Analysis
-
max time kernel
141s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
20-04-2024 01:47
Static task
static1
Behavioral task
behavioral1
Sample
11021f0c7d10508554cdbf2434dff591c4e07236c7d3f3171731e5df9c529ace.exe
Resource
win7-20240220-en
General
-
Target
11021f0c7d10508554cdbf2434dff591c4e07236c7d3f3171731e5df9c529ace.exe
-
Size
2.6MB
-
MD5
de32ed98fa0ec33326038b38c937a01e
-
SHA1
b1ee8d7aac14bc492389bc1e06fab4b25a3a82c2
-
SHA256
11021f0c7d10508554cdbf2434dff591c4e07236c7d3f3171731e5df9c529ace
-
SHA512
9d4d6bbb394a9706524585720c1c4f09562665e64c3594047ea23c593711620179b331c2d9afe61a6f36ee32f6e88693442d776b6421c7a7d8fbbd8e8633ee49
-
SSDEEP
24576:QAHnh+eWsN3skA4RV1Hom2KXSmHdqf0K44JzixdvW80EXLq31gEfUvWDyBFZpxxz:Hh+ZkldoPKiYdqd6b
Malware Config
Extracted
orcus
ligeon
ligeon.ddns.net:1606
b98fb09a59c24a81b9d17a55ccf2c036
-
autostart_method
Disable
-
enable_keylogger
true
-
install_path
%programfiles%\Orcus\Orcus.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
Orcus
-
watchdog_path
AppData\OrcusWatchdog.exe
Signatures
-
Orcurs Rat Executable 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1656-3-0x0000000000400000-0x00000000004EA000-memory.dmp orcus behavioral1/memory/1656-9-0x0000000000400000-0x00000000004EA000-memory.dmp orcus behavioral1/memory/1656-10-0x0000000000400000-0x00000000004EA000-memory.dmp orcus -
Executes dropped EXE 2 IoCs
Processes:
setspn.exesetspn.exepid process 1948 setspn.exe 2064 setspn.exe -
AutoIT Executable 4 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral1/memory/2156-0-0x0000000000890000-0x0000000000B3A000-memory.dmp autoit_exe C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe autoit_exe behavioral1/memory/1948-25-0x0000000000130000-0x00000000003DA000-memory.dmp autoit_exe behavioral1/memory/2064-40-0x0000000000360000-0x000000000060A000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
11021f0c7d10508554cdbf2434dff591c4e07236c7d3f3171731e5df9c529ace.exesetspn.exesetspn.exedescription pid process target process PID 2156 set thread context of 1656 2156 11021f0c7d10508554cdbf2434dff591c4e07236c7d3f3171731e5df9c529ace.exe RegSvcs.exe PID 1948 set thread context of 2476 1948 setspn.exe RegSvcs.exe PID 2064 set thread context of 2076 2064 setspn.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 588 schtasks.exe 3036 schtasks.exe 1952 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
11021f0c7d10508554cdbf2434dff591c4e07236c7d3f3171731e5df9c529ace.exesetspn.exesetspn.exepid process 2156 11021f0c7d10508554cdbf2434dff591c4e07236c7d3f3171731e5df9c529ace.exe 2156 11021f0c7d10508554cdbf2434dff591c4e07236c7d3f3171731e5df9c529ace.exe 1948 setspn.exe 1948 setspn.exe 2064 setspn.exe 2064 setspn.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 1656 RegSvcs.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
RegSvcs.exepid process 1656 RegSvcs.exe -
Suspicious use of WriteProcessMemory 47 IoCs
Processes:
11021f0c7d10508554cdbf2434dff591c4e07236c7d3f3171731e5df9c529ace.exetaskeng.exesetspn.exesetspn.exedescription pid process target process PID 2156 wrote to memory of 1656 2156 11021f0c7d10508554cdbf2434dff591c4e07236c7d3f3171731e5df9c529ace.exe RegSvcs.exe PID 2156 wrote to memory of 1656 2156 11021f0c7d10508554cdbf2434dff591c4e07236c7d3f3171731e5df9c529ace.exe RegSvcs.exe PID 2156 wrote to memory of 1656 2156 11021f0c7d10508554cdbf2434dff591c4e07236c7d3f3171731e5df9c529ace.exe RegSvcs.exe PID 2156 wrote to memory of 1656 2156 11021f0c7d10508554cdbf2434dff591c4e07236c7d3f3171731e5df9c529ace.exe RegSvcs.exe PID 2156 wrote to memory of 1656 2156 11021f0c7d10508554cdbf2434dff591c4e07236c7d3f3171731e5df9c529ace.exe RegSvcs.exe PID 2156 wrote to memory of 1656 2156 11021f0c7d10508554cdbf2434dff591c4e07236c7d3f3171731e5df9c529ace.exe RegSvcs.exe PID 2156 wrote to memory of 1656 2156 11021f0c7d10508554cdbf2434dff591c4e07236c7d3f3171731e5df9c529ace.exe RegSvcs.exe PID 2156 wrote to memory of 1656 2156 11021f0c7d10508554cdbf2434dff591c4e07236c7d3f3171731e5df9c529ace.exe RegSvcs.exe PID 2156 wrote to memory of 1656 2156 11021f0c7d10508554cdbf2434dff591c4e07236c7d3f3171731e5df9c529ace.exe RegSvcs.exe PID 2156 wrote to memory of 3036 2156 11021f0c7d10508554cdbf2434dff591c4e07236c7d3f3171731e5df9c529ace.exe schtasks.exe PID 2156 wrote to memory of 3036 2156 11021f0c7d10508554cdbf2434dff591c4e07236c7d3f3171731e5df9c529ace.exe schtasks.exe PID 2156 wrote to memory of 3036 2156 11021f0c7d10508554cdbf2434dff591c4e07236c7d3f3171731e5df9c529ace.exe schtasks.exe PID 2156 wrote to memory of 3036 2156 11021f0c7d10508554cdbf2434dff591c4e07236c7d3f3171731e5df9c529ace.exe schtasks.exe PID 2104 wrote to memory of 1948 2104 taskeng.exe setspn.exe PID 2104 wrote to memory of 1948 2104 taskeng.exe setspn.exe PID 2104 wrote to memory of 1948 2104 taskeng.exe setspn.exe PID 2104 wrote to memory of 1948 2104 taskeng.exe setspn.exe PID 1948 wrote to memory of 2476 1948 setspn.exe RegSvcs.exe PID 1948 wrote to memory of 2476 1948 setspn.exe RegSvcs.exe PID 1948 wrote to memory of 2476 1948 setspn.exe RegSvcs.exe PID 1948 wrote to memory of 2476 1948 setspn.exe RegSvcs.exe PID 1948 wrote to memory of 2476 1948 setspn.exe RegSvcs.exe PID 1948 wrote to memory of 2476 1948 setspn.exe RegSvcs.exe PID 1948 wrote to memory of 2476 1948 setspn.exe RegSvcs.exe PID 1948 wrote to memory of 2476 1948 setspn.exe RegSvcs.exe PID 1948 wrote to memory of 2476 1948 setspn.exe RegSvcs.exe PID 1948 wrote to memory of 1952 1948 setspn.exe schtasks.exe PID 1948 wrote to memory of 1952 1948 setspn.exe schtasks.exe PID 1948 wrote to memory of 1952 1948 setspn.exe schtasks.exe PID 1948 wrote to memory of 1952 1948 setspn.exe schtasks.exe PID 2104 wrote to memory of 2064 2104 taskeng.exe setspn.exe PID 2104 wrote to memory of 2064 2104 taskeng.exe setspn.exe PID 2104 wrote to memory of 2064 2104 taskeng.exe setspn.exe PID 2104 wrote to memory of 2064 2104 taskeng.exe setspn.exe PID 2064 wrote to memory of 2076 2064 setspn.exe RegSvcs.exe PID 2064 wrote to memory of 2076 2064 setspn.exe RegSvcs.exe PID 2064 wrote to memory of 2076 2064 setspn.exe RegSvcs.exe PID 2064 wrote to memory of 2076 2064 setspn.exe RegSvcs.exe PID 2064 wrote to memory of 2076 2064 setspn.exe RegSvcs.exe PID 2064 wrote to memory of 2076 2064 setspn.exe RegSvcs.exe PID 2064 wrote to memory of 2076 2064 setspn.exe RegSvcs.exe PID 2064 wrote to memory of 2076 2064 setspn.exe RegSvcs.exe PID 2064 wrote to memory of 2076 2064 setspn.exe RegSvcs.exe PID 2064 wrote to memory of 588 2064 setspn.exe schtasks.exe PID 2064 wrote to memory of 588 2064 setspn.exe schtasks.exe PID 2064 wrote to memory of 588 2064 setspn.exe schtasks.exe PID 2064 wrote to memory of 588 2064 setspn.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\11021f0c7d10508554cdbf2434dff591c4e07236c7d3f3171731e5df9c529ace.exe"C:\Users\Admin\AppData\Local\Temp\11021f0c7d10508554cdbf2434dff591c4e07236c7d3f3171731e5df9c529ace.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
-
C:\Windows\system32\taskeng.exetaskeng.exe {95425B78-01E2-46EA-88C5-53B69FD23985} S-1-5-21-2721934792-624042501-2768869379-1000:BISMIZHX\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exeC:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exeC:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F3⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exeFilesize
2.6MB
MD5e65a398dc051d1d0194a71c790ac8c03
SHA1d63a9d45e03427928e00adc720e9a002b05c0c0f
SHA256e1d55b49556c56aa8495e56c85bbc9bf5c9b0eabcd7ec33554f1f0c70bd9e4dd
SHA512eda584cc66e7327a4937018f4e0299725b82521bfd5847b4161f38ae1c2bbe5403944a77b42ea74ebd7cdb67fbac26ef0b751ab0851c112f3c0e9500a03fb16e
-
memory/1656-17-0x0000000000520000-0x0000000000532000-memory.dmpFilesize
72KB
-
memory/1656-3-0x0000000000400000-0x00000000004EA000-memory.dmpFilesize
936KB
-
memory/1656-20-0x0000000000A90000-0x0000000000AA0000-memory.dmpFilesize
64KB
-
memory/1656-21-0x0000000073E50000-0x000000007453E000-memory.dmpFilesize
6.9MB
-
memory/1656-9-0x0000000000400000-0x00000000004EA000-memory.dmpFilesize
936KB
-
memory/1656-10-0x0000000000400000-0x00000000004EA000-memory.dmpFilesize
936KB
-
memory/1656-13-0x0000000073E50000-0x000000007453E000-memory.dmpFilesize
6.9MB
-
memory/1656-14-0x0000000004B00000-0x0000000004B40000-memory.dmpFilesize
256KB
-
memory/1656-15-0x0000000000350000-0x000000000035E000-memory.dmpFilesize
56KB
-
memory/1656-16-0x00000000003A0000-0x00000000003FC000-memory.dmpFilesize
368KB
-
memory/1656-18-0x0000000000540000-0x0000000000548000-memory.dmpFilesize
32KB
-
memory/1656-19-0x0000000000590000-0x00000000005A8000-memory.dmpFilesize
96KB
-
memory/1656-22-0x0000000004B00000-0x0000000004B40000-memory.dmpFilesize
256KB
-
memory/1656-2-0x0000000000400000-0x00000000004EA000-memory.dmpFilesize
936KB
-
memory/1656-7-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1948-25-0x0000000000130000-0x00000000003DA000-memory.dmpFilesize
2.7MB
-
memory/2064-40-0x0000000000360000-0x000000000060A000-memory.dmpFilesize
2.7MB
-
memory/2076-53-0x0000000073E50000-0x000000007453E000-memory.dmpFilesize
6.9MB
-
memory/2076-52-0x0000000004A00000-0x0000000004A40000-memory.dmpFilesize
256KB
-
memory/2076-51-0x0000000073E50000-0x000000007453E000-memory.dmpFilesize
6.9MB
-
memory/2156-1-0x0000000000840000-0x0000000000841000-memory.dmpFilesize
4KB
-
memory/2156-0-0x0000000000890000-0x0000000000B3A000-memory.dmpFilesize
2.7MB
-
memory/2476-32-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2476-36-0x0000000073E50000-0x000000007453E000-memory.dmpFilesize
6.9MB
-
memory/2476-37-0x0000000004AB0000-0x0000000004AF0000-memory.dmpFilesize
256KB
-
memory/2476-38-0x0000000073E50000-0x000000007453E000-memory.dmpFilesize
6.9MB