Analysis
-
max time kernel
157s -
max time network
166s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
20-04-2024 01:17
Static task
static1
Behavioral task
behavioral1
Sample
96a7e0367daf2aeebe129b0b2fa7857df8bb21634058f6bd78b51f7685e6c842.exe
Resource
win7-20240220-en
General
-
Target
96a7e0367daf2aeebe129b0b2fa7857df8bb21634058f6bd78b51f7685e6c842.exe
-
Size
2.6MB
-
MD5
f039ecda64d8a6b6d622a58c83823d2e
-
SHA1
6dd79daaa002e4ded84a5adb8b99242069bb36eb
-
SHA256
96a7e0367daf2aeebe129b0b2fa7857df8bb21634058f6bd78b51f7685e6c842
-
SHA512
ab49ba650003fea6ca708fd074272b82edcdc5b4f3973732ed8588dd329742546d8b5950b628c1b8181afcc2a46120ebb582fefec8382ab46e3bf4d79ae2eb52
-
SSDEEP
24576:QAHnh+eWsN3skA4RV1Hom2KXSmHdqf0K44JzixdvW80EXLq31gEfUvWDyBFZpxxa:Hh+ZkldoPKiYdqd6y
Malware Config
Extracted
orcus
ligeon
ligeon.ddns.net:1606
b98fb09a59c24a81b9d17a55ccf2c036
-
autostart_method
Disable
-
enable_keylogger
true
-
install_path
%programfiles%\Orcus\Orcus.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
Orcus
-
watchdog_path
AppData\OrcusWatchdog.exe
Signatures
-
Orcurs Rat Executable 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1028-2-0x0000000000400000-0x00000000004EA000-memory.dmp orcus -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
96a7e0367daf2aeebe129b0b2fa7857df8bb21634058f6bd78b51f7685e6c842.exesetspn.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation 96a7e0367daf2aeebe129b0b2fa7857df8bb21634058f6bd78b51f7685e6c842.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation setspn.exe -
Executes dropped EXE 2 IoCs
Processes:
setspn.exesetspn.exepid process 4344 setspn.exe 2156 setspn.exe -
AutoIT Executable 4 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral2/memory/2992-0-0x00000000006A0000-0x000000000094A000-memory.dmp autoit_exe C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe autoit_exe behavioral2/memory/4344-24-0x0000000000370000-0x000000000061A000-memory.dmp autoit_exe behavioral2/memory/2156-36-0x0000000000370000-0x000000000061A000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
96a7e0367daf2aeebe129b0b2fa7857df8bb21634058f6bd78b51f7685e6c842.exesetspn.exedescription pid process target process PID 2992 set thread context of 1028 2992 96a7e0367daf2aeebe129b0b2fa7857df8bb21634058f6bd78b51f7685e6c842.exe RegSvcs.exe PID 4344 set thread context of 4940 4344 setspn.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 432 schtasks.exe 2448 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
96a7e0367daf2aeebe129b0b2fa7857df8bb21634058f6bd78b51f7685e6c842.exesetspn.exesetspn.exepid process 2992 96a7e0367daf2aeebe129b0b2fa7857df8bb21634058f6bd78b51f7685e6c842.exe 2992 96a7e0367daf2aeebe129b0b2fa7857df8bb21634058f6bd78b51f7685e6c842.exe 2992 96a7e0367daf2aeebe129b0b2fa7857df8bb21634058f6bd78b51f7685e6c842.exe 2992 96a7e0367daf2aeebe129b0b2fa7857df8bb21634058f6bd78b51f7685e6c842.exe 4344 setspn.exe 4344 setspn.exe 4344 setspn.exe 4344 setspn.exe 2156 setspn.exe 2156 setspn.exe 2156 setspn.exe 2156 setspn.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 1028 RegSvcs.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
RegSvcs.exepid process 1028 RegSvcs.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
96a7e0367daf2aeebe129b0b2fa7857df8bb21634058f6bd78b51f7685e6c842.exesetspn.exedescription pid process target process PID 2992 wrote to memory of 1028 2992 96a7e0367daf2aeebe129b0b2fa7857df8bb21634058f6bd78b51f7685e6c842.exe RegSvcs.exe PID 2992 wrote to memory of 1028 2992 96a7e0367daf2aeebe129b0b2fa7857df8bb21634058f6bd78b51f7685e6c842.exe RegSvcs.exe PID 2992 wrote to memory of 1028 2992 96a7e0367daf2aeebe129b0b2fa7857df8bb21634058f6bd78b51f7685e6c842.exe RegSvcs.exe PID 2992 wrote to memory of 1028 2992 96a7e0367daf2aeebe129b0b2fa7857df8bb21634058f6bd78b51f7685e6c842.exe RegSvcs.exe PID 2992 wrote to memory of 1028 2992 96a7e0367daf2aeebe129b0b2fa7857df8bb21634058f6bd78b51f7685e6c842.exe RegSvcs.exe PID 2992 wrote to memory of 432 2992 96a7e0367daf2aeebe129b0b2fa7857df8bb21634058f6bd78b51f7685e6c842.exe schtasks.exe PID 2992 wrote to memory of 432 2992 96a7e0367daf2aeebe129b0b2fa7857df8bb21634058f6bd78b51f7685e6c842.exe schtasks.exe PID 2992 wrote to memory of 432 2992 96a7e0367daf2aeebe129b0b2fa7857df8bb21634058f6bd78b51f7685e6c842.exe schtasks.exe PID 4344 wrote to memory of 4940 4344 setspn.exe RegSvcs.exe PID 4344 wrote to memory of 4940 4344 setspn.exe RegSvcs.exe PID 4344 wrote to memory of 4940 4344 setspn.exe RegSvcs.exe PID 4344 wrote to memory of 4940 4344 setspn.exe RegSvcs.exe PID 4344 wrote to memory of 4940 4344 setspn.exe RegSvcs.exe PID 4344 wrote to memory of 2448 4344 setspn.exe schtasks.exe PID 4344 wrote to memory of 2448 4344 setspn.exe schtasks.exe PID 4344 wrote to memory of 2448 4344 setspn.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\96a7e0367daf2aeebe129b0b2fa7857df8bb21634058f6bd78b51f7685e6c842.exe"C:\Users\Admin\AppData\Local\Temp\96a7e0367daf2aeebe129b0b2fa7857df8bb21634058f6bd78b51f7685e6c842.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4004 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:81⤵
-
C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exeC:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exeC:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exeFilesize
2.6MB
MD5d236a0015f86405e2c67f88eb502bc16
SHA12bfa80c3ddc5fd0e2d27e42fba0fcf72a4631abd
SHA2561374e56e40c6b30cf26a7a1eb1c2fb16943daf1d8ba13ee66d254afa1daffb19
SHA5122425b0ccd34dec49179a46865a07c54edfa2ba5f8391e7c33bc6d505204e45f2afd1d4f17e2c6842ac138fa523be4c8d4851a1f9029b592700fa22ecbbb0cbc7
-
memory/1028-16-0x00000000059B0000-0x00000000059C0000-memory.dmpFilesize
64KB
-
memory/1028-7-0x0000000073940000-0x00000000740F0000-memory.dmpFilesize
7.7MB
-
memory/1028-18-0x0000000005B00000-0x0000000005B08000-memory.dmpFilesize
32KB
-
memory/1028-10-0x00000000059B0000-0x00000000059C0000-memory.dmpFilesize
64KB
-
memory/1028-11-0x0000000003390000-0x000000000339E000-memory.dmpFilesize
56KB
-
memory/1028-12-0x00000000059C0000-0x0000000005A1C000-memory.dmpFilesize
368KB
-
memory/1028-13-0x0000000005FE0000-0x0000000006584000-memory.dmpFilesize
5.6MB
-
memory/1028-14-0x0000000005B10000-0x0000000005BA2000-memory.dmpFilesize
584KB
-
memory/1028-19-0x0000000005F40000-0x0000000005F58000-memory.dmpFilesize
96KB
-
memory/1028-17-0x0000000005AF0000-0x0000000005B02000-memory.dmpFilesize
72KB
-
memory/1028-22-0x0000000006950000-0x000000000695A000-memory.dmpFilesize
40KB
-
memory/1028-2-0x0000000000400000-0x00000000004EA000-memory.dmpFilesize
936KB
-
memory/1028-15-0x0000000073940000-0x00000000740F0000-memory.dmpFilesize
7.7MB
-
memory/1028-20-0x0000000006960000-0x0000000006B22000-memory.dmpFilesize
1.8MB
-
memory/1028-21-0x0000000006790000-0x00000000067A0000-memory.dmpFilesize
64KB
-
memory/2156-36-0x0000000000370000-0x000000000061A000-memory.dmpFilesize
2.7MB
-
memory/2992-1-0x0000000003AA0000-0x0000000003AA1000-memory.dmpFilesize
4KB
-
memory/2992-0-0x00000000006A0000-0x000000000094A000-memory.dmpFilesize
2.7MB
-
memory/4344-24-0x0000000000370000-0x000000000061A000-memory.dmpFilesize
2.7MB
-
memory/4940-31-0x0000000073940000-0x00000000740F0000-memory.dmpFilesize
7.7MB
-
memory/4940-32-0x00000000053B0000-0x00000000053C0000-memory.dmpFilesize
64KB
-
memory/4940-34-0x0000000073940000-0x00000000740F0000-memory.dmpFilesize
7.7MB