Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-04-2024 01:21

General

  • Target

    1b670ff7d1762cf8ace33e878b4d4364af807690ebf4baa0fb817d1beeb7d793.exe

  • Size

    2.6MB

  • MD5

    8d53a3e657af6caeb670bab7ddfa29fa

  • SHA1

    96d5ee1307916044d6b1e4f3d867a282c020bb20

  • SHA256

    1b670ff7d1762cf8ace33e878b4d4364af807690ebf4baa0fb817d1beeb7d793

  • SHA512

    86f4bb8190928f6458efb46008789d80652a743fd8edab6f2744182969f39f5ccd01feb14cc2cd8a52fa0574b0ebad3fff46c392251fcf271bb553a08e049eb8

  • SSDEEP

    24576:SAHnh+eWsN3skA4RV1Hom2KXSmHdK3VqbE6przwKpwvEuM/SD0wugdDEl6NrL/NQ:Vh+ZkldoPKiYdKr9K

Malware Config

Extracted

Family

orcus

Botnet

ligeon

C2

ligeon.ddns.net:1606

Mutex

b98fb09a59c24a81b9d17a55ccf2c036

Attributes
  • autostart_method

    Disable

  • enable_keylogger

    true

  • install_path

    %programfiles%\Orcus\Orcus.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\OrcusWatchdog.exe

Signatures

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

  • Orcurs Rat Executable 2 IoCs
  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • AutoIT Executable 5 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1b670ff7d1762cf8ace33e878b4d4364af807690ebf4baa0fb817d1beeb7d793.exe
    "C:\Users\Admin\AppData\Local\Temp\1b670ff7d1762cf8ace33e878b4d4364af807690ebf4baa0fb817d1beeb7d793.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4312
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2616
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F
      2⤵
      • Creates scheduled task(s)
      PID:2284
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /k ping 127.0.0.1 -t 0 & del C:\Users\Admin\AppData\Local\Temp\1b670ff7d1762cf8ace33e878b4d4364af807690ebf4baa0fb817d1beeb7d793.exe & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5092
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -t 0
        3⤵
        • Runs ping.exe
        PID:1900
  • C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe
    C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe
    1⤵
    • Checks computer location settings
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2864
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      2⤵
        PID:3796
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F
        2⤵
        • Creates scheduled task(s)
        PID:4980
    • C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe
      C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe
      1⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1504
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        2⤵
          PID:3932
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F
          2⤵
          • Creates scheduled task(s)
          PID:2944
      • C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe
        C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1760
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
          2⤵
            PID:4504
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F
            2⤵
            • Creates scheduled task(s)
            PID:184

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegSvcs.exe.log

          Filesize

          1KB

          MD5

          0672db2ef13237d5cb85075ff4915942

          SHA1

          ad8b4d3eb5e40791c47d48b22e273486f25f663f

          SHA256

          0a933408890369b5a178f9c30aa93d2c94f425650815cf8e8310de4e90a3b519

          SHA512

          84ad10ba5b695567d33a52f786405a5544aa49d8d23631ba9edf3afa877c5dbd81570d15bcf74bce5d9fb1afad2117d0a4ef913b396c0d923afefe615619c84b

        • C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe

          Filesize

          2.6MB

          MD5

          9ba31f69e1bd48fac5513a8ece23b98f

          SHA1

          075b764c5556b2d5547ba613043169740443c573

          SHA256

          63877b3c46ecc2639003409299de09a78a27dea31ab5882d068ef70df697918a

          SHA512

          0d8b41b53699d166d04bebde906afd403ca394e70a03edc00e434e742cc7eb5d287e065099193296a35b1bf46fb89da5da5cbe330fbb7c5361596c56797495e3

        • memory/1504-35-0x0000000000750000-0x00000000009FA000-memory.dmp

          Filesize

          2.7MB

        • memory/1760-46-0x0000000000750000-0x00000000009FA000-memory.dmp

          Filesize

          2.7MB

        • memory/2616-11-0x0000000005DC0000-0x0000000006364000-memory.dmp

          Filesize

          5.6MB

        • memory/2616-24-0x0000000074230000-0x00000000749E0000-memory.dmp

          Filesize

          7.7MB

        • memory/2616-10-0x0000000005680000-0x00000000056DC000-memory.dmp

          Filesize

          368KB

        • memory/2616-2-0x0000000000400000-0x00000000004EA000-memory.dmp

          Filesize

          936KB

        • memory/2616-14-0x0000000005810000-0x00000000058A2000-memory.dmp

          Filesize

          584KB

        • memory/2616-15-0x00000000057F0000-0x0000000005802000-memory.dmp

          Filesize

          72KB

        • memory/2616-16-0x0000000005CF0000-0x0000000005CF8000-memory.dmp

          Filesize

          32KB

        • memory/2616-17-0x0000000005D10000-0x0000000005D28000-memory.dmp

          Filesize

          96KB

        • memory/2616-18-0x0000000006640000-0x0000000006802000-memory.dmp

          Filesize

          1.8MB

        • memory/2616-20-0x00000000064B0000-0x00000000064BA000-memory.dmp

          Filesize

          40KB

        • memory/2616-19-0x0000000005D90000-0x0000000005DA0000-memory.dmp

          Filesize

          64KB

        • memory/2616-8-0x00000000057E0000-0x00000000057F0000-memory.dmp

          Filesize

          64KB

        • memory/2616-7-0x0000000074230000-0x00000000749E0000-memory.dmp

          Filesize

          7.7MB

        • memory/2616-9-0x00000000013D0000-0x00000000013DE000-memory.dmp

          Filesize

          56KB

        • memory/2616-30-0x00000000057E0000-0x00000000057F0000-memory.dmp

          Filesize

          64KB

        • memory/2864-22-0x0000000000750000-0x00000000009FA000-memory.dmp

          Filesize

          2.7MB

        • memory/3796-31-0x0000000074230000-0x00000000749E0000-memory.dmp

          Filesize

          7.7MB

        • memory/3796-33-0x0000000074230000-0x00000000749E0000-memory.dmp

          Filesize

          7.7MB

        • memory/3932-42-0x0000000074230000-0x00000000749E0000-memory.dmp

          Filesize

          7.7MB

        • memory/3932-43-0x0000000005650000-0x0000000005660000-memory.dmp

          Filesize

          64KB

        • memory/3932-44-0x0000000074230000-0x00000000749E0000-memory.dmp

          Filesize

          7.7MB

        • memory/4312-0-0x0000000000980000-0x0000000000C2A000-memory.dmp

          Filesize

          2.7MB

        • memory/4312-1-0x00000000010F0000-0x00000000010F1000-memory.dmp

          Filesize

          4KB

        • memory/4504-52-0x0000000074230000-0x00000000749E0000-memory.dmp

          Filesize

          7.7MB

        • memory/4504-53-0x00000000058A0000-0x00000000058B0000-memory.dmp

          Filesize

          64KB

        • memory/4504-54-0x0000000074230000-0x00000000749E0000-memory.dmp

          Filesize

          7.7MB