Analysis

  • max time kernel
    959s
  • max time network
    442s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-04-2024 16:42

General

  • Target

    Extreme Injector v3.exe

  • Size

    1.9MB

  • MD5

    8a85b1dbf679febd30fe2f55a811de58

  • SHA1

    d06b7f96415b1ff21adff49ecd84b7b06f01fe6e

  • SHA256

    cfe2e6d9739a3251ed06594563f1d66e9dd018b3c74a96ca3734cca7880fb105

  • SHA512

    9b9ba49b1bc4ef056ade2146ad915eeba819485d49dd2825b4f914b68ec572304c8138f1c202508f40a0e8db8c6443270da333e323d631b27897edf915fefabf

  • SSDEEP

    49152:d4FdetMVCK1LVXXQezP3+Wgm18VeWo/Wz3XEVM:udkCCK3XXQO18VeWJLE

Malware Config

Extracted

Family

orcus

C2

s7vety-47274.portmap.host:47274

Mutex

2dfc3c3857c0466484c2056fcb13e0c9

Attributes
  • autostart_method

    Registry

  • enable_keylogger

    false

  • install_path

    %temp%\Windows Updater\updateclient.exe

  • reconnect_delay

    10000

  • registry_keyname

    WindowsUpdater

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\OrcusWatchdog.exe

Signatures

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

  • Orcus main payload 1 IoCs
  • Orcurs Rat Executable 2 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 9 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 17 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
    "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3076
    • C:\Users\Admin\AppData\Local\Temp\Update.exe
      "C:\Users\Admin\AppData\Local\Temp\Update.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:548
      • C:\Windows\SysWOW64\WindowsInput.exe
        "C:\Windows\SysWOW64\WindowsInput.exe" --install
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        PID:3468
      • C:\Users\Admin\AppData\Local\Temp\Windows Updater\updateclient.exe
        "C:\Users\Admin\AppData\Local\Temp\Windows Updater\updateclient.exe"
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of AdjustPrivilegeToken
        PID:3908
    • C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3_or.exe
      "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3_or.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:3636
  • C:\Windows\SysWOW64\WindowsInput.exe
    "C:\Windows\SysWOW64\WindowsInput.exe"
    1⤵
    • Executes dropped EXE
    PID:2308
  • C:\Users\Admin\AppData\Local\Temp\Windows Updater\updateclient.exe
    "C:\Users\Admin\AppData\Local\Temp\Windows Updater\updateclient.exe"
    1⤵
    • Executes dropped EXE
    PID:4908
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:3940
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:4296
    • C:\Windows\system32\OpenWith.exe
      C:\Windows\system32\OpenWith.exe -Embedding
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3768
      • C:\Windows\system32\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Windows Updater\updateclient.exe.config
        2⤵
          PID:964
      • C:\Users\Admin\AppData\Local\Temp\Windows Updater\updateclient.exe
        "C:\Users\Admin\AppData\Local\Temp\Windows Updater\updateclient.exe"
        1⤵
        • Executes dropped EXE
        PID:3468
      • C:\Users\Admin\AppData\Local\Temp\Windows Updater\updateclient.exe
        "C:\Users\Admin\AppData\Local\Temp\Windows Updater\updateclient.exe"
        1⤵
        • Executes dropped EXE
        PID:5108
      • C:\Users\Admin\AppData\Local\Temp\Windows Updater\updateclient.exe
        "C:\Users\Admin\AppData\Local\Temp\Windows Updater\updateclient.exe"
        1⤵
        • Executes dropped EXE
        PID:3928

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\updateclient.exe.log

        Filesize

        1KB

        MD5

        9be3069b2cf9222dde6c28dd9180a35a

        SHA1

        14b76614ed5c94c513b10ada5bd642e888fc1231

        SHA256

        5e4c38466764be178ea21ba3149d0580d25d035b57e081b3abb9c06a19cfd67a

        SHA512

        043256f38c20d8765ddf2f1d5912249bfbb017c0b630d24d9e4894f4a759dec66bf0ffaf878ac69e9dfd6db7ec5e090dd69de2333d83299ef43888c394398885

      • C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3_or.exe

        Filesize

        1.9MB

        MD5

        ec801a7d4b72a288ec6c207bb9ff0131

        SHA1

        32eec2ae1f9e201516fa7fcdc16c4928f7997561

        SHA256

        b65f40618f584303ca0bcf9b5f88c233cc4237699c0c4bf40ba8facbe8195a46

        SHA512

        a07dd5e8241de73ce65ff8d74acef4942b85fc45cf6a7baafd3c0f9d330b08e7412f2023ba667e99b40e732a65e8fb4389f7fe73c7b6256ca71e63afe46cdcac

      • C:\Users\Admin\AppData\Local\Temp\Update.exe

        Filesize

        918KB

        MD5

        8c6658a8808482bfab2b8ac9840f9e51

        SHA1

        c941721888b49c97c456af1b195a4018e4edeb0c

        SHA256

        95abbef690302956860c174bfa7ee8764f5d4379a2e13a6fd7c945ab2fd113a0

        SHA512

        4fe5a5cbf4baa919320ce2736cdac33e273719272ce76233466e98d334e94a33c8402b8656f35d4d099e3495370953fda1f943cfe07774551420eff004d3172d

      • C:\Windows\SysWOW64\WindowsInput.exe

        Filesize

        21KB

        MD5

        e6fcf516d8ed8d0d4427f86e08d0d435

        SHA1

        c7691731583ab7890086635cb7f3e4c22ca5e409

        SHA256

        8dbe814359391ed6b0b5b182039008cf1d00964da9fbc4747f46242a95c24337

        SHA512

        c496cf8e2e222fe1e19051b291e6860f31aae39f54369c1c5e8c9758c4b56e8af904e3e536e743a0a6fdbbf8478afba4baee92e13fc1b3073376ac6bf4a7948e

      • C:\Windows\SysWOW64\WindowsInput.exe.config

        Filesize

        357B

        MD5

        a2b76cea3a59fa9af5ea21ff68139c98

        SHA1

        35d76475e6a54c168f536e30206578babff58274

        SHA256

        f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839

        SHA512

        b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad

      • memory/548-40-0x00000000014A0000-0x00000000014A8000-memory.dmp

        Filesize

        32KB

      • memory/548-32-0x00007FFDE68C0000-0x00007FFDE7381000-memory.dmp

        Filesize

        10.8MB

      • memory/548-21-0x0000000000BF0000-0x0000000000CDC000-memory.dmp

        Filesize

        944KB

      • memory/548-85-0x00007FFDE68C0000-0x00007FFDE7381000-memory.dmp

        Filesize

        10.8MB

      • memory/548-31-0x0000000002FA0000-0x0000000002FFC000-memory.dmp

        Filesize

        368KB

      • memory/548-34-0x0000000001460000-0x000000000146E000-memory.dmp

        Filesize

        56KB

      • memory/548-39-0x00000000014B0000-0x00000000014C2000-memory.dmp

        Filesize

        72KB

      • memory/548-37-0x0000000001560000-0x0000000001570000-memory.dmp

        Filesize

        64KB

      • memory/2308-68-0x000000001A830000-0x000000001A93A000-memory.dmp

        Filesize

        1.0MB

      • memory/2308-66-0x00007FFDE68C0000-0x00007FFDE7381000-memory.dmp

        Filesize

        10.8MB

      • memory/2308-100-0x00007FFDE68C0000-0x00007FFDE7381000-memory.dmp

        Filesize

        10.8MB

      • memory/2308-67-0x000000001A410000-0x000000001A420000-memory.dmp

        Filesize

        64KB

      • memory/3076-3-0x00007FFDEA160000-0x00007FFDEAB01000-memory.dmp

        Filesize

        9.6MB

      • memory/3076-5-0x0000000001590000-0x00000000015A0000-memory.dmp

        Filesize

        64KB

      • memory/3076-4-0x000000001BDB0000-0x000000001BE12000-memory.dmp

        Filesize

        392KB

      • memory/3076-1-0x00007FFDEA160000-0x00007FFDEAB01000-memory.dmp

        Filesize

        9.6MB

      • memory/3076-33-0x00007FFDEA160000-0x00007FFDEAB01000-memory.dmp

        Filesize

        9.6MB

      • memory/3076-0-0x000000001BC90000-0x000000001BD36000-memory.dmp

        Filesize

        664KB

      • memory/3076-2-0x0000000001590000-0x00000000015A0000-memory.dmp

        Filesize

        64KB

      • memory/3468-56-0x0000000002DE0000-0x0000000002DF2000-memory.dmp

        Filesize

        72KB

      • memory/3468-124-0x000000001BC60000-0x000000001BC70000-memory.dmp

        Filesize

        64KB

      • memory/3468-62-0x00007FFDE68C0000-0x00007FFDE7381000-memory.dmp

        Filesize

        10.8MB

      • memory/3468-54-0x0000000000E60000-0x0000000000E6C000-memory.dmp

        Filesize

        48KB

      • memory/3468-123-0x00007FFDE68C0000-0x00007FFDE7381000-memory.dmp

        Filesize

        10.8MB

      • memory/3468-58-0x0000000002E60000-0x0000000002E9C000-memory.dmp

        Filesize

        240KB

      • memory/3468-55-0x00007FFDE68C0000-0x00007FFDE7381000-memory.dmp

        Filesize

        10.8MB

      • memory/3468-125-0x00007FFDE68C0000-0x00007FFDE7381000-memory.dmp

        Filesize

        10.8MB

      • memory/3468-57-0x000000001BBC0000-0x000000001BBD0000-memory.dmp

        Filesize

        64KB

      • memory/3636-38-0x000000001AFC0000-0x000000001AFD0000-memory.dmp

        Filesize

        64KB

      • memory/3636-99-0x000000001AFC0000-0x000000001AFD0000-memory.dmp

        Filesize

        64KB

      • memory/3636-35-0x0000000000010000-0x00000000001F6000-memory.dmp

        Filesize

        1.9MB

      • memory/3636-65-0x000000001AFC0000-0x000000001AFD0000-memory.dmp

        Filesize

        64KB

      • memory/3636-106-0x00007FFDE68C0000-0x00007FFDE7381000-memory.dmp

        Filesize

        10.8MB

      • memory/3636-93-0x00007FFDE68C0000-0x00007FFDE7381000-memory.dmp

        Filesize

        10.8MB

      • memory/3636-104-0x000000001AFC0000-0x000000001AFD0000-memory.dmp

        Filesize

        64KB

      • memory/3636-103-0x000000001AFC0000-0x000000001AFD0000-memory.dmp

        Filesize

        64KB

      • memory/3636-96-0x000000001AFC0000-0x000000001AFD0000-memory.dmp

        Filesize

        64KB

      • memory/3636-36-0x00007FFDE68C0000-0x00007FFDE7381000-memory.dmp

        Filesize

        10.8MB

      • memory/3908-88-0x000000001BA60000-0x000000001BAAE000-memory.dmp

        Filesize

        312KB

      • memory/3908-91-0x0000000001850000-0x0000000001860000-memory.dmp

        Filesize

        64KB

      • memory/3908-101-0x00007FFDE68C0000-0x00007FFDE7381000-memory.dmp

        Filesize

        10.8MB

      • memory/3908-102-0x00000000017D0000-0x00000000017E0000-memory.dmp

        Filesize

        64KB

      • memory/3908-94-0x00000000017D0000-0x00000000017E0000-memory.dmp

        Filesize

        64KB

      • memory/3908-86-0x00007FFDE68C0000-0x00007FFDE7381000-memory.dmp

        Filesize

        10.8MB

      • memory/3908-87-0x00000000017B0000-0x00000000017C2000-memory.dmp

        Filesize

        72KB

      • memory/3908-89-0x0000000001830000-0x0000000001848000-memory.dmp

        Filesize

        96KB

      • memory/3928-132-0x00007FFDE68C0000-0x00007FFDE7381000-memory.dmp

        Filesize

        10.8MB

      • memory/3928-131-0x00007FFDE68C0000-0x00007FFDE7381000-memory.dmp

        Filesize

        10.8MB

      • memory/3940-107-0x00000201223F0000-0x00000201223F1000-memory.dmp

        Filesize

        4KB

      • memory/3940-113-0x00000201223F0000-0x00000201223F1000-memory.dmp

        Filesize

        4KB

      • memory/3940-115-0x00000201223F0000-0x00000201223F1000-memory.dmp

        Filesize

        4KB

      • memory/3940-116-0x00000201223F0000-0x00000201223F1000-memory.dmp

        Filesize

        4KB

      • memory/3940-117-0x00000201223F0000-0x00000201223F1000-memory.dmp

        Filesize

        4KB

      • memory/3940-118-0x00000201223F0000-0x00000201223F1000-memory.dmp

        Filesize

        4KB

      • memory/3940-119-0x00000201223F0000-0x00000201223F1000-memory.dmp

        Filesize

        4KB

      • memory/3940-114-0x00000201223F0000-0x00000201223F1000-memory.dmp

        Filesize

        4KB

      • memory/3940-109-0x00000201223F0000-0x00000201223F1000-memory.dmp

        Filesize

        4KB

      • memory/3940-108-0x00000201223F0000-0x00000201223F1000-memory.dmp

        Filesize

        4KB

      • memory/4908-98-0x00007FFDE68C0000-0x00007FFDE7381000-memory.dmp

        Filesize

        10.8MB

      • memory/4908-92-0x00007FFDE68C0000-0x00007FFDE7381000-memory.dmp

        Filesize

        10.8MB

      • memory/4908-95-0x000000001B380000-0x000000001B390000-memory.dmp

        Filesize

        64KB

      • memory/5108-127-0x00007FFDE68C0000-0x00007FFDE7381000-memory.dmp

        Filesize

        10.8MB

      • memory/5108-128-0x000000001B2B0000-0x000000001B2C0000-memory.dmp

        Filesize

        64KB

      • memory/5108-129-0x00007FFDE68C0000-0x00007FFDE7381000-memory.dmp

        Filesize

        10.8MB