Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
12-04-2024 01:21
Static task
static1
Behavioral task
behavioral1
Sample
1b670ff7d1762cf8ace33e878b4d4364af807690ebf4baa0fb817d1beeb7d793.exe
Resource
win7-20240221-en
General
-
Target
1b670ff7d1762cf8ace33e878b4d4364af807690ebf4baa0fb817d1beeb7d793.exe
-
Size
2.6MB
-
MD5
8d53a3e657af6caeb670bab7ddfa29fa
-
SHA1
96d5ee1307916044d6b1e4f3d867a282c020bb20
-
SHA256
1b670ff7d1762cf8ace33e878b4d4364af807690ebf4baa0fb817d1beeb7d793
-
SHA512
86f4bb8190928f6458efb46008789d80652a743fd8edab6f2744182969f39f5ccd01feb14cc2cd8a52fa0574b0ebad3fff46c392251fcf271bb553a08e049eb8
-
SSDEEP
24576:SAHnh+eWsN3skA4RV1Hom2KXSmHdK3VqbE6przwKpwvEuM/SD0wugdDEl6NrL/NQ:Vh+ZkldoPKiYdKr9K
Malware Config
Extracted
orcus
ligeon
ligeon.ddns.net:1606
b98fb09a59c24a81b9d17a55ccf2c036
-
autostart_method
Disable
-
enable_keylogger
true
-
install_path
%programfiles%\Orcus\Orcus.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
Orcus
-
watchdog_path
AppData\OrcusWatchdog.exe
Signatures
-
Orcurs Rat Executable 2 IoCs
Processes:
resource yara_rule behavioral2/memory/2616-2-0x0000000000400000-0x00000000004EA000-memory.dmp orcus behavioral2/memory/2616-30-0x00000000057E0000-0x00000000057F0000-memory.dmp orcus -
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
setspn.exesetspn.exesetspn.exe1b670ff7d1762cf8ace33e878b4d4364af807690ebf4baa0fb817d1beeb7d793.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation setspn.exe Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation setspn.exe Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation setspn.exe Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation 1b670ff7d1762cf8ace33e878b4d4364af807690ebf4baa0fb817d1beeb7d793.exe -
Executes dropped EXE 3 IoCs
Processes:
setspn.exesetspn.exesetspn.exepid process 2864 setspn.exe 1504 setspn.exe 1760 setspn.exe -
AutoIT Executable 5 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral2/memory/4312-0-0x0000000000980000-0x0000000000C2A000-memory.dmp autoit_exe C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe autoit_exe behavioral2/memory/2864-22-0x0000000000750000-0x00000000009FA000-memory.dmp autoit_exe behavioral2/memory/1504-35-0x0000000000750000-0x00000000009FA000-memory.dmp autoit_exe behavioral2/memory/1760-46-0x0000000000750000-0x00000000009FA000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
1b670ff7d1762cf8ace33e878b4d4364af807690ebf4baa0fb817d1beeb7d793.exesetspn.exesetspn.exesetspn.exedescription pid process target process PID 4312 set thread context of 2616 4312 1b670ff7d1762cf8ace33e878b4d4364af807690ebf4baa0fb817d1beeb7d793.exe RegSvcs.exe PID 2864 set thread context of 3796 2864 setspn.exe RegSvcs.exe PID 1504 set thread context of 3932 1504 setspn.exe RegSvcs.exe PID 1760 set thread context of 4504 1760 setspn.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 2284 schtasks.exe 4980 schtasks.exe 2944 schtasks.exe 184 schtasks.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
1b670ff7d1762cf8ace33e878b4d4364af807690ebf4baa0fb817d1beeb7d793.exesetspn.exesetspn.exesetspn.exepid process 4312 1b670ff7d1762cf8ace33e878b4d4364af807690ebf4baa0fb817d1beeb7d793.exe 4312 1b670ff7d1762cf8ace33e878b4d4364af807690ebf4baa0fb817d1beeb7d793.exe 4312 1b670ff7d1762cf8ace33e878b4d4364af807690ebf4baa0fb817d1beeb7d793.exe 4312 1b670ff7d1762cf8ace33e878b4d4364af807690ebf4baa0fb817d1beeb7d793.exe 2864 setspn.exe 2864 setspn.exe 2864 setspn.exe 2864 setspn.exe 1504 setspn.exe 1504 setspn.exe 1504 setspn.exe 1504 setspn.exe 1760 setspn.exe 1760 setspn.exe 1760 setspn.exe 1760 setspn.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 2616 RegSvcs.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
RegSvcs.exepid process 2616 RegSvcs.exe -
Suspicious use of WriteProcessMemory 38 IoCs
Processes:
1b670ff7d1762cf8ace33e878b4d4364af807690ebf4baa0fb817d1beeb7d793.execmd.exesetspn.exesetspn.exesetspn.exedescription pid process target process PID 4312 wrote to memory of 2616 4312 1b670ff7d1762cf8ace33e878b4d4364af807690ebf4baa0fb817d1beeb7d793.exe RegSvcs.exe PID 4312 wrote to memory of 2616 4312 1b670ff7d1762cf8ace33e878b4d4364af807690ebf4baa0fb817d1beeb7d793.exe RegSvcs.exe PID 4312 wrote to memory of 2616 4312 1b670ff7d1762cf8ace33e878b4d4364af807690ebf4baa0fb817d1beeb7d793.exe RegSvcs.exe PID 4312 wrote to memory of 2616 4312 1b670ff7d1762cf8ace33e878b4d4364af807690ebf4baa0fb817d1beeb7d793.exe RegSvcs.exe PID 4312 wrote to memory of 2616 4312 1b670ff7d1762cf8ace33e878b4d4364af807690ebf4baa0fb817d1beeb7d793.exe RegSvcs.exe PID 4312 wrote to memory of 2284 4312 1b670ff7d1762cf8ace33e878b4d4364af807690ebf4baa0fb817d1beeb7d793.exe schtasks.exe PID 4312 wrote to memory of 2284 4312 1b670ff7d1762cf8ace33e878b4d4364af807690ebf4baa0fb817d1beeb7d793.exe schtasks.exe PID 4312 wrote to memory of 2284 4312 1b670ff7d1762cf8ace33e878b4d4364af807690ebf4baa0fb817d1beeb7d793.exe schtasks.exe PID 4312 wrote to memory of 5092 4312 1b670ff7d1762cf8ace33e878b4d4364af807690ebf4baa0fb817d1beeb7d793.exe cmd.exe PID 4312 wrote to memory of 5092 4312 1b670ff7d1762cf8ace33e878b4d4364af807690ebf4baa0fb817d1beeb7d793.exe cmd.exe PID 4312 wrote to memory of 5092 4312 1b670ff7d1762cf8ace33e878b4d4364af807690ebf4baa0fb817d1beeb7d793.exe cmd.exe PID 5092 wrote to memory of 1900 5092 cmd.exe PING.EXE PID 5092 wrote to memory of 1900 5092 cmd.exe PING.EXE PID 5092 wrote to memory of 1900 5092 cmd.exe PING.EXE PID 2864 wrote to memory of 3796 2864 setspn.exe RegSvcs.exe PID 2864 wrote to memory of 3796 2864 setspn.exe RegSvcs.exe PID 2864 wrote to memory of 3796 2864 setspn.exe RegSvcs.exe PID 2864 wrote to memory of 3796 2864 setspn.exe RegSvcs.exe PID 2864 wrote to memory of 3796 2864 setspn.exe RegSvcs.exe PID 2864 wrote to memory of 4980 2864 setspn.exe schtasks.exe PID 2864 wrote to memory of 4980 2864 setspn.exe schtasks.exe PID 2864 wrote to memory of 4980 2864 setspn.exe schtasks.exe PID 1504 wrote to memory of 3932 1504 setspn.exe RegSvcs.exe PID 1504 wrote to memory of 3932 1504 setspn.exe RegSvcs.exe PID 1504 wrote to memory of 3932 1504 setspn.exe RegSvcs.exe PID 1504 wrote to memory of 3932 1504 setspn.exe RegSvcs.exe PID 1504 wrote to memory of 3932 1504 setspn.exe RegSvcs.exe PID 1504 wrote to memory of 2944 1504 setspn.exe schtasks.exe PID 1504 wrote to memory of 2944 1504 setspn.exe schtasks.exe PID 1504 wrote to memory of 2944 1504 setspn.exe schtasks.exe PID 1760 wrote to memory of 4504 1760 setspn.exe RegSvcs.exe PID 1760 wrote to memory of 4504 1760 setspn.exe RegSvcs.exe PID 1760 wrote to memory of 4504 1760 setspn.exe RegSvcs.exe PID 1760 wrote to memory of 4504 1760 setspn.exe RegSvcs.exe PID 1760 wrote to memory of 4504 1760 setspn.exe RegSvcs.exe PID 1760 wrote to memory of 184 1760 setspn.exe schtasks.exe PID 1760 wrote to memory of 184 1760 setspn.exe schtasks.exe PID 1760 wrote to memory of 184 1760 setspn.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1b670ff7d1762cf8ace33e878b4d4364af807690ebf4baa0fb817d1beeb7d793.exe"C:\Users\Admin\AppData\Local\Temp\1b670ff7d1762cf8ace33e878b4d4364af807690ebf4baa0fb817d1beeb7d793.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2616 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:2284 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /k ping 127.0.0.1 -t 0 & del C:\Users\Admin\AppData\Local\Temp\1b670ff7d1762cf8ace33e878b4d4364af807690ebf4baa0fb817d1beeb7d793.exe & exit2⤵
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -t 03⤵
- Runs ping.exe
PID:1900
-
C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exeC:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵PID:3796
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:4980
-
C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exeC:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵PID:3932
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:2944
-
C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exeC:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵PID:4504
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:184
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD50672db2ef13237d5cb85075ff4915942
SHA1ad8b4d3eb5e40791c47d48b22e273486f25f663f
SHA2560a933408890369b5a178f9c30aa93d2c94f425650815cf8e8310de4e90a3b519
SHA51284ad10ba5b695567d33a52f786405a5544aa49d8d23631ba9edf3afa877c5dbd81570d15bcf74bce5d9fb1afad2117d0a4ef913b396c0d923afefe615619c84b
-
Filesize
2.6MB
MD59ba31f69e1bd48fac5513a8ece23b98f
SHA1075b764c5556b2d5547ba613043169740443c573
SHA25663877b3c46ecc2639003409299de09a78a27dea31ab5882d068ef70df697918a
SHA5120d8b41b53699d166d04bebde906afd403ca394e70a03edc00e434e742cc7eb5d287e065099193296a35b1bf46fb89da5da5cbe330fbb7c5361596c56797495e3