44caliber | 60b31c2e2e564debf4560d50673a23034b4267dba853230a67550540749102bf

General

Target

60b31c2e2e564debf4560d50673a23034b4267dba853230a67550540749102bf.exe
Size

1.9MB
MD5

efeb40096e1a60f97a1258b070d49355
SHA1

133f1910684c0fe0f011c65b7e34b9c1c96ad547
SHA256

60b31c2e2e564debf4560d50673a23034b4267dba853230a67550540749102bf
SHA512

ff8728e5c1950b1f0111e738446efcb4462a7472d1bfc2466b25ccee26113e4ea4117eb8176b4e738f0b270ae678995f65785c618524fba1dab465985feac901
SSDEEP

24576:4VjAexEhMSmTVjAexEhdd74MROxnF/grrcI0AilFEvxHPE4QooFI:pGUDaMi6rrcI0AilFEvxHPEy

Score

10^/10

44caliber orcus dup rat spyware stealer

Malware Config

Extracted

Family

44caliber

C2

https://discord.com/api/webhooks/1230453187920658442/0DLiOzNARmlV9YkQawqhFddTXmXbAH-u7b6bGKX5-MD8hY4I0upEZ9kZsB7sI4nBhjEX

Extracted

Family

orcus

Botnet

Dup

C2

127.0.0.1:1268

Mutex

8986e5e934d6456b941d30af15cc57c7

Attributes

autostart_method
Disable
enable_keylogger
true
install_path
%programfiles%\Orcus\Orcus.exe
reconnect_delay
10000
registry_keyname
Orcus
taskscheduler_taskname
Orcus
watchdog_path
AppData\OrcusWatchdog.exe

Signatures

44Caliber
An open source infostealer written in C#.
stealer 44caliber
Orcus
Orcus is a Remote Access Trojan that is being sold on underground forums.
rat spyware stealer orcus

Orcus main payload 2 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\Cortex Launcher.exe	family_orcus
\Users\Admin\AppData\Local\Temp\Cortex.exe	family_orcus

Orcurs Rat Executable 7 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\Cortex Launcher.exe	orcus
behavioral1/memory/2416-14-0x0000000000400000-0x00000000005E9000-memory.dmp	orcus
\Users\Admin\AppData\Local\Temp\Cortex.exe	orcus
behavioral1/memory/2380-25-0x0000000000400000-0x0000000000548000-memory.dmp	orcus
behavioral1/memory/2648-28-0x0000000000E30000-0x0000000000F1A000-memory.dmp	orcus
behavioral1/memory/2648-33-0x0000000004C00000-0x0000000004C40000-memory.dmp	orcus
behavioral1/memory/1408-63-0x0000000000230000-0x000000000031A000-memory.dmp	orcus

Executes dropped EXE 4 IoCs

Processes:

Cartex.exeCortex Launcher.exeCortex.exeOrcus.exe

pid process

2196 Cartex.exe
2380 Cortex Launcher.exe
2648 Cortex.exe
1408 Orcus.exe

pid	process
2196	Cartex.exe
2380	Cortex Launcher.exe
2648	Cortex.exe
1408	Orcus.exe

Loads dropped DLL 5 IoCs

Processes:

60b31c2e2e564debf4560d50673a23034b4267dba853230a67550540749102bf.exeCortex Launcher.exeCortex.exe

pid	process
2416	60b31c2e2e564debf4560d50673a23034b4267dba853230a67550540749102bf.exe
2416	60b31c2e2e564debf4560d50673a23034b4267dba853230a67550540749102bf.exe
2416	60b31c2e2e564debf4560d50673a23034b4267dba853230a67550540749102bf.exe
2380	Cortex Launcher.exe
2648	Cortex.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

5 freegeoip.app
4 freegeoip.app

flow	ioc
5	freegeoip.app
4	freegeoip.app

Drops file in Program Files directory 3 IoCs

Processes:

Cortex.exe

description	ioc	process
File created	C:\Program Files (x86)\Orcus\Orcus.exe	Cortex.exe
File opened for modification	C:\Program Files (x86)\Orcus\Orcus.exe	Cortex.exe
File created	C:\Program Files (x86)\Orcus\Orcus.exe.config	Cortex.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Cartex.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	Cartex.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	Cartex.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

Cartex.exe

pid process

2196 Cartex.exe
2196 Cartex.exe
2196 Cartex.exe
2196 Cartex.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Cartex.exeOrcus.exe

description pid process

Token: SeDebugPrivilege 2196 Cartex.exe
Token: SeDebugPrivilege 1408 Orcus.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

Orcus.exe

pid process

1408 Orcus.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

Orcus.exe

pid process

1408 Orcus.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Orcus.exe

pid process

1408 Orcus.exe

pid	process
2196	Cartex.exe
2196	Cartex.exe
2196	Cartex.exe
2196	Cartex.exe

description	pid	process
Token: SeDebugPrivilege	2196	Cartex.exe
Token: SeDebugPrivilege	1408	Orcus.exe

pid	process
1408	Orcus.exe

pid	process
1408	Orcus.exe

pid	process
1408	Orcus.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

60b31c2e2e564debf4560d50673a23034b4267dba853230a67550540749102bf.exeCortex Launcher.exeCortex.exe

description	pid	process	target process
PID 2416 wrote to memory of 2196	2416	60b31c2e2e564debf4560d50673a23034b4267dba853230a67550540749102bf.exe	Cartex.exe
PID 2416 wrote to memory of 2196	2416	60b31c2e2e564debf4560d50673a23034b4267dba853230a67550540749102bf.exe	Cartex.exe
PID 2416 wrote to memory of 2196	2416	60b31c2e2e564debf4560d50673a23034b4267dba853230a67550540749102bf.exe	Cartex.exe
PID 2416 wrote to memory of 2196	2416	60b31c2e2e564debf4560d50673a23034b4267dba853230a67550540749102bf.exe	Cartex.exe
PID 2416 wrote to memory of 2380	2416	60b31c2e2e564debf4560d50673a23034b4267dba853230a67550540749102bf.exe	Cortex Launcher.exe
PID 2416 wrote to memory of 2380	2416	60b31c2e2e564debf4560d50673a23034b4267dba853230a67550540749102bf.exe	Cortex Launcher.exe
PID 2416 wrote to memory of 2380	2416	60b31c2e2e564debf4560d50673a23034b4267dba853230a67550540749102bf.exe	Cortex Launcher.exe
PID 2416 wrote to memory of 2380	2416	60b31c2e2e564debf4560d50673a23034b4267dba853230a67550540749102bf.exe	Cortex Launcher.exe
PID 2416 wrote to memory of 2380	2416	60b31c2e2e564debf4560d50673a23034b4267dba853230a67550540749102bf.exe	Cortex Launcher.exe
PID 2416 wrote to memory of 2380	2416	60b31c2e2e564debf4560d50673a23034b4267dba853230a67550540749102bf.exe	Cortex Launcher.exe
PID 2416 wrote to memory of 2380	2416	60b31c2e2e564debf4560d50673a23034b4267dba853230a67550540749102bf.exe	Cortex Launcher.exe
PID 2380 wrote to memory of 2648	2380	Cortex Launcher.exe	Cortex.exe
PID 2380 wrote to memory of 2648	2380	Cortex Launcher.exe	Cortex.exe
PID 2380 wrote to memory of 2648	2380	Cortex Launcher.exe	Cortex.exe
PID 2380 wrote to memory of 2648	2380	Cortex Launcher.exe	Cortex.exe
PID 2380 wrote to memory of 2648	2380	Cortex Launcher.exe	Cortex.exe
PID 2380 wrote to memory of 2648	2380	Cortex Launcher.exe	Cortex.exe
PID 2380 wrote to memory of 2648	2380	Cortex Launcher.exe	Cortex.exe
PID 2648 wrote to memory of 1408	2648	Cortex.exe	Orcus.exe
PID 2648 wrote to memory of 1408	2648	Cortex.exe	Orcus.exe
PID 2648 wrote to memory of 1408	2648	Cortex.exe	Orcus.exe
PID 2648 wrote to memory of 1408	2648	Cortex.exe	Orcus.exe
PID 2648 wrote to memory of 1408	2648	Cortex.exe	Orcus.exe
PID 2648 wrote to memory of 1408	2648	Cortex.exe	Orcus.exe
PID 2648 wrote to memory of 1408	2648	Cortex.exe	Orcus.exe

C:\Users\Admin\AppData\Local\Temp\60b31c2e2e564debf4560d50673a23034b4267dba853230a67550540749102bf.exe
"C:\Users\Admin\AppData\Local\Temp\60b31c2e2e564debf4560d50673a23034b4267dba853230a67550540749102bf.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2416

C:\Users\Admin\AppData\Local\Temp\Cartex.exe
"C:\Users\Admin\AppData\Local\Temp\Cartex.exe"
2⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2196

C:\Users\Admin\AppData\Local\Temp\Cortex Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Cortex Launcher.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2380

C:\Users\Admin\AppData\Local\Temp\Cortex.exe
"C:\Users\Admin\AppData\Local\Temp\Cortex.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2648

C:\Program Files (x86)\Orcus\Orcus.exe
"C:\Program Files (x86)\Orcus\Orcus.exe"
4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1408

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

System Information Discovery

2

T1082

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Orcus\Orcus.exe.config
Filesize
357B

MD5
a2b76cea3a59fa9af5ea21ff68139c98

SHA1
35d76475e6a54c168f536e30206578babff58274

SHA256
f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839

SHA512
b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad

Download Submit
C:\Users\Admin\AppData\Local\44\Process.txt
Filesize
399B

MD5
bf74415c252112e42ecd6c06decd966f

SHA1
3165fdb0929d6f47668d29dbac51498a5887baf8

SHA256
32b90f72a9c19ca2ab66ff470f7a1f24b05a6c81c8805baa6b004051a034e854

SHA512
482dbb6c5fe3bce2fa6fdd122440d88b94171ab99457441badcf7fc5965ca9cf91bce1c02181ec97da72f2050cc81cf7519b7c7f75e8c7fc046036c0c9cc9e7e

Download Submit
\Users\Admin\AppData\Local\Temp\Cartex.exe
Filesize
274KB

MD5
b0e26ccf1d3180fecd30a685d22390ad

SHA1
d20b553dea1425f5d85b6e1af23ea32c063ed3fb

SHA256
71756da4e3e8d02d44656518e3863a5477c197e991e62c785f1e0e8e739f0fe7

SHA512
4d2ba5292642e88fd0d52ae386ddcb06bdcd9478d4a594def61e84b57fb5637b97254b81ca7c457a0de43b9c32b62a25e3e2f94fe8061b30126fd966ac9b37e2

Download Submit
\Users\Admin\AppData\Local\Temp\Cortex Launcher.exe
Filesize
1.3MB

MD5
44566fbbb0f447a1560a614fec6a6988

SHA1
3a76bf992012c775e8cc5a6b54f6417b2cdc8552

SHA256
daa00b164ed37d0f65c9d54095d67405e588163ddcac190240fd9316b411231c

SHA512
8ba77aba1c1b17d357854d7531ea3786786c9495959a2ca033abcce6187cc6117c45765f246918cf34408e221a871e4c56359f38d8da5871e327543fe148d6b3

Download Submit
\Users\Admin\AppData\Local\Temp\Cortex.exe
Filesize
910KB

MD5
9fc39d72aad030cc4734b024dea538f1

SHA1
bc5ce1c73b404ca308c327b49696a6eb3da8089f

SHA256
8d55cd0abe78a6d6bb808debcae912757451129b8a99eacca0a625fe4cff4b76

SHA512
68ff6779be0290d774fe28c0b760f815934576893eff59af135dad006578dc294fd79e2d300ac812be5b4509cd4f84581bf0bbbd400ffdb8f303b2e653523277

Download Submit
memory/1408-66-0x00000000746F0000-0x0000000074DDE000-memory.dmp

Filesize
6.9MB

Download
memory/1408-65-0x0000000004D40000-0x0000000004D80000-memory.dmp

Filesize
256KB

Download
memory/1408-101-0x00000000746F0000-0x0000000074DDE000-memory.dmp

Filesize
6.9MB

Download
memory/1408-67-0x0000000000670000-0x0000000000688000-memory.dmp

Filesize
96KB

Download
memory/1408-63-0x0000000000230000-0x000000000031A000-memory.dmp

Filesize
936KB

Download
memory/1408-100-0x0000000004D40000-0x0000000004D80000-memory.dmp

Filesize
256KB

Download
memory/1408-68-0x0000000000A30000-0x0000000000A40000-memory.dmp

Filesize
64KB

Download
memory/2196-30-0x0000000000AC0000-0x0000000000B40000-memory.dmp

Filesize
512KB

Download
memory/2196-99-0x000007FEF5CE0000-0x000007FEF66CC000-memory.dmp

Filesize
9.9MB

Download
memory/2196-29-0x000007FEF5CE0000-0x000007FEF66CC000-memory.dmp

Filesize
9.9MB

Download
memory/2196-27-0x0000000000BE0000-0x0000000000C2A000-memory.dmp

Filesize
296KB

Download
memory/2380-25-0x0000000000400000-0x0000000000548000-memory.dmp

Filesize
1.3MB

Download
memory/2416-14-0x0000000000400000-0x00000000005E9000-memory.dmp

Filesize
1.9MB

Download
memory/2648-49-0x0000000000940000-0x000000000099C000-memory.dmp

Filesize
368KB

Download
memory/2648-64-0x00000000746F0000-0x0000000074DDE000-memory.dmp

Filesize
6.9MB

Download
memory/2648-53-0x0000000000470000-0x0000000000478000-memory.dmp

Filesize
32KB

Download
memory/2648-52-0x0000000000450000-0x0000000000462000-memory.dmp

Filesize
72KB

Download
memory/2648-33-0x0000000004C00000-0x0000000004C40000-memory.dmp

Filesize
256KB

Download
memory/2648-31-0x00000000746F0000-0x0000000074DDE000-memory.dmp

Filesize
6.9MB

Download
memory/2648-32-0x0000000000250000-0x000000000025E000-memory.dmp

Filesize
56KB

Download
memory/2648-28-0x0000000000E30000-0x0000000000F1A000-memory.dmp

Filesize
936KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads