Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
23/04/2024, 01:58
General
- Target 60b31c2e2e564debf4560d50673a23034b4267dba853230a67550540749102bf.exe
- Size 1.9MB
- Sample240423-cd5xgabc94
- SHA256 60b31c2e2e564debf4560d50673a23034b4267dba853230a67550540749102bf
Malware Config
Extracted
-
44caliber
-
https://discord.com/api/webhooks/1230453187920658442/0DLiOzNARmlV9YkQawqhFddTXmXbAH-u7b6bGKX5-MD8hY4I0upEZ9kZsB7sI4nBhjEX
Extracted
-
orcus
-
Dup
-
127.0.0.1:1268
-
8986e5e934d6456b941d30af15cc57c7
-
autostart_method
Disable
-
enable_keylogger
true
-
install_path
%programfiles%\Orcus\Orcus.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
Orcus
-
watchdog_path
AppData\OrcusWatchdog.exe
Signatures
- 44Caliber
An open source infostealer written in C#.
- Orcus
Orcus is a Remote Access Trojan that is being sold on underground forums.
- Orcus main payload 2 IoCs
- Orcurs Rat Executable 5 IoCs
- Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 4 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in Program Files directory 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\60b31c2e2e564debf4560d50673a23034b4267dba853230a67550540749102bf.exe"C:\Users\Admin\AppData\Local\Temp\60b31c2e2e564debf4560d50673a23034b4267dba853230a67550540749102bf.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Cartex.exe"C:\Users\Admin\AppData\Local\Temp\Cartex.exe"2⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Cortex Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Cortex Launcher.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Cortex.exe"C:\Users\Admin\AppData\Local\Temp\Cortex.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Orcus\Orcus.exe"C:\Program Files (x86)\Orcus\Orcus.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4340 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Orcus.exe.config
Process.txt
Process.txt
Cartex.exe
Cortex Launcher.exe
Cortex.exe
memory/372-20-0x0000000000400000-0x00000000005E9000-memory.dmp
memory/516-160-0x0000000006140000-0x00000000066E4000-memory.dmp
memory/516-159-0x0000000005A70000-0x0000000005ACC000-memory.dmp
memory/516-64-0x0000000000FB0000-0x000000000109A000-memory.dmp
memory/516-162-0x0000000005C20000-0x0000000005C32000-memory.dmp
memory/516-134-0x00000000034F0000-0x0000000003500000-memory.dmp
memory/516-163-0x00000000060D0000-0x00000000060D8000-memory.dmp
memory/516-158-0x00000000034B0000-0x00000000034BE000-memory.dmp
memory/516-63-0x0000000074AF0000-0x00000000752A0000-memory.dmp
memory/516-178-0x0000000074AF0000-0x00000000752A0000-memory.dmp
memory/516-161-0x0000000005C30000-0x0000000005CC2000-memory.dmp
memory/2756-26-0x000001F06EF30000-0x000001F06EF40000-memory.dmp
memory/2756-25-0x00007FFAE92C0000-0x00007FFAE9D81000-memory.dmp
memory/2756-14-0x000001F06C990000-0x000001F06C9DA000-memory.dmp
memory/2756-186-0x00007FFAE92C0000-0x00007FFAE9D81000-memory.dmp
memory/2776-61-0x0000000000400000-0x0000000000548000-memory.dmp
memory/2992-180-0x0000000004E90000-0x0000000004EA0000-memory.dmp
memory/2992-182-0x0000000005370000-0x0000000005388000-memory.dmp
memory/2992-181-0x0000000005340000-0x0000000005352000-memory.dmp
memory/2992-179-0x0000000074AF0000-0x00000000752A0000-memory.dmp
memory/2992-187-0x00000000053F0000-0x0000000005400000-memory.dmp
memory/2992-185-0x0000000005CD0000-0x0000000005E92000-memory.dmp
memory/2992-188-0x0000000005C50000-0x0000000005C5A000-memory.dmp
memory/2992-189-0x0000000074AF0000-0x00000000752A0000-memory.dmp
memory/2992-190-0x0000000004E90000-0x0000000004EA0000-memory.dmp