Analysis
-
max time kernel
127s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
12-04-2024 01:21
Behavioral task
behavioral1
Sample
6536fadb04a1bb17334c71e0052b3c228756982a05f47b0f7c84d11d65f3b371.exe
Resource
win7-20240221-en
General
-
Target
6536fadb04a1bb17334c71e0052b3c228756982a05f47b0f7c84d11d65f3b371.exe
-
Size
3.0MB
-
MD5
aa560b36e63ca3b1b4978984754e5ceb
-
SHA1
83b34966a9af688d42b8cd648952a1e582a1ba34
-
SHA256
6536fadb04a1bb17334c71e0052b3c228756982a05f47b0f7c84d11d65f3b371
-
SHA512
5bdf091dd7d434682ee3f8e6b04bef1b79ddf807c4036bd70d83ebeff04ec93b6fd7b6e02032da99f322fe803ee809480ae492314830fcc07e51a6cb97fa9741
-
SSDEEP
49152:ZGX87p1EZKMnkmWg8LX5prviYDyKS5AypQxbRQAo9JnCmpKu/nRFfjI7L0qb:ZLHTPJg8z1mKnypSbRxo9JCm
Malware Config
Extracted
orcus
Новый тег
31.44.184.52:10996
sudo_t2l2oml1k2zm4hn99ibwa74761uvpduo
-
autostart_method
Disable
-
enable_keylogger
false
-
install_path
%appdata%\wordpresstrack\lowsecure.exe
-
reconnect_delay
10000
-
registry_keyname
Sudik
-
taskscheduler_taskname
sudik
-
watchdog_path
AppData\aga.exe
Signatures
-
Orcus main payload 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\wordpresstrack\lowsecure.exe family_orcus -
Orcurs Rat Executable 2 IoCs
Processes:
resource yara_rule behavioral2/memory/3196-1-0x0000000000900000-0x0000000000BFE000-memory.dmp orcus C:\Users\Admin\AppData\Roaming\wordpresstrack\lowsecure.exe orcus -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
6536fadb04a1bb17334c71e0052b3c228756982a05f47b0f7c84d11d65f3b371.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation 6536fadb04a1bb17334c71e0052b3c228756982a05f47b0f7c84d11d65f3b371.exe -
Executes dropped EXE 4 IoCs
Processes:
lowsecure.exelowsecure.exelowsecure.exelowsecure.exepid process 4856 lowsecure.exe 2472 lowsecure.exe 1740 lowsecure.exe 2596 lowsecure.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
lowsecure.exedescription pid process target process PID 4856 set thread context of 4572 4856 lowsecure.exe regasm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
6536fadb04a1bb17334c71e0052b3c228756982a05f47b0f7c84d11d65f3b371.exelowsecure.exeregasm.exepid process 3196 6536fadb04a1bb17334c71e0052b3c228756982a05f47b0f7c84d11d65f3b371.exe 4856 lowsecure.exe 4856 lowsecure.exe 4572 regasm.exe 4572 regasm.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
6536fadb04a1bb17334c71e0052b3c228756982a05f47b0f7c84d11d65f3b371.exelowsecure.exeregasm.exedescription pid process Token: SeDebugPrivilege 3196 6536fadb04a1bb17334c71e0052b3c228756982a05f47b0f7c84d11d65f3b371.exe Token: SeDebugPrivilege 4856 lowsecure.exe Token: SeDebugPrivilege 4572 regasm.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
6536fadb04a1bb17334c71e0052b3c228756982a05f47b0f7c84d11d65f3b371.exelowsecure.exedescription pid process target process PID 3196 wrote to memory of 4856 3196 6536fadb04a1bb17334c71e0052b3c228756982a05f47b0f7c84d11d65f3b371.exe lowsecure.exe PID 3196 wrote to memory of 4856 3196 6536fadb04a1bb17334c71e0052b3c228756982a05f47b0f7c84d11d65f3b371.exe lowsecure.exe PID 3196 wrote to memory of 4856 3196 6536fadb04a1bb17334c71e0052b3c228756982a05f47b0f7c84d11d65f3b371.exe lowsecure.exe PID 4856 wrote to memory of 4572 4856 lowsecure.exe regasm.exe PID 4856 wrote to memory of 4572 4856 lowsecure.exe regasm.exe PID 4856 wrote to memory of 4572 4856 lowsecure.exe regasm.exe PID 4856 wrote to memory of 4572 4856 lowsecure.exe regasm.exe PID 4856 wrote to memory of 4572 4856 lowsecure.exe regasm.exe PID 4856 wrote to memory of 4572 4856 lowsecure.exe regasm.exe PID 4856 wrote to memory of 4572 4856 lowsecure.exe regasm.exe PID 4856 wrote to memory of 4572 4856 lowsecure.exe regasm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6536fadb04a1bb17334c71e0052b3c228756982a05f47b0f7c84d11d65f3b371.exe"C:\Users\Admin\AppData\Local\Temp\6536fadb04a1bb17334c71e0052b3c228756982a05f47b0f7c84d11d65f3b371.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Users\Admin\AppData\Roaming\wordpresstrack\lowsecure.exe"C:\Users\Admin\AppData\Roaming\wordpresstrack\lowsecure.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4572
-
C:\Users\Admin\AppData\Roaming\wordpresstrack\lowsecure.exeC:\Users\Admin\AppData\Roaming\wordpresstrack\lowsecure.exe1⤵
- Executes dropped EXE
PID:2472
-
C:\Users\Admin\AppData\Roaming\wordpresstrack\lowsecure.exeC:\Users\Admin\AppData\Roaming\wordpresstrack\lowsecure.exe1⤵
- Executes dropped EXE
PID:1740
-
C:\Users\Admin\AppData\Roaming\wordpresstrack\lowsecure.exeC:\Users\Admin\AppData\Roaming\wordpresstrack\lowsecure.exe1⤵
- Executes dropped EXE
PID:2596
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5663b8d5469caa4489d463aa9bc18124f
SHA1e57123a7d969115853ea631a3b33826335025d28
SHA2567b4fa505452f0b8ac74bb31f5a03b13342836318018fb18d224ae2ff11b1a7e8
SHA51245e373295125a629fcc0b19609608d969c9106514918bfac5d6b8e340e407434577b825741b8fa6a043c8f3f5c1a030ba8857da5f4e8ef15a551ce3c5fe03b55
-
Filesize
3.0MB
MD5aa560b36e63ca3b1b4978984754e5ceb
SHA183b34966a9af688d42b8cd648952a1e582a1ba34
SHA2566536fadb04a1bb17334c71e0052b3c228756982a05f47b0f7c84d11d65f3b371
SHA5125bdf091dd7d434682ee3f8e6b04bef1b79ddf807c4036bd70d83ebeff04ec93b6fd7b6e02032da99f322fe803ee809480ae492314830fcc07e51a6cb97fa9741
-
Filesize
357B
MD5a2b76cea3a59fa9af5ea21ff68139c98
SHA135d76475e6a54c168f536e30206578babff58274
SHA256f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839
SHA512b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad