General

  • Target

    qwe.exe

  • Size

    918KB

  • Sample

    240414-t1dvyach2t

  • MD5

    b70c58bfc13fa70d4e2e996105829ebc

  • SHA1

    78fa32d0ae2cdfd48096b75a843b14cf289a519f

  • SHA256

    f32b0ef6f9db9cb8e271eb9e60c356ecbd8bbfe98de9f864c700cb8076eeb92b

  • SHA512

    d18ed7f5306dffd8408b875e1e478ec21deaa45282b49430e984f7008a4dcf20d8983d935bf3307fd394d3407d91bd7b31d6be26264d2825e843689ffb188c0b

  • SSDEEP

    12288:90XCGPSX0zbyD+ndg+QCImGYUl9qyzlkE2kUNCg+34ai5V2Xopqi1n07dG1lFlWD:l2C4MROxnF9lrrcI0AilFEvxHj+Qu

Malware Config

Extracted

Family

orcus

C2

s7vety-47274.portmap.host:47274

Mutex

dd6ac135bc344ba3be035bc19a9835dc

Attributes
  • autostart_method

    Registry

  • enable_keylogger

    false

  • install_path

    %temp%\Windows Updater\updateclient.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\OrcusWatchdog.exe

Targets

    • Target

      qwe.exe

    • Size

      918KB

    • MD5

      b70c58bfc13fa70d4e2e996105829ebc

    • SHA1

      78fa32d0ae2cdfd48096b75a843b14cf289a519f

    • SHA256

      f32b0ef6f9db9cb8e271eb9e60c356ecbd8bbfe98de9f864c700cb8076eeb92b

    • SHA512

      d18ed7f5306dffd8408b875e1e478ec21deaa45282b49430e984f7008a4dcf20d8983d935bf3307fd394d3407d91bd7b31d6be26264d2825e843689ffb188c0b

    • SSDEEP

      12288:90XCGPSX0zbyD+ndg+QCImGYUl9qyzlkE2kUNCg+34ai5V2Xopqi1n07dG1lFlWD:l2C4MROxnF9lrrcI0AilFEvxHj+Qu

    • Orcus

      Orcus is a Remote Access Trojan that is being sold on underground forums.

    • Orcus main payload

    • Orcurs Rat Executable

    • Disables Task Manager via registry modification

    • Drops file in Drivers directory

    • Modifies Windows Firewall

    • Sets DLL path for service in the registry

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads WinSCP keys stored on the system

      Tries to access WinSCP stored sessions.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Registers COM server for autorun

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Modifies WinLogon

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks