Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
20-04-2024 01:21
Static task
static1
Behavioral task
behavioral1
Sample
464f44f3c9deda36ae9a4ec9043403f0546e3902c12abde791729d6a5c5a01dc.exe
Resource
win7-20231129-en
General
-
Target
464f44f3c9deda36ae9a4ec9043403f0546e3902c12abde791729d6a5c5a01dc.exe
-
Size
2.6MB
-
MD5
9244dfbd957a522232e9f93b7c0c6859
-
SHA1
bb68c6b213bef977e090208ea8b83078d600d4a5
-
SHA256
464f44f3c9deda36ae9a4ec9043403f0546e3902c12abde791729d6a5c5a01dc
-
SHA512
384c2dc44509b3f559bab05b8e8d6259bab83600da71c246b5d330903773f9412def98b963db0643cc3029ecb7cefc6fa7a1996b504bfc1f0190d934638d2db6
-
SSDEEP
24576:QAHnh+eWsN3skA4RV1Hom2KXSmHdqf0K44JzixdvW80EXLq31gEfUvWDyBFZpxx3:Hh+ZkldoPKiYdqd6/
Malware Config
Extracted
orcus
ligeon
ligeon.ddns.net:1606
b98fb09a59c24a81b9d17a55ccf2c036
-
autostart_method
Disable
-
enable_keylogger
true
-
install_path
%programfiles%\Orcus\Orcus.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
Orcus
-
watchdog_path
AppData\OrcusWatchdog.exe
Signatures
-
Orcurs Rat Executable 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1804-2-0x0000000000400000-0x00000000004EA000-memory.dmp orcus behavioral2/memory/5024-37-0x0000000000500000-0x00000000005EA000-memory.dmp orcus -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
setspn.exe464f44f3c9deda36ae9a4ec9043403f0546e3902c12abde791729d6a5c5a01dc.exesetspn.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation setspn.exe Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation 464f44f3c9deda36ae9a4ec9043403f0546e3902c12abde791729d6a5c5a01dc.exe Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation setspn.exe -
Executes dropped EXE 2 IoCs
Processes:
setspn.exesetspn.exepid process 3548 setspn.exe 4104 setspn.exe -
AutoIT Executable 4 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral2/memory/2108-0-0x0000000000DF0000-0x000000000109A000-memory.dmp autoit_exe C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe autoit_exe behavioral2/memory/3548-24-0x0000000000990000-0x0000000000C3A000-memory.dmp autoit_exe behavioral2/memory/4104-36-0x0000000000990000-0x0000000000C3A000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
464f44f3c9deda36ae9a4ec9043403f0546e3902c12abde791729d6a5c5a01dc.exesetspn.exesetspn.exedescription pid process target process PID 2108 set thread context of 1804 2108 464f44f3c9deda36ae9a4ec9043403f0546e3902c12abde791729d6a5c5a01dc.exe RegSvcs.exe PID 3548 set thread context of 2604 3548 setspn.exe RegSvcs.exe PID 4104 set thread context of 5024 4104 setspn.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 3908 schtasks.exe 436 schtasks.exe 512 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
464f44f3c9deda36ae9a4ec9043403f0546e3902c12abde791729d6a5c5a01dc.exesetspn.exesetspn.exepid process 2108 464f44f3c9deda36ae9a4ec9043403f0546e3902c12abde791729d6a5c5a01dc.exe 2108 464f44f3c9deda36ae9a4ec9043403f0546e3902c12abde791729d6a5c5a01dc.exe 2108 464f44f3c9deda36ae9a4ec9043403f0546e3902c12abde791729d6a5c5a01dc.exe 2108 464f44f3c9deda36ae9a4ec9043403f0546e3902c12abde791729d6a5c5a01dc.exe 3548 setspn.exe 3548 setspn.exe 3548 setspn.exe 3548 setspn.exe 4104 setspn.exe 4104 setspn.exe 4104 setspn.exe 4104 setspn.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 1804 RegSvcs.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
RegSvcs.exepid process 1804 RegSvcs.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
464f44f3c9deda36ae9a4ec9043403f0546e3902c12abde791729d6a5c5a01dc.exesetspn.exesetspn.exedescription pid process target process PID 2108 wrote to memory of 1804 2108 464f44f3c9deda36ae9a4ec9043403f0546e3902c12abde791729d6a5c5a01dc.exe RegSvcs.exe PID 2108 wrote to memory of 1804 2108 464f44f3c9deda36ae9a4ec9043403f0546e3902c12abde791729d6a5c5a01dc.exe RegSvcs.exe PID 2108 wrote to memory of 1804 2108 464f44f3c9deda36ae9a4ec9043403f0546e3902c12abde791729d6a5c5a01dc.exe RegSvcs.exe PID 2108 wrote to memory of 1804 2108 464f44f3c9deda36ae9a4ec9043403f0546e3902c12abde791729d6a5c5a01dc.exe RegSvcs.exe PID 2108 wrote to memory of 1804 2108 464f44f3c9deda36ae9a4ec9043403f0546e3902c12abde791729d6a5c5a01dc.exe RegSvcs.exe PID 2108 wrote to memory of 3908 2108 464f44f3c9deda36ae9a4ec9043403f0546e3902c12abde791729d6a5c5a01dc.exe schtasks.exe PID 2108 wrote to memory of 3908 2108 464f44f3c9deda36ae9a4ec9043403f0546e3902c12abde791729d6a5c5a01dc.exe schtasks.exe PID 2108 wrote to memory of 3908 2108 464f44f3c9deda36ae9a4ec9043403f0546e3902c12abde791729d6a5c5a01dc.exe schtasks.exe PID 3548 wrote to memory of 2604 3548 setspn.exe RegSvcs.exe PID 3548 wrote to memory of 2604 3548 setspn.exe RegSvcs.exe PID 3548 wrote to memory of 2604 3548 setspn.exe RegSvcs.exe PID 3548 wrote to memory of 2604 3548 setspn.exe RegSvcs.exe PID 3548 wrote to memory of 2604 3548 setspn.exe RegSvcs.exe PID 3548 wrote to memory of 436 3548 setspn.exe schtasks.exe PID 3548 wrote to memory of 436 3548 setspn.exe schtasks.exe PID 3548 wrote to memory of 436 3548 setspn.exe schtasks.exe PID 4104 wrote to memory of 5024 4104 setspn.exe RegSvcs.exe PID 4104 wrote to memory of 5024 4104 setspn.exe RegSvcs.exe PID 4104 wrote to memory of 5024 4104 setspn.exe RegSvcs.exe PID 4104 wrote to memory of 5024 4104 setspn.exe RegSvcs.exe PID 4104 wrote to memory of 5024 4104 setspn.exe RegSvcs.exe PID 4104 wrote to memory of 512 4104 setspn.exe schtasks.exe PID 4104 wrote to memory of 512 4104 setspn.exe schtasks.exe PID 4104 wrote to memory of 512 4104 setspn.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\464f44f3c9deda36ae9a4ec9043403f0546e3902c12abde791729d6a5c5a01dc.exe"C:\Users\Admin\AppData\Local\Temp\464f44f3c9deda36ae9a4ec9043403f0546e3902c12abde791729d6a5c5a01dc.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exeC:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exeC:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegSvcs.exe.logFilesize
1KB
MD50672db2ef13237d5cb85075ff4915942
SHA1ad8b4d3eb5e40791c47d48b22e273486f25f663f
SHA2560a933408890369b5a178f9c30aa93d2c94f425650815cf8e8310de4e90a3b519
SHA51284ad10ba5b695567d33a52f786405a5544aa49d8d23631ba9edf3afa877c5dbd81570d15bcf74bce5d9fb1afad2117d0a4ef913b396c0d923afefe615619c84b
-
C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exeFilesize
2.6MB
MD5d1cd641eaa79073fd1a57c6182ef5fd9
SHA103584afbfb3afaaa8199bbfaf668ceca781eafc2
SHA256ead86094c7a67160a59998a5087726572d95588f4be839d941920f15a0fe8c90
SHA51231c63471e780357dc193e3fa368e922c547f011db9bfff6d2d28730502662e4b959a642d52d19869806e9c4b00f0009f9b7a41c60ec31c39a9a9504ba6b26454
-
memory/1804-20-0x00000000057E0000-0x00000000057EA000-memory.dmpFilesize
40KB
-
memory/1804-8-0x0000000005240000-0x0000000005250000-memory.dmpFilesize
64KB
-
memory/1804-21-0x0000000073920000-0x00000000740D0000-memory.dmpFilesize
7.7MB
-
memory/1804-22-0x0000000005240000-0x0000000005250000-memory.dmpFilesize
64KB
-
memory/1804-10-0x0000000004F20000-0x0000000004F7C000-memory.dmpFilesize
368KB
-
memory/1804-13-0x0000000005800000-0x0000000005DA4000-memory.dmpFilesize
5.6MB
-
memory/1804-14-0x0000000005110000-0x00000000051A2000-memory.dmpFilesize
584KB
-
memory/1804-17-0x00000000051F0000-0x0000000005208000-memory.dmpFilesize
96KB
-
memory/1804-16-0x00000000050F0000-0x00000000050F8000-memory.dmpFilesize
32KB
-
memory/1804-15-0x0000000005050000-0x0000000005062000-memory.dmpFilesize
72KB
-
memory/1804-19-0x00000000057A0000-0x00000000057B0000-memory.dmpFilesize
64KB
-
memory/1804-18-0x0000000005F80000-0x0000000006142000-memory.dmpFilesize
1.8MB
-
memory/1804-2-0x0000000000400000-0x00000000004EA000-memory.dmpFilesize
936KB
-
memory/1804-7-0x0000000073920000-0x00000000740D0000-memory.dmpFilesize
7.7MB
-
memory/1804-9-0x00000000029B0000-0x00000000029BE000-memory.dmpFilesize
56KB
-
memory/2108-1-0x0000000002930000-0x0000000002931000-memory.dmpFilesize
4KB
-
memory/2108-0-0x0000000000DF0000-0x000000000109A000-memory.dmpFilesize
2.7MB
-
memory/2604-31-0x0000000073920000-0x00000000740D0000-memory.dmpFilesize
7.7MB
-
memory/2604-32-0x00000000055E0000-0x00000000055F0000-memory.dmpFilesize
64KB
-
memory/2604-34-0x0000000073920000-0x00000000740D0000-memory.dmpFilesize
7.7MB
-
memory/3548-24-0x0000000000990000-0x0000000000C3A000-memory.dmpFilesize
2.7MB
-
memory/4104-36-0x0000000000990000-0x0000000000C3A000-memory.dmpFilesize
2.7MB
-
memory/5024-45-0x0000000073920000-0x00000000740D0000-memory.dmpFilesize
7.7MB
-
memory/5024-37-0x0000000000500000-0x00000000005EA000-memory.dmpFilesize
936KB
-
memory/5024-43-0x0000000073920000-0x00000000740D0000-memory.dmpFilesize
7.7MB
-
memory/5024-44-0x0000000004CB0000-0x0000000004CC0000-memory.dmpFilesize
64KB