Analysis
-
max time kernel
126s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
12-04-2024 01:21
Behavioral task
behavioral1
Sample
6536fadb04a1bb17334c71e0052b3c228756982a05f47b0f7c84d11d65f3b371.exe
Resource
win7-20240221-en
General
-
Target
6536fadb04a1bb17334c71e0052b3c228756982a05f47b0f7c84d11d65f3b371.exe
-
Size
3.0MB
-
MD5
aa560b36e63ca3b1b4978984754e5ceb
-
SHA1
83b34966a9af688d42b8cd648952a1e582a1ba34
-
SHA256
6536fadb04a1bb17334c71e0052b3c228756982a05f47b0f7c84d11d65f3b371
-
SHA512
5bdf091dd7d434682ee3f8e6b04bef1b79ddf807c4036bd70d83ebeff04ec93b6fd7b6e02032da99f322fe803ee809480ae492314830fcc07e51a6cb97fa9741
-
SSDEEP
49152:ZGX87p1EZKMnkmWg8LX5prviYDyKS5AypQxbRQAo9JnCmpKu/nRFfjI7L0qb:ZLHTPJg8z1mKnypSbRxo9JCm
Malware Config
Extracted
orcus
Новый тег
31.44.184.52:10996
sudo_t2l2oml1k2zm4hn99ibwa74761uvpduo
-
autostart_method
Disable
-
enable_keylogger
false
-
install_path
%appdata%\wordpresstrack\lowsecure.exe
-
reconnect_delay
10000
-
registry_keyname
Sudik
-
taskscheduler_taskname
sudik
-
watchdog_path
AppData\aga.exe
Signatures
-
Orcus main payload 1 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Roaming\wordpresstrack\lowsecure.exe family_orcus -
Orcurs Rat Executable 9 IoCs
Processes:
resource yara_rule behavioral1/memory/2304-0-0x0000000000850000-0x0000000000B4E000-memory.dmp orcus \Users\Admin\AppData\Roaming\wordpresstrack\lowsecure.exe orcus behavioral1/memory/2792-17-0x0000000000C10000-0x0000000000F0E000-memory.dmp orcus behavioral1/memory/2520-24-0x0000000000400000-0x00000000006FE000-memory.dmp orcus behavioral1/memory/2520-26-0x0000000000400000-0x00000000006FE000-memory.dmp orcus behavioral1/memory/2520-30-0x0000000000400000-0x00000000006FE000-memory.dmp orcus behavioral1/memory/2520-32-0x0000000000400000-0x00000000006FE000-memory.dmp orcus behavioral1/memory/2520-34-0x0000000000400000-0x00000000006FE000-memory.dmp orcus behavioral1/memory/2568-40-0x00000000012C0000-0x00000000015BE000-memory.dmp orcus -
Executes dropped EXE 4 IoCs
Processes:
lowsecure.exelowsecure.exelowsecure.exelowsecure.exepid process 2792 lowsecure.exe 2568 lowsecure.exe 1668 lowsecure.exe 300 lowsecure.exe -
Loads dropped DLL 1 IoCs
Processes:
6536fadb04a1bb17334c71e0052b3c228756982a05f47b0f7c84d11d65f3b371.exepid process 2304 6536fadb04a1bb17334c71e0052b3c228756982a05f47b0f7c84d11d65f3b371.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
lowsecure.exedescription pid process target process PID 2792 set thread context of 2520 2792 lowsecure.exe installutil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
6536fadb04a1bb17334c71e0052b3c228756982a05f47b0f7c84d11d65f3b371.exelowsecure.exeinstallutil.exepid process 2304 6536fadb04a1bb17334c71e0052b3c228756982a05f47b0f7c84d11d65f3b371.exe 2792 lowsecure.exe 2792 lowsecure.exe 2520 installutil.exe 2520 installutil.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
6536fadb04a1bb17334c71e0052b3c228756982a05f47b0f7c84d11d65f3b371.exelowsecure.exeinstallutil.exedescription pid process Token: SeDebugPrivilege 2304 6536fadb04a1bb17334c71e0052b3c228756982a05f47b0f7c84d11d65f3b371.exe Token: SeDebugPrivilege 2792 lowsecure.exe Token: SeDebugPrivilege 2520 installutil.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
6536fadb04a1bb17334c71e0052b3c228756982a05f47b0f7c84d11d65f3b371.exelowsecure.exetaskeng.exedescription pid process target process PID 2304 wrote to memory of 2792 2304 6536fadb04a1bb17334c71e0052b3c228756982a05f47b0f7c84d11d65f3b371.exe lowsecure.exe PID 2304 wrote to memory of 2792 2304 6536fadb04a1bb17334c71e0052b3c228756982a05f47b0f7c84d11d65f3b371.exe lowsecure.exe PID 2304 wrote to memory of 2792 2304 6536fadb04a1bb17334c71e0052b3c228756982a05f47b0f7c84d11d65f3b371.exe lowsecure.exe PID 2304 wrote to memory of 2792 2304 6536fadb04a1bb17334c71e0052b3c228756982a05f47b0f7c84d11d65f3b371.exe lowsecure.exe PID 2792 wrote to memory of 2520 2792 lowsecure.exe installutil.exe PID 2792 wrote to memory of 2520 2792 lowsecure.exe installutil.exe PID 2792 wrote to memory of 2520 2792 lowsecure.exe installutil.exe PID 2792 wrote to memory of 2520 2792 lowsecure.exe installutil.exe PID 2792 wrote to memory of 2520 2792 lowsecure.exe installutil.exe PID 2792 wrote to memory of 2520 2792 lowsecure.exe installutil.exe PID 2792 wrote to memory of 2520 2792 lowsecure.exe installutil.exe PID 2792 wrote to memory of 2520 2792 lowsecure.exe installutil.exe PID 2792 wrote to memory of 2520 2792 lowsecure.exe installutil.exe PID 2792 wrote to memory of 2520 2792 lowsecure.exe installutil.exe PID 2792 wrote to memory of 2520 2792 lowsecure.exe installutil.exe PID 2792 wrote to memory of 2520 2792 lowsecure.exe installutil.exe PID 2552 wrote to memory of 2568 2552 taskeng.exe lowsecure.exe PID 2552 wrote to memory of 2568 2552 taskeng.exe lowsecure.exe PID 2552 wrote to memory of 2568 2552 taskeng.exe lowsecure.exe PID 2552 wrote to memory of 2568 2552 taskeng.exe lowsecure.exe PID 2552 wrote to memory of 1668 2552 taskeng.exe lowsecure.exe PID 2552 wrote to memory of 1668 2552 taskeng.exe lowsecure.exe PID 2552 wrote to memory of 1668 2552 taskeng.exe lowsecure.exe PID 2552 wrote to memory of 1668 2552 taskeng.exe lowsecure.exe PID 2552 wrote to memory of 300 2552 taskeng.exe lowsecure.exe PID 2552 wrote to memory of 300 2552 taskeng.exe lowsecure.exe PID 2552 wrote to memory of 300 2552 taskeng.exe lowsecure.exe PID 2552 wrote to memory of 300 2552 taskeng.exe lowsecure.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6536fadb04a1bb17334c71e0052b3c228756982a05f47b0f7c84d11d65f3b371.exe"C:\Users\Admin\AppData\Local\Temp\6536fadb04a1bb17334c71e0052b3c228756982a05f47b0f7c84d11d65f3b371.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Users\Admin\AppData\Roaming\wordpresstrack\lowsecure.exe"C:\Users\Admin\AppData\Roaming\wordpresstrack\lowsecure.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2520
-
C:\Windows\system32\taskeng.exetaskeng.exe {F3E4C7C1-A0B1-44D5-8B49-494C9925116C} S-1-5-21-3452737119-3959686427-228443150-1000:QGTQZTRE\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Roaming\wordpresstrack\lowsecure.exeC:\Users\Admin\AppData\Roaming\wordpresstrack\lowsecure.exe2⤵
- Executes dropped EXE
PID:2568 -
C:\Users\Admin\AppData\Roaming\wordpresstrack\lowsecure.exeC:\Users\Admin\AppData\Roaming\wordpresstrack\lowsecure.exe2⤵
- Executes dropped EXE
PID:1668 -
C:\Users\Admin\AppData\Roaming\wordpresstrack\lowsecure.exeC:\Users\Admin\AppData\Roaming\wordpresstrack\lowsecure.exe2⤵
- Executes dropped EXE
PID:300
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
357B
MD5a2b76cea3a59fa9af5ea21ff68139c98
SHA135d76475e6a54c168f536e30206578babff58274
SHA256f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839
SHA512b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad
-
Filesize
3.0MB
MD5aa560b36e63ca3b1b4978984754e5ceb
SHA183b34966a9af688d42b8cd648952a1e582a1ba34
SHA2566536fadb04a1bb17334c71e0052b3c228756982a05f47b0f7c84d11d65f3b371
SHA5125bdf091dd7d434682ee3f8e6b04bef1b79ddf807c4036bd70d83ebeff04ec93b6fd7b6e02032da99f322fe803ee809480ae492314830fcc07e51a6cb97fa9741