Analysis
-
max time kernel
142s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
12-04-2024 02:20
Static task
static1
Behavioral task
behavioral1
Sample
b7bcab6254e350d3e6726f221ef90abe3a909ba4cd0ad17cbfc11a0e651e5602.exe
Resource
win7-20240221-en
General
-
Target
b7bcab6254e350d3e6726f221ef90abe3a909ba4cd0ad17cbfc11a0e651e5602.exe
-
Size
2.6MB
-
MD5
0dbc59ff95744137f3f34763e8ee3d81
-
SHA1
0b8613d8c43536689da43690347729051ec23150
-
SHA256
b7bcab6254e350d3e6726f221ef90abe3a909ba4cd0ad17cbfc11a0e651e5602
-
SHA512
542f1dcebd9204c4b4158d1471e67a39d393bddec42d7b751d9cf01a40344b532be3f5f19615f22c6f6c2db3dd6f94c042e58d620c1296cf29ba6ca68cc9c793
-
SSDEEP
24576:SAHnh+eWsN3skA4RV1Hom2KXSmHdK3VqbE6przwKpwvEuM/SD0wugdDEl6NrL/NG:Vh+ZkldoPKiYdKr9U
Malware Config
Extracted
orcus
ligeon
ligeon.ddns.net:1606
b98fb09a59c24a81b9d17a55ccf2c036
-
autostart_method
Disable
-
enable_keylogger
true
-
install_path
%programfiles%\Orcus\Orcus.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
Orcus
-
watchdog_path
AppData\OrcusWatchdog.exe
Signatures
-
Orcurs Rat Executable 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1704-3-0x0000000000400000-0x00000000004EA000-memory.dmp orcus behavioral1/memory/1704-9-0x0000000000400000-0x00000000004EA000-memory.dmp orcus behavioral1/memory/1704-10-0x0000000000400000-0x00000000004EA000-memory.dmp orcus -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2572 cmd.exe -
Executes dropped EXE 2 IoCs
Processes:
setspn.exesetspn.exepid process 2908 setspn.exe 3012 setspn.exe -
AutoIT Executable 4 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral1/memory/1924-0-0x0000000001390000-0x000000000163A000-memory.dmp autoit_exe C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe autoit_exe behavioral1/memory/2908-25-0x0000000001190000-0x000000000143A000-memory.dmp autoit_exe behavioral1/memory/3012-38-0x0000000001190000-0x000000000143A000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
b7bcab6254e350d3e6726f221ef90abe3a909ba4cd0ad17cbfc11a0e651e5602.exesetspn.exesetspn.exedescription pid process target process PID 1924 set thread context of 1704 1924 b7bcab6254e350d3e6726f221ef90abe3a909ba4cd0ad17cbfc11a0e651e5602.exe RegSvcs.exe PID 2908 set thread context of 1868 2908 setspn.exe RegSvcs.exe PID 3012 set thread context of 560 3012 setspn.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 2692 schtasks.exe 2744 schtasks.exe 2804 schtasks.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
b7bcab6254e350d3e6726f221ef90abe3a909ba4cd0ad17cbfc11a0e651e5602.exesetspn.exesetspn.exepid process 1924 b7bcab6254e350d3e6726f221ef90abe3a909ba4cd0ad17cbfc11a0e651e5602.exe 1924 b7bcab6254e350d3e6726f221ef90abe3a909ba4cd0ad17cbfc11a0e651e5602.exe 2908 setspn.exe 2908 setspn.exe 3012 setspn.exe 3012 setspn.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 1704 RegSvcs.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
RegSvcs.exepid process 1704 RegSvcs.exe -
Suspicious use of WriteProcessMemory 55 IoCs
Processes:
b7bcab6254e350d3e6726f221ef90abe3a909ba4cd0ad17cbfc11a0e651e5602.execmd.exetaskeng.exesetspn.exesetspn.exedescription pid process target process PID 1924 wrote to memory of 1704 1924 b7bcab6254e350d3e6726f221ef90abe3a909ba4cd0ad17cbfc11a0e651e5602.exe RegSvcs.exe PID 1924 wrote to memory of 1704 1924 b7bcab6254e350d3e6726f221ef90abe3a909ba4cd0ad17cbfc11a0e651e5602.exe RegSvcs.exe PID 1924 wrote to memory of 1704 1924 b7bcab6254e350d3e6726f221ef90abe3a909ba4cd0ad17cbfc11a0e651e5602.exe RegSvcs.exe PID 1924 wrote to memory of 1704 1924 b7bcab6254e350d3e6726f221ef90abe3a909ba4cd0ad17cbfc11a0e651e5602.exe RegSvcs.exe PID 1924 wrote to memory of 1704 1924 b7bcab6254e350d3e6726f221ef90abe3a909ba4cd0ad17cbfc11a0e651e5602.exe RegSvcs.exe PID 1924 wrote to memory of 1704 1924 b7bcab6254e350d3e6726f221ef90abe3a909ba4cd0ad17cbfc11a0e651e5602.exe RegSvcs.exe PID 1924 wrote to memory of 1704 1924 b7bcab6254e350d3e6726f221ef90abe3a909ba4cd0ad17cbfc11a0e651e5602.exe RegSvcs.exe PID 1924 wrote to memory of 1704 1924 b7bcab6254e350d3e6726f221ef90abe3a909ba4cd0ad17cbfc11a0e651e5602.exe RegSvcs.exe PID 1924 wrote to memory of 1704 1924 b7bcab6254e350d3e6726f221ef90abe3a909ba4cd0ad17cbfc11a0e651e5602.exe RegSvcs.exe PID 1924 wrote to memory of 2692 1924 b7bcab6254e350d3e6726f221ef90abe3a909ba4cd0ad17cbfc11a0e651e5602.exe schtasks.exe PID 1924 wrote to memory of 2692 1924 b7bcab6254e350d3e6726f221ef90abe3a909ba4cd0ad17cbfc11a0e651e5602.exe schtasks.exe PID 1924 wrote to memory of 2692 1924 b7bcab6254e350d3e6726f221ef90abe3a909ba4cd0ad17cbfc11a0e651e5602.exe schtasks.exe PID 1924 wrote to memory of 2692 1924 b7bcab6254e350d3e6726f221ef90abe3a909ba4cd0ad17cbfc11a0e651e5602.exe schtasks.exe PID 1924 wrote to memory of 2572 1924 b7bcab6254e350d3e6726f221ef90abe3a909ba4cd0ad17cbfc11a0e651e5602.exe cmd.exe PID 1924 wrote to memory of 2572 1924 b7bcab6254e350d3e6726f221ef90abe3a909ba4cd0ad17cbfc11a0e651e5602.exe cmd.exe PID 1924 wrote to memory of 2572 1924 b7bcab6254e350d3e6726f221ef90abe3a909ba4cd0ad17cbfc11a0e651e5602.exe cmd.exe PID 1924 wrote to memory of 2572 1924 b7bcab6254e350d3e6726f221ef90abe3a909ba4cd0ad17cbfc11a0e651e5602.exe cmd.exe PID 2572 wrote to memory of 2636 2572 cmd.exe PING.EXE PID 2572 wrote to memory of 2636 2572 cmd.exe PING.EXE PID 2572 wrote to memory of 2636 2572 cmd.exe PING.EXE PID 2572 wrote to memory of 2636 2572 cmd.exe PING.EXE PID 2868 wrote to memory of 2908 2868 taskeng.exe setspn.exe PID 2868 wrote to memory of 2908 2868 taskeng.exe setspn.exe PID 2868 wrote to memory of 2908 2868 taskeng.exe setspn.exe PID 2868 wrote to memory of 2908 2868 taskeng.exe setspn.exe PID 2908 wrote to memory of 1868 2908 setspn.exe RegSvcs.exe PID 2908 wrote to memory of 1868 2908 setspn.exe RegSvcs.exe PID 2908 wrote to memory of 1868 2908 setspn.exe RegSvcs.exe PID 2908 wrote to memory of 1868 2908 setspn.exe RegSvcs.exe PID 2908 wrote to memory of 1868 2908 setspn.exe RegSvcs.exe PID 2908 wrote to memory of 1868 2908 setspn.exe RegSvcs.exe PID 2908 wrote to memory of 1868 2908 setspn.exe RegSvcs.exe PID 2908 wrote to memory of 1868 2908 setspn.exe RegSvcs.exe PID 2908 wrote to memory of 1868 2908 setspn.exe RegSvcs.exe PID 2908 wrote to memory of 2744 2908 setspn.exe schtasks.exe PID 2908 wrote to memory of 2744 2908 setspn.exe schtasks.exe PID 2908 wrote to memory of 2744 2908 setspn.exe schtasks.exe PID 2908 wrote to memory of 2744 2908 setspn.exe schtasks.exe PID 2868 wrote to memory of 3012 2868 taskeng.exe setspn.exe PID 2868 wrote to memory of 3012 2868 taskeng.exe setspn.exe PID 2868 wrote to memory of 3012 2868 taskeng.exe setspn.exe PID 2868 wrote to memory of 3012 2868 taskeng.exe setspn.exe PID 3012 wrote to memory of 560 3012 setspn.exe RegSvcs.exe PID 3012 wrote to memory of 560 3012 setspn.exe RegSvcs.exe PID 3012 wrote to memory of 560 3012 setspn.exe RegSvcs.exe PID 3012 wrote to memory of 560 3012 setspn.exe RegSvcs.exe PID 3012 wrote to memory of 560 3012 setspn.exe RegSvcs.exe PID 3012 wrote to memory of 560 3012 setspn.exe RegSvcs.exe PID 3012 wrote to memory of 560 3012 setspn.exe RegSvcs.exe PID 3012 wrote to memory of 560 3012 setspn.exe RegSvcs.exe PID 3012 wrote to memory of 560 3012 setspn.exe RegSvcs.exe PID 3012 wrote to memory of 2804 3012 setspn.exe schtasks.exe PID 3012 wrote to memory of 2804 3012 setspn.exe schtasks.exe PID 3012 wrote to memory of 2804 3012 setspn.exe schtasks.exe PID 3012 wrote to memory of 2804 3012 setspn.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b7bcab6254e350d3e6726f221ef90abe3a909ba4cd0ad17cbfc11a0e651e5602.exe"C:\Users\Admin\AppData\Local\Temp\b7bcab6254e350d3e6726f221ef90abe3a909ba4cd0ad17cbfc11a0e651e5602.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1704 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:2692 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /k ping 127.0.0.1 -t 0 & del C:\Users\Admin\AppData\Local\Temp\b7bcab6254e350d3e6726f221ef90abe3a909ba4cd0ad17cbfc11a0e651e5602.exe & exit2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -t 03⤵
- Runs ping.exe
PID:2636
-
C:\Windows\system32\taskeng.exetaskeng.exe {31579939-7B68-410E-8D52-D31AF114E430} S-1-5-21-2297530677-1229052932-2803917579-1000:HKULBIBU\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exeC:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵PID:1868
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F3⤵
- Creates scheduled task(s)
PID:2744 -
C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exeC:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵PID:560
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F3⤵
- Creates scheduled task(s)
PID:2804
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.6MB
MD58afceb4ebed2eb7746d2abdbb25c48a7
SHA1e4a038943074c85a7abc38f859c574aa491edaf4
SHA25686f12f0ab95f023757640b57d29ac34bbfe299c3f1e7d27278592e6c9568d68a
SHA512cef169aebe7e96ebbf84f40c90b8be0dcc15f5f2c91379bed5b81d556cd98a67f55716a3b2a8d22bb46376be67b357ef962f2dc00882cb9c99717efbfb810430