Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    12-04-2024 01:21

General

  • Target

    1b670ff7d1762cf8ace33e878b4d4364af807690ebf4baa0fb817d1beeb7d793.exe

  • Size

    2.6MB

  • MD5

    8d53a3e657af6caeb670bab7ddfa29fa

  • SHA1

    96d5ee1307916044d6b1e4f3d867a282c020bb20

  • SHA256

    1b670ff7d1762cf8ace33e878b4d4364af807690ebf4baa0fb817d1beeb7d793

  • SHA512

    86f4bb8190928f6458efb46008789d80652a743fd8edab6f2744182969f39f5ccd01feb14cc2cd8a52fa0574b0ebad3fff46c392251fcf271bb553a08e049eb8

  • SSDEEP

    24576:SAHnh+eWsN3skA4RV1Hom2KXSmHdK3VqbE6przwKpwvEuM/SD0wugdDEl6NrL/NQ:Vh+ZkldoPKiYdKr9K

Malware Config

Extracted

Family

orcus

Botnet

ligeon

C2

ligeon.ddns.net:1606

Mutex

b98fb09a59c24a81b9d17a55ccf2c036

Attributes
  • autostart_method

    Disable

  • enable_keylogger

    true

  • install_path

    %programfiles%\Orcus\Orcus.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\OrcusWatchdog.exe

Signatures

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

  • Orcurs Rat Executable 9 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 3 IoCs
  • AutoIT Executable 5 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1b670ff7d1762cf8ace33e878b4d4364af807690ebf4baa0fb817d1beeb7d793.exe
    "C:\Users\Admin\AppData\Local\Temp\1b670ff7d1762cf8ace33e878b4d4364af807690ebf4baa0fb817d1beeb7d793.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2324
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:1664
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F
      2⤵
      • Creates scheduled task(s)
      PID:2516
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /k ping 127.0.0.1 -t 0 & del C:\Users\Admin\AppData\Local\Temp\1b670ff7d1762cf8ace33e878b4d4364af807690ebf4baa0fb817d1beeb7d793.exe & exit
      2⤵
      • Deletes itself
      • Suspicious use of WriteProcessMemory
      PID:2700
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -t 0
        3⤵
        • Runs ping.exe
        PID:2564
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {83C5D56C-B494-4B99-93D0-9DFB6F6E20ED} S-1-5-21-778096762-2241304387-192235952-1000:AYFLYVMK\Admin:Interactive:[1]
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2428
    • C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe
      C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1564
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        3⤵
          PID:2264
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F
          3⤵
          • Creates scheduled task(s)
          PID:268
      • C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe
        C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1132
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
          3⤵
            PID:1092
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F
            3⤵
            • Creates scheduled task(s)
            PID:2016
        • C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe
          C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe
          2⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1592
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
            3⤵
              PID:2168
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F
              3⤵
              • Creates scheduled task(s)
              PID:1076

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe

          Filesize

          2.6MB

          MD5

          29dd70cfb7f79293242e6f65a503f033

          SHA1

          4f927a50144b38612fd1aa6ab4aa4ee555f151d4

          SHA256

          448d0a0a1b97ae6fcfcb16ea158c5c6330a89a7b4a8f2a062c1e3493e09f5aea

          SHA512

          65c8117a6adb764572c6b829ac7fafb5f6939546374ee77d7365fb21dfe8436cffca93e8fbf4851c45068f92c1e3240516f9296a2119472417065fb470b321a6

        • memory/1092-49-0x0000000074260000-0x000000007494E000-memory.dmp

          Filesize

          6.9MB

        • memory/1092-48-0x00000000048E0000-0x0000000004920000-memory.dmp

          Filesize

          256KB

        • memory/1092-47-0x0000000074260000-0x000000007494E000-memory.dmp

          Filesize

          6.9MB

        • memory/1092-46-0x0000000000400000-0x00000000004EA000-memory.dmp

          Filesize

          936KB

        • memory/1092-45-0x0000000000400000-0x00000000004EA000-memory.dmp

          Filesize

          936KB

        • memory/1092-39-0x0000000000400000-0x00000000004EA000-memory.dmp

          Filesize

          936KB

        • memory/1132-37-0x0000000001070000-0x000000000131A000-memory.dmp

          Filesize

          2.7MB

        • memory/1564-23-0x0000000000CE0000-0x0000000000F8A000-memory.dmp

          Filesize

          2.7MB

        • memory/1592-51-0x0000000001070000-0x000000000131A000-memory.dmp

          Filesize

          2.7MB

        • memory/1664-3-0x00000000001B0000-0x000000000029A000-memory.dmp

          Filesize

          936KB

        • memory/1664-16-0x00000000007C0000-0x000000000081C000-memory.dmp

          Filesize

          368KB

        • memory/1664-18-0x0000000000400000-0x0000000000408000-memory.dmp

          Filesize

          32KB

        • memory/1664-19-0x0000000000620000-0x0000000000638000-memory.dmp

          Filesize

          96KB

        • memory/1664-20-0x0000000000650000-0x0000000000660000-memory.dmp

          Filesize

          64KB

        • memory/1664-14-0x00000000049B0000-0x00000000049F0000-memory.dmp

          Filesize

          256KB

        • memory/1664-33-0x0000000074260000-0x000000007494E000-memory.dmp

          Filesize

          6.9MB

        • memory/1664-9-0x00000000001B0000-0x000000000029A000-memory.dmp

          Filesize

          936KB

        • memory/1664-2-0x00000000001B0000-0x000000000029A000-memory.dmp

          Filesize

          936KB

        • memory/1664-15-0x0000000000350000-0x000000000035E000-memory.dmp

          Filesize

          56KB

        • memory/1664-7-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

          Filesize

          4KB

        • memory/1664-17-0x00000000003A0000-0x00000000003B2000-memory.dmp

          Filesize

          72KB

        • memory/1664-10-0x00000000001B0000-0x000000000029A000-memory.dmp

          Filesize

          936KB

        • memory/1664-13-0x0000000074260000-0x000000007494E000-memory.dmp

          Filesize

          6.9MB

        • memory/2168-61-0x0000000074260000-0x000000007494E000-memory.dmp

          Filesize

          6.9MB

        • memory/2168-63-0x0000000074260000-0x000000007494E000-memory.dmp

          Filesize

          6.9MB

        • memory/2168-62-0x0000000004AA0000-0x0000000004AE0000-memory.dmp

          Filesize

          256KB

        • memory/2264-35-0x0000000074260000-0x000000007494E000-memory.dmp

          Filesize

          6.9MB

        • memory/2264-32-0x0000000000120000-0x000000000020A000-memory.dmp

          Filesize

          936KB

        • memory/2264-31-0x0000000000120000-0x000000000020A000-memory.dmp

          Filesize

          936KB

        • memory/2264-25-0x0000000000120000-0x000000000020A000-memory.dmp

          Filesize

          936KB

        • memory/2264-34-0x0000000074260000-0x000000007494E000-memory.dmp

          Filesize

          6.9MB

        • memory/2324-1-0x00000000001E0000-0x00000000001E1000-memory.dmp

          Filesize

          4KB

        • memory/2324-0-0x0000000000950000-0x0000000000BFA000-memory.dmp

          Filesize

          2.7MB