Analysis
-
max time kernel
149s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
12-04-2024 02:19
Static task
static1
Behavioral task
behavioral1
Sample
2ba7fcf7f06472ae111f33f4667b928fd1ed4d99f094256e46abe0d6b020e757.exe
Resource
win7-20240221-en
General
-
Target
2ba7fcf7f06472ae111f33f4667b928fd1ed4d99f094256e46abe0d6b020e757.exe
-
Size
2.6MB
-
MD5
3e2ad8d0c4fd454427d92c3bb36be39a
-
SHA1
92f7d5f9c642c497ef94ffc3152ca60da1a4b394
-
SHA256
2ba7fcf7f06472ae111f33f4667b928fd1ed4d99f094256e46abe0d6b020e757
-
SHA512
dd28e91dfcebea1f3426dee4ef3d9264bca3bf45725567abf144a97bfbe4b22fa46b27a8274d4ec4d23c8c48952c260ab2cd23892e0dd08b6bc62de31007a1bb
-
SSDEEP
24576:SAHnh+eWsN3skA4RV1Hom2KXSmHdK3VqbE6przwKpwvEuM/SD0wugdDEl6NrL/Nv:Vh+ZkldoPKiYdKr9Z
Malware Config
Extracted
orcus
ligeon
ligeon.ddns.net:1606
b98fb09a59c24a81b9d17a55ccf2c036
-
autostart_method
Disable
-
enable_keylogger
true
-
install_path
%programfiles%\Orcus\Orcus.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
Orcus
-
watchdog_path
AppData\OrcusWatchdog.exe
Signatures
-
Orcurs Rat Executable 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1924-3-0x0000000000400000-0x00000000004EA000-memory.dmp orcus behavioral1/memory/1924-9-0x0000000000400000-0x00000000004EA000-memory.dmp orcus behavioral1/memory/1924-10-0x0000000000400000-0x00000000004EA000-memory.dmp orcus behavioral1/memory/2892-27-0x0000000000170000-0x000000000025A000-memory.dmp orcus behavioral1/memory/2892-33-0x0000000000170000-0x000000000025A000-memory.dmp orcus behavioral1/memory/2892-34-0x0000000000170000-0x000000000025A000-memory.dmp orcus -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1276 cmd.exe -
Executes dropped EXE 3 IoCs
Processes:
setspn.exesetspn.exesetspn.exepid process 2452 setspn.exe 2928 setspn.exe 1608 setspn.exe -
AutoIT Executable 5 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral1/memory/2872-0-0x00000000008A0000-0x0000000000B4A000-memory.dmp autoit_exe C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe autoit_exe behavioral1/memory/2452-23-0x0000000000C70000-0x0000000000F1A000-memory.dmp autoit_exe behavioral1/memory/2928-39-0x0000000000FE0000-0x000000000128A000-memory.dmp autoit_exe behavioral1/memory/1608-53-0x0000000000FE0000-0x000000000128A000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
2ba7fcf7f06472ae111f33f4667b928fd1ed4d99f094256e46abe0d6b020e757.exesetspn.exesetspn.exesetspn.exedescription pid process target process PID 2872 set thread context of 1924 2872 2ba7fcf7f06472ae111f33f4667b928fd1ed4d99f094256e46abe0d6b020e757.exe RegSvcs.exe PID 2452 set thread context of 2892 2452 setspn.exe RegSvcs.exe PID 2928 set thread context of 2904 2928 setspn.exe RegSvcs.exe PID 1608 set thread context of 1656 1608 setspn.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 1192 schtasks.exe 2104 schtasks.exe 2128 schtasks.exe 2120 schtasks.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
2ba7fcf7f06472ae111f33f4667b928fd1ed4d99f094256e46abe0d6b020e757.exesetspn.exesetspn.exesetspn.exepid process 2872 2ba7fcf7f06472ae111f33f4667b928fd1ed4d99f094256e46abe0d6b020e757.exe 2872 2ba7fcf7f06472ae111f33f4667b928fd1ed4d99f094256e46abe0d6b020e757.exe 2452 setspn.exe 2452 setspn.exe 2928 setspn.exe 2928 setspn.exe 1608 setspn.exe 1608 setspn.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 1924 RegSvcs.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
RegSvcs.exepid process 1924 RegSvcs.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2ba7fcf7f06472ae111f33f4667b928fd1ed4d99f094256e46abe0d6b020e757.execmd.exetaskeng.exesetspn.exesetspn.exesetspn.exedescription pid process target process PID 2872 wrote to memory of 1924 2872 2ba7fcf7f06472ae111f33f4667b928fd1ed4d99f094256e46abe0d6b020e757.exe RegSvcs.exe PID 2872 wrote to memory of 1924 2872 2ba7fcf7f06472ae111f33f4667b928fd1ed4d99f094256e46abe0d6b020e757.exe RegSvcs.exe PID 2872 wrote to memory of 1924 2872 2ba7fcf7f06472ae111f33f4667b928fd1ed4d99f094256e46abe0d6b020e757.exe RegSvcs.exe PID 2872 wrote to memory of 1924 2872 2ba7fcf7f06472ae111f33f4667b928fd1ed4d99f094256e46abe0d6b020e757.exe RegSvcs.exe PID 2872 wrote to memory of 1924 2872 2ba7fcf7f06472ae111f33f4667b928fd1ed4d99f094256e46abe0d6b020e757.exe RegSvcs.exe PID 2872 wrote to memory of 1924 2872 2ba7fcf7f06472ae111f33f4667b928fd1ed4d99f094256e46abe0d6b020e757.exe RegSvcs.exe PID 2872 wrote to memory of 1924 2872 2ba7fcf7f06472ae111f33f4667b928fd1ed4d99f094256e46abe0d6b020e757.exe RegSvcs.exe PID 2872 wrote to memory of 1924 2872 2ba7fcf7f06472ae111f33f4667b928fd1ed4d99f094256e46abe0d6b020e757.exe RegSvcs.exe PID 2872 wrote to memory of 1924 2872 2ba7fcf7f06472ae111f33f4667b928fd1ed4d99f094256e46abe0d6b020e757.exe RegSvcs.exe PID 2872 wrote to memory of 2120 2872 2ba7fcf7f06472ae111f33f4667b928fd1ed4d99f094256e46abe0d6b020e757.exe schtasks.exe PID 2872 wrote to memory of 2120 2872 2ba7fcf7f06472ae111f33f4667b928fd1ed4d99f094256e46abe0d6b020e757.exe schtasks.exe PID 2872 wrote to memory of 2120 2872 2ba7fcf7f06472ae111f33f4667b928fd1ed4d99f094256e46abe0d6b020e757.exe schtasks.exe PID 2872 wrote to memory of 2120 2872 2ba7fcf7f06472ae111f33f4667b928fd1ed4d99f094256e46abe0d6b020e757.exe schtasks.exe PID 2872 wrote to memory of 1276 2872 2ba7fcf7f06472ae111f33f4667b928fd1ed4d99f094256e46abe0d6b020e757.exe cmd.exe PID 2872 wrote to memory of 1276 2872 2ba7fcf7f06472ae111f33f4667b928fd1ed4d99f094256e46abe0d6b020e757.exe cmd.exe PID 2872 wrote to memory of 1276 2872 2ba7fcf7f06472ae111f33f4667b928fd1ed4d99f094256e46abe0d6b020e757.exe cmd.exe PID 2872 wrote to memory of 1276 2872 2ba7fcf7f06472ae111f33f4667b928fd1ed4d99f094256e46abe0d6b020e757.exe cmd.exe PID 1276 wrote to memory of 1728 1276 cmd.exe PING.EXE PID 1276 wrote to memory of 1728 1276 cmd.exe PING.EXE PID 1276 wrote to memory of 1728 1276 cmd.exe PING.EXE PID 1276 wrote to memory of 1728 1276 cmd.exe PING.EXE PID 2648 wrote to memory of 2452 2648 taskeng.exe setspn.exe PID 2648 wrote to memory of 2452 2648 taskeng.exe setspn.exe PID 2648 wrote to memory of 2452 2648 taskeng.exe setspn.exe PID 2648 wrote to memory of 2452 2648 taskeng.exe setspn.exe PID 2452 wrote to memory of 2892 2452 setspn.exe RegSvcs.exe PID 2452 wrote to memory of 2892 2452 setspn.exe RegSvcs.exe PID 2452 wrote to memory of 2892 2452 setspn.exe RegSvcs.exe PID 2452 wrote to memory of 2892 2452 setspn.exe RegSvcs.exe PID 2452 wrote to memory of 2892 2452 setspn.exe RegSvcs.exe PID 2452 wrote to memory of 2892 2452 setspn.exe RegSvcs.exe PID 2452 wrote to memory of 2892 2452 setspn.exe RegSvcs.exe PID 2452 wrote to memory of 2892 2452 setspn.exe RegSvcs.exe PID 2452 wrote to memory of 2892 2452 setspn.exe RegSvcs.exe PID 2452 wrote to memory of 1192 2452 setspn.exe schtasks.exe PID 2452 wrote to memory of 1192 2452 setspn.exe schtasks.exe PID 2452 wrote to memory of 1192 2452 setspn.exe schtasks.exe PID 2452 wrote to memory of 1192 2452 setspn.exe schtasks.exe PID 2648 wrote to memory of 2928 2648 taskeng.exe setspn.exe PID 2648 wrote to memory of 2928 2648 taskeng.exe setspn.exe PID 2648 wrote to memory of 2928 2648 taskeng.exe setspn.exe PID 2648 wrote to memory of 2928 2648 taskeng.exe setspn.exe PID 2928 wrote to memory of 2904 2928 setspn.exe RegSvcs.exe PID 2928 wrote to memory of 2904 2928 setspn.exe RegSvcs.exe PID 2928 wrote to memory of 2904 2928 setspn.exe RegSvcs.exe PID 2928 wrote to memory of 2904 2928 setspn.exe RegSvcs.exe PID 2928 wrote to memory of 2904 2928 setspn.exe RegSvcs.exe PID 2928 wrote to memory of 2904 2928 setspn.exe RegSvcs.exe PID 2928 wrote to memory of 2904 2928 setspn.exe RegSvcs.exe PID 2928 wrote to memory of 2904 2928 setspn.exe RegSvcs.exe PID 2928 wrote to memory of 2904 2928 setspn.exe RegSvcs.exe PID 2928 wrote to memory of 2104 2928 setspn.exe schtasks.exe PID 2928 wrote to memory of 2104 2928 setspn.exe schtasks.exe PID 2928 wrote to memory of 2104 2928 setspn.exe schtasks.exe PID 2928 wrote to memory of 2104 2928 setspn.exe schtasks.exe PID 2648 wrote to memory of 1608 2648 taskeng.exe setspn.exe PID 2648 wrote to memory of 1608 2648 taskeng.exe setspn.exe PID 2648 wrote to memory of 1608 2648 taskeng.exe setspn.exe PID 2648 wrote to memory of 1608 2648 taskeng.exe setspn.exe PID 1608 wrote to memory of 1656 1608 setspn.exe RegSvcs.exe PID 1608 wrote to memory of 1656 1608 setspn.exe RegSvcs.exe PID 1608 wrote to memory of 1656 1608 setspn.exe RegSvcs.exe PID 1608 wrote to memory of 1656 1608 setspn.exe RegSvcs.exe PID 1608 wrote to memory of 1656 1608 setspn.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2ba7fcf7f06472ae111f33f4667b928fd1ed4d99f094256e46abe0d6b020e757.exe"C:\Users\Admin\AppData\Local\Temp\2ba7fcf7f06472ae111f33f4667b928fd1ed4d99f094256e46abe0d6b020e757.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1924 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:2120 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /k ping 127.0.0.1 -t 0 & del C:\Users\Admin\AppData\Local\Temp\2ba7fcf7f06472ae111f33f4667b928fd1ed4d99f094256e46abe0d6b020e757.exe & exit2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -t 03⤵
- Runs ping.exe
PID:1728
-
C:\Windows\system32\taskeng.exetaskeng.exe {2761A1ED-5BBE-4EA8-855D-5B70A6EDB7A9} S-1-5-21-3452737119-3959686427-228443150-1000:QGTQZTRE\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exeC:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵PID:2892
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F3⤵
- Creates scheduled task(s)
PID:1192 -
C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exeC:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵PID:2904
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F3⤵
- Creates scheduled task(s)
PID:2104 -
C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exeC:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵PID:1656
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F3⤵
- Creates scheduled task(s)
PID:2128
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.6MB
MD584e24bd853a58a58247838285cd14741
SHA14b812362aad69c69cc68277f1638cc1c8513c290
SHA25644601b91195008715eb8a9fbad4d9e67894a1f407319c1210b0e344bb1877e40
SHA512c39a11e698825d389e46bcc6f8e212d54451553f213fb300354728b09bd0f71088886e4ede3e1450da1d71e3b4fdfaee616c363c7ce500538fd8a808aad67052