Analysis
-
max time kernel
146s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240319-en -
resource tags
arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system -
submitted
12-04-2024 01:52
Static task
static1
Behavioral task
behavioral1
Sample
cb49bf2372e28eedd203c223b78e1e2f9cdb8677dc55efac23aa2ce6bd355bbf.exe
Resource
win7-20240220-en
General
-
Target
cb49bf2372e28eedd203c223b78e1e2f9cdb8677dc55efac23aa2ce6bd355bbf.exe
-
Size
2.6MB
-
MD5
d8ee7afd9f98df1d92b3ad3c38f405a1
-
SHA1
921b80872b0733073b94b3c461e0e0c901890a29
-
SHA256
cb49bf2372e28eedd203c223b78e1e2f9cdb8677dc55efac23aa2ce6bd355bbf
-
SHA512
ad4b2f873cbec1163d1a5f5717d43c10271d2c20adce615f0f619d5678cfa0d7f1ebe456429848a058f57cc5e09332d4247deac359e5cf55a10c6e75aa5c3839
-
SSDEEP
24576:SAHnh+eWsN3skA4RV1Hom2KXSmHdK3VqbE6przwKpwvEuM/SD0wugdDEl6NrL/NQ:Vh+ZkldoPKiYdKr9i
Malware Config
Extracted
orcus
ligeon
ligeon.ddns.net:1606
b98fb09a59c24a81b9d17a55ccf2c036
-
autostart_method
Disable
-
enable_keylogger
true
-
install_path
%programfiles%\Orcus\Orcus.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
Orcus
-
watchdog_path
AppData\OrcusWatchdog.exe
Signatures
-
Orcurs Rat Executable 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1084-2-0x0000000000400000-0x00000000004EA000-memory.dmp orcus -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
cb49bf2372e28eedd203c223b78e1e2f9cdb8677dc55efac23aa2ce6bd355bbf.exesetspn.exesetspn.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\Control Panel\International\Geo\Nation cb49bf2372e28eedd203c223b78e1e2f9cdb8677dc55efac23aa2ce6bd355bbf.exe Key value queried \REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\Control Panel\International\Geo\Nation setspn.exe Key value queried \REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\Control Panel\International\Geo\Nation setspn.exe -
Executes dropped EXE 2 IoCs
Processes:
setspn.exesetspn.exepid process 3280 setspn.exe 4384 setspn.exe -
AutoIT Executable 4 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral2/memory/3728-0-0x0000000000190000-0x000000000043A000-memory.dmp autoit_exe C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe autoit_exe behavioral2/memory/3280-24-0x0000000000A40000-0x0000000000CEA000-memory.dmp autoit_exe behavioral2/memory/4384-36-0x0000000000A40000-0x0000000000CEA000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
cb49bf2372e28eedd203c223b78e1e2f9cdb8677dc55efac23aa2ce6bd355bbf.exesetspn.exesetspn.exedescription pid process target process PID 3728 set thread context of 1084 3728 cb49bf2372e28eedd203c223b78e1e2f9cdb8677dc55efac23aa2ce6bd355bbf.exe RegSvcs.exe PID 3280 set thread context of 4384 3280 setspn.exe RegSvcs.exe PID 4384 set thread context of 1676 4384 setspn.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 1940 schtasks.exe 4400 schtasks.exe 4368 schtasks.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
cb49bf2372e28eedd203c223b78e1e2f9cdb8677dc55efac23aa2ce6bd355bbf.exesetspn.exesetspn.exepid process 3728 cb49bf2372e28eedd203c223b78e1e2f9cdb8677dc55efac23aa2ce6bd355bbf.exe 3728 cb49bf2372e28eedd203c223b78e1e2f9cdb8677dc55efac23aa2ce6bd355bbf.exe 3728 cb49bf2372e28eedd203c223b78e1e2f9cdb8677dc55efac23aa2ce6bd355bbf.exe 3728 cb49bf2372e28eedd203c223b78e1e2f9cdb8677dc55efac23aa2ce6bd355bbf.exe 3280 setspn.exe 3280 setspn.exe 3280 setspn.exe 3280 setspn.exe 4384 setspn.exe 4384 setspn.exe 4384 setspn.exe 4384 setspn.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 1084 RegSvcs.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
RegSvcs.exepid process 1084 RegSvcs.exe -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
cb49bf2372e28eedd203c223b78e1e2f9cdb8677dc55efac23aa2ce6bd355bbf.execmd.exesetspn.exesetspn.exedescription pid process target process PID 3728 wrote to memory of 1084 3728 cb49bf2372e28eedd203c223b78e1e2f9cdb8677dc55efac23aa2ce6bd355bbf.exe RegSvcs.exe PID 3728 wrote to memory of 1084 3728 cb49bf2372e28eedd203c223b78e1e2f9cdb8677dc55efac23aa2ce6bd355bbf.exe RegSvcs.exe PID 3728 wrote to memory of 1084 3728 cb49bf2372e28eedd203c223b78e1e2f9cdb8677dc55efac23aa2ce6bd355bbf.exe RegSvcs.exe PID 3728 wrote to memory of 1084 3728 cb49bf2372e28eedd203c223b78e1e2f9cdb8677dc55efac23aa2ce6bd355bbf.exe RegSvcs.exe PID 3728 wrote to memory of 1084 3728 cb49bf2372e28eedd203c223b78e1e2f9cdb8677dc55efac23aa2ce6bd355bbf.exe RegSvcs.exe PID 3728 wrote to memory of 4368 3728 cb49bf2372e28eedd203c223b78e1e2f9cdb8677dc55efac23aa2ce6bd355bbf.exe schtasks.exe PID 3728 wrote to memory of 4368 3728 cb49bf2372e28eedd203c223b78e1e2f9cdb8677dc55efac23aa2ce6bd355bbf.exe schtasks.exe PID 3728 wrote to memory of 4368 3728 cb49bf2372e28eedd203c223b78e1e2f9cdb8677dc55efac23aa2ce6bd355bbf.exe schtasks.exe PID 3728 wrote to memory of 1064 3728 cb49bf2372e28eedd203c223b78e1e2f9cdb8677dc55efac23aa2ce6bd355bbf.exe cmd.exe PID 3728 wrote to memory of 1064 3728 cb49bf2372e28eedd203c223b78e1e2f9cdb8677dc55efac23aa2ce6bd355bbf.exe cmd.exe PID 3728 wrote to memory of 1064 3728 cb49bf2372e28eedd203c223b78e1e2f9cdb8677dc55efac23aa2ce6bd355bbf.exe cmd.exe PID 1064 wrote to memory of 3280 1064 cmd.exe PING.EXE PID 1064 wrote to memory of 3280 1064 cmd.exe PING.EXE PID 1064 wrote to memory of 3280 1064 cmd.exe PING.EXE PID 3280 wrote to memory of 4384 3280 setspn.exe RegSvcs.exe PID 3280 wrote to memory of 4384 3280 setspn.exe RegSvcs.exe PID 3280 wrote to memory of 4384 3280 setspn.exe RegSvcs.exe PID 3280 wrote to memory of 4384 3280 setspn.exe RegSvcs.exe PID 3280 wrote to memory of 4384 3280 setspn.exe RegSvcs.exe PID 3280 wrote to memory of 1940 3280 setspn.exe schtasks.exe PID 3280 wrote to memory of 1940 3280 setspn.exe schtasks.exe PID 3280 wrote to memory of 1940 3280 setspn.exe schtasks.exe PID 4384 wrote to memory of 1676 4384 setspn.exe RegSvcs.exe PID 4384 wrote to memory of 1676 4384 setspn.exe RegSvcs.exe PID 4384 wrote to memory of 1676 4384 setspn.exe RegSvcs.exe PID 4384 wrote to memory of 1676 4384 setspn.exe RegSvcs.exe PID 4384 wrote to memory of 1676 4384 setspn.exe RegSvcs.exe PID 4384 wrote to memory of 4400 4384 setspn.exe schtasks.exe PID 4384 wrote to memory of 4400 4384 setspn.exe schtasks.exe PID 4384 wrote to memory of 4400 4384 setspn.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cb49bf2372e28eedd203c223b78e1e2f9cdb8677dc55efac23aa2ce6bd355bbf.exe"C:\Users\Admin\AppData\Local\Temp\cb49bf2372e28eedd203c223b78e1e2f9cdb8677dc55efac23aa2ce6bd355bbf.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1084 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:4368 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /k ping 127.0.0.1 -t 0 & del C:\Users\Admin\AppData\Local\Temp\cb49bf2372e28eedd203c223b78e1e2f9cdb8677dc55efac23aa2ce6bd355bbf.exe & exit2⤵
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -t 03⤵
- Runs ping.exe
PID:3280
-
C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exeC:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵PID:4384
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:1940
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3776 --field-trial-handle=2232,i,9772508353233483703,11473701862007458502,262144 --variations-seed-version /prefetch:81⤵PID:3504
-
C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exeC:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵PID:1676
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:4400
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD50672db2ef13237d5cb85075ff4915942
SHA1ad8b4d3eb5e40791c47d48b22e273486f25f663f
SHA2560a933408890369b5a178f9c30aa93d2c94f425650815cf8e8310de4e90a3b519
SHA51284ad10ba5b695567d33a52f786405a5544aa49d8d23631ba9edf3afa877c5dbd81570d15bcf74bce5d9fb1afad2117d0a4ef913b396c0d923afefe615619c84b
-
Filesize
2.6MB
MD59f41b102f39b28b4a631c2dbadfebbb2
SHA11ac8ef58dd9e12641083ffb693fab2be2901b7d1
SHA256bddb778c21561f38163787e8dee90585695b2bbd83b8c53a68409825308d211b
SHA5128e01fb00575e0d465689095f4ab8666813be09f0c1332de8af57e85a6852523625a5fd4b78f7ff11f278931e6bb49c9d520d12e7b87a28afb22ea02009d98e3e