target process PID 2324 wrote to memory of 1664 2324 1b670ff7d1762cf8ace33e878b4d4364af807690ebf4baa0fb817d1beeb7d793.exe RegSvcs.exe PID 2324 wrote to memory of 1664 2324 1b670ff7d1762cf8ace33e878b4d4364af807690ebf4baa0fb817d1beeb7d793.exe RegSvcs.exe PID 2324 wrote to memory of 1664 2324 1b670ff7d1762cf8ace33e878b4d4364af807690ebf4baa0fb817d1beeb7d793.exe RegSvcs.exe PID 2324 wrote to memory of 1664 2324 1b670ff7d1762cf8ace33e878b4d4364af807690ebf4baa0fb817d1beeb7d793.exe RegSvcs.exe PID 2324 wrote to memory of 1664 2324 1b670ff7d1762cf8ace33e878b4d4364af807690ebf4baa0fb817d1beeb7d793.exe RegSvcs.exe PID 2324 wrote to memory of 1664 2324 1b670ff7d1762cf8ace33e878b4d4364af807690ebf4baa0fb817d1beeb7d793.exe RegSvcs.exe PID 2324 wrote to memory of 1664 2324 1b670ff7d1762cf8ace33e878b4d4364af807690ebf4baa0fb817d1beeb7d793.exe RegSvcs.exe PID 2324 wrote to memory of 1664 2324 1b670ff7d1762cf8ace33e878b4d4364af807690ebf4baa0fb817d1beeb7d793.exe RegSvcs.exe PID 2324 wrote to memory of 1664 2324 1b670ff7d1762cf8ace33e878b4d4364af807690ebf4baa0fb817d1beeb7d793.exe RegSvcs.exe PID 2324 wrote to memory of 2516 2324 1b670ff7d1762cf8ace33e878b4d4364af807690ebf4baa0fb817d1beeb7d793.exe schtasks.exe PID 2324 wrote to memory of 2516 2324 1b670ff7d1762cf8ace33e878b4d4364af807690ebf4baa0fb817d1beeb7d793.exe schtasks.exe PID 2324 wrote to memory of 2516 2324 1b670ff7d1762cf8ace33e878b4d4364af807690ebf4baa0fb817d1beeb7d793.exe schtasks.exe PID 2324 wrote to memory of 2516 2324 1b670ff7d1762cf8ace33e878b4d4364af807690ebf4baa0fb817d1beeb7d793.exe schtasks.exe PID 2324 wrote to memory of 2700 2324 1b670ff7d1762cf8ace33e878b4d4364af807690ebf4baa0fb817d1beeb7d793.exe cmd.exe PID 2324 wrote to memory of 2700 2324 1b670ff7d1762cf8ace33e878b4d4364af807690ebf4baa0fb817d1beeb7d793.exe cmd.exe PID 2324 wrote to memory of 2700 2324 1b670ff7d1762cf8ace33e878b4d4364af807690ebf4baa0fb817d1beeb7d793.exe cmd.exe PID 2324 wrote to memory of 2700 2324 1b670ff7d1762cf8ace33e878b4d4364af807690ebf4baa0fb817d1beeb7d793.exe cmd.exe PID 2700 wrote to memory of 2564 2700 cmd.exe PING.EXE PID 2700 wrote to memory of 2564 2700 cmd.exe PING.EXE PID 2700 wrote to memory of 2564 2700 cmd.exe PING.EXE PID 2700 wrote to memory of 2564 2700 cmd.exe PING.EXE PID 2428 wrote to memory of 1564 2428 taskeng.exe setspn.exe PID 2428 wrote to memory of 1564 2428 taskeng.exe setspn.exe PID 2428 wrote to memory of 1564 2428 taskeng.exe setspn.exe PID 2428 wrote to memory of 1564 2428 taskeng.exe setspn.exe PID 1564 wrote to memory of 2264 1564 setspn.exe RegSvcs.exe PID 1564 wrote to memory of 2264 1564 setspn.exe RegSvcs.exe PID 1564 wrote to memory of 2264 1564 setspn.exe RegSvcs.exe PID 1564 wrote to memory of 2264 1564 setspn.exe RegSvcs.exe PID 1564 wrote to memory of 2264 1564 setspn.exe RegSvcs.exe PID 1564 wrote to memory of 2264 1564 setspn.exe RegSvcs.exe PID 1564 wrote to memory of 2264 1564 setspn.exe RegSvcs.exe PID 1564 wrote to memory of 2264 1564 setspn.exe RegSvcs.exe PID 1564 wrote to memory of 2264 1564 setspn.exe RegSvcs.exe PID 1564 wrote to memory of 268 1564 setspn.exe schtasks.exe PID 1564 wrote to memory of 268 1564 setspn.exe schtasks.exe PID 1564 wrote to memory of 268 1564 setspn.exe schtasks.exe PID 1564 wrote to memory of 268 1564 setspn.exe schtasks.exe PID 2428 wrote to memory of 1132 2428 taskeng.exe setspn.exe PID 2428 wrote to memory of 1132 2428 taskeng.exe setspn.exe PID 2428 wrote to memory of 1132 2428 taskeng.exe setspn.exe PID 2428 wrote to memory of 1132 2428 taskeng.exe setspn.exe PID 1132 wrote to memory of 1092 1132 setspn.exe RegSvcs.exe PID 1132 wrote to memory of 1092 1132 setspn.exe RegSvcs.exe PID 1132 wrote to memory of 1092 1132 setspn.exe RegSvcs.exe PID 1132 wrote to memory of 1092 1132 setspn.exe RegSvcs.exe PID 1132 wrote to memory of 1092 1132 setspn.exe RegSvcs.exe PID 1132 wrote to memory of 1092 1132 setspn.exe RegSvcs.exe PID 1132 wrote to memory of 1092 1132 setspn.exe RegSvcs.exe PID 1132 wrote to memory of 1092 1132 setspn.exe RegSvcs.exe PID 1132 wrote to memory of 1092 1132 setspn.exe RegSvcs.exe PID 1132 wrote to memory of 2016 1132 setspn.exe schtasks.exe PID 1132 wrote to memory of 2016 1132 setspn.exe schtasks.exe PID 1132 wrote to memory of 2016 1132 setspn.exe schtasks.exe PID 1132 wrote to memory of 2016 1132 setspn.exe schtasks.exe PID 2428 wrote to memory of 1592 2428 taskeng.exe setspn.exe PID 2428 wrote to memory of 1592 2428 taskeng.exe setspn.exe PID 2428 wrote to memory of 1592 2428 taskeng.exe setspn.exe PID 2428 wrote to memory of 1592 2428 taskeng.exe setspn.exe PID 1592 wrote to memory of 2168 1592 setspn.exe RegSvcs.exe PID 1592 wrote to memory of 2168 1592 setspn.exe RegSvcs.exe PID 1592 wrote to memory of 2168 1592 setspn.exe RegSvcs.exe PID 1592 wrote to memory of 2168 1592 setspn.exe RegSvcs.exe PID 1592 wrote to memory of 2168 1592 setspn.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1b670ff7d1762cf8ace33e878b4d4364af807690ebf4baa0fb817d1beeb7d793.exe"C:\Users\Admin\AppData\Local\Temp\1b670ff7d1762cf8ace33e878b4d4364af807690ebf4baa0fb817d1beeb7d793.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1664 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:2516 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /k ping 127.0.0.1 -t 0 & del C:\Users\Admin\AppData\Local\Temp\1b670ff7d1762cf8ace33e878b4d4364af807690ebf4baa0fb817d1beeb7d793.exe & exit2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -t 03⤵
- Runs ping.exe
PID:2564
-
C:\Windows\system32\taskeng.exetaskeng.exe {83C5D56C-B494-4B99-93D0-9DFB6F6E20ED} S-1-5-21-778096762-2241304387-192235952-1000:AYFLYVMK\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exeC:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵PID:2264
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F3⤵
- Creates scheduled task(s)
PID:268 -
C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exeC:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵PID:1092
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F3⤵
- Creates scheduled task(s)
PID:2016 -
C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exeC:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵PID:2168
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F3⤵
- Creates scheduled task(s)
PID:1076
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.6MB
MD529dd70cfb7f79293242e6f65a503f033
SHA14f927a50144b38612fd1aa6ab4aa4ee555f151d4
SHA256448d0a0a1b97ae6fcfcb16ea158c5c6330a89a7b4a8f2a062c1e3493e09f5aea
SHA51265c8117a6adb764572c6b829ac7fafb5f6939546374ee77d7365fb21dfe8436cffca93e8fbf4851c45068f92c1e3240516f9296a2119472417065fb470b321a6