Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
23-04-2024 01:31
General
-
Target
9963f8b42627725045115b76ed179f43468d4dfbfb26837e114fcdcd59e7d336.exe
-
Size
914KB
-
MD5
382b5ec3d08f531a34b67c3d37851f93
-
SHA1
18fcf2c3f7756b5cc9f43ff41dde700c5326c2a8
-
SHA256
9963f8b42627725045115b76ed179f43468d4dfbfb26837e114fcdcd59e7d336
-
SHA512
e4b89d38ea971d666c95297872363d855500e1c553bbceb83768137b3b50243423f50b563aefb0c3b18200ffcf3d283e6b2568dcbe68300ffabb78fa8e0a0ce6
-
SSDEEP
24576:P6A4MROxnFR3aTnXrZlI0AilFEvxHiXv:P6jMijkrZlI0AilFEvxHi
Malware Config
Extracted
orcus
178.20.45.159:7777
0987a51eb44e4803863e149ff474a3f6
-
autostart_method
Registry
-
enable_keylogger
false
-
install_path
%appdata%\Discord\Telegram.exe
-
reconnect_delay
10000
-
registry_keyname
tg
-
taskscheduler_taskname
tg
-
watchdog_path
Temp\Telegram.exe
Signatures
-
Orcus
Orcus is a Remote Access Trojan that is being sold on underground forums.
-
Orcus main payload 1 IoCs
-
Orcurs Rat Executable 2 IoCs
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 3 IoCs
-
Drops desktop.ini file(s) 2 IoCs
-
Drops file in Windows directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9963f8b42627725045115b76ed179f43468d4dfbfb26837e114fcdcd59e7d336.exe"C:\Users\Admin\AppData\Local\Temp\9963f8b42627725045115b76ed179f43468d4dfbfb26837e114fcdcd59e7d336.exe"1⤵
- Checks computer location settings
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4j41jhln.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3BD1.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC3BD0.tmp"3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Discord\Telegram.exe"C:\Users\Admin\AppData\Roaming\Discord\Telegram.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Telegram.exe"C:\Users\Admin\AppData\Local\Temp\Telegram.exe" /launchSelfAndExit "C:\Users\Admin\AppData\Roaming\Discord\Telegram.exe" 5068 /protectFile3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Telegram.exe"C:\Users\Admin\AppData\Local\Temp\Telegram.exe" /watchProcess "C:\Users\Admin\AppData\Roaming\Discord\Telegram.exe" 5068 "/protectFile"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
425B
MD54eaca4566b22b01cd3bc115b9b0b2196
SHA1e743e0792c19f71740416e7b3c061d9f1336bf94
SHA25634ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb
SHA512bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1
-
Filesize
76KB
MD5a22612e27f40557d6b1872b159493af5
SHA12ae7a21662f7fa2279aedeed69248ee81cf8e229
SHA25678f388820b51bb20e4da686fb86cb449f9434b2955cd67edbeb96ca3048036c0
SHA5124bcc5180cd0b40af7c9db4337ea2a34cfff75b6411e0c9656d14465e671a3b3a1875c19bb4c696033c8dc62381aeb0979c402ec5198e059c82fca02266aa2c29
-
Filesize
1KB
MD5c29ae9e196591745ee480e213aabc67e
SHA1df816bee7850e7e1406f320a122fec61cf2643a0
SHA25647aa1c01f38bb40843a1a711573ef8443803a86b6180fd44e76c9c2e42c49d43
SHA5127dfe0d306071beee8d26a01e44c49c1ebbc637736c24b14541972d3362559bd75bc37a48bf159706d45770ea361bf773f3273c0addeb701c3ad30399207e813e
-
Filesize
9KB
MD5913967b216326e36a08010fb70f9dba3
SHA17b6f8c2eb5b443e03c212b85c2f0edb9c76ad2bf
SHA2568d880758549220154d2ff4ee578f2b49527c5fb76a07d55237b61e30bcc09e3a
SHA512c6fcb98d9fd509e9834fc3fba143bd36d41869cc104fbce5354951f0a6756156e34a30796baaa130dd45de3ed96e039ec14716716f6da4569915c7ef2d2b6c33
-
Filesize
914KB
MD5382b5ec3d08f531a34b67c3d37851f93
SHA118fcf2c3f7756b5cc9f43ff41dde700c5326c2a8
SHA2569963f8b42627725045115b76ed179f43468d4dfbfb26837e114fcdcd59e7d336
SHA512e4b89d38ea971d666c95297872363d855500e1c553bbceb83768137b3b50243423f50b563aefb0c3b18200ffcf3d283e6b2568dcbe68300ffabb78fa8e0a0ce6
-
Filesize
357B
MD5a2b76cea3a59fa9af5ea21ff68139c98
SHA135d76475e6a54c168f536e30206578babff58274
SHA256f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839
SHA512b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad
-
Filesize
208KB
MD5c4ebc15b4aac7aea360bb58657aaa7ea
SHA15a3cb80f9b84dd6f4d2596e7b3217a88d30746cd
SHA2563f8824f138c700bc1b9ba6e3a1ff1b2c828e3a88611295097051c6a399eaf868
SHA51268ae1308f46e5fb57217536b9ff313063bc9aa215b4f475bc25708a684e7addd871d82465aa5c93d34e011d2f1773a30bd63c8c35f3d04f62fb4d215a962791e
-
Filesize
349B
MD58cb64fc63f044833ceb43f2dfd4dbf96
SHA1c31fa7ec4bfcd38c7d43e5ca42cab20381760bcf
SHA25620fc59a1199b0f5ad271e86c7b0ec1be4cfdc6dfcdfa9f0e4978f632f06b7669
SHA5128e553f1b10e13243d1b21feb72ae7e006de2cdb3788453495ed58487f95e255d0be33061b7b283e7ea147df5db17fcc90c03b9ebc630e7db390982c9c9e20fb6
-
Filesize
676B
MD54d28401869a7a85b8d989e3cec170714
SHA192c1d1d9fd8626ec6126bfb5e76f37ed27a50513
SHA25634ba04e01cc8c5a5a6dc4529652cd9179e9892c186fc91a1f62b35c2e5cb9f70
SHA51288a2f771ef689a0c03a5dc6604455884c6213f152cb09c45a0d2f6c6f038f86fca3dc3c912287d5dc38d61ed7ed9e133102138405d31b2a17bcb14210196eaff
-
Filesize
4.8MB
-
Filesize
624KB
-
Filesize
56KB
-
Filesize
88KB
-
Filesize
72KB
-
Filesize
32KB
-
Filesize
9.6MB
-
Filesize
368KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
32KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
10.8MB
-
Filesize
240KB
-
Filesize
64KB
-
Filesize
936KB
-
Filesize
72KB
-
Filesize
96KB
-
Filesize
72KB
-
Filesize
64KB
-
Filesize
1.0MB
-
Filesize
1.8MB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
312KB